Privacy Policy
Thank you for your interest in echory! This privacy policy explains how information that directly identifies you or is likely to make you identifiable is collected, used, shared and otherwise processed by echory in connection with our website and the echory platform, including our customer and account management.
This English version is a convenience translation. The German version (Datenschutzerklärung) is authoritative.
1. Scope
Echory GmbH ("echory", "we" or "us") considers the protection of your personal data an important concern. With this privacy policy, we want to inform you comprehensively, as a person affected by the processing of personal data ("you", "customer" or "user"), about how we handle your personal data.
Personal data means any information that can be used to identify a natural person directly or indirectly, or that is suitable for making a person identifiable ("personal data"). For example, a person can be identified by reference to an identifier such as a name, an identification number or location data, or by reference to individual physical, physiological, economic or cultural characteristics. Processing of personal data means any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means. Processing can therefore include, for example, collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure and destruction of data.
This privacy policy applies to the processing of your personal data when you visit our website www.echoryflow.com or contact us by post, email or telephone. It also applies to our application at app.echoryflow.com and the echory desktop app, insofar as we act as controller there as described in the following paragraphs. It does not cover the processing of personal data within the echory platform where we act as a processor for our customers; that processing is governed by the respective contractual agreements with our customers. Insofar as we process personal data as controller in connection with the echory platform (e.g. to set up and manage user accounts, to perform contracts and billing, for customer and account management in our CRM system, to send marketing and lifecycle emails, and to ensure the security and stability of the platform), this privacy policy applies. This concerns both users who take out a subscription and team members they invite. Information on the calendar integration of the echory platform can be found in our separate Calendar Integration Privacy Notice.
2. Controller
We are the controller for the processing of personal data described in this privacy policy. This means that echory determines the purposes and means of the processing of your personal data.
For all data protection enquiries, you can contact:
Echory GmbH
Graf-Adolf-Platz 15
40213 Düsseldorf
Germany
Email security@echoryflow.com
echory has currently not appointed a data protection officer within the meaning of Art. 37 to 39 GDPR. For data protection questions, please contact the address above.
3. How we collect your data
Depending on the specific processing situation, we collect and process different personal data about you.
- When you visit our website (log data). When you visit our website (www.echoryflow.com), we or our hosting provider collect log data. This data includes your internet protocol address (IP), date and time of access, the page or file requested and the amount of data transferred, browser type and version, operating system and the referring URL (referrer URL).
- Early access or demo request. When you request access or a demo via our form, we process your first and last name, your business email address, your company, your team size and your position. If you give separate consent, we also process your contact details to contact you for marketing purposes by email and/or telephone.
- Event registration. When you register for an event via our event page, we process your name, your business email address, your company, your position and the status of your registration.
- Waitlist. When you join our waitlist via the form, we process the information you enter in the form, in particular your email address, in order to inform you as soon as your access is available. The form is provided by HubSpot (see Annex 2).
- Subscription and payment processing. When you take out a paid subscription, we receive from our payment service provider your name, your email address, your billing address, the selected plan, the billing interval and the status and amount of the payment. Your payment data (e.g. card number or bank details) is processed exclusively by our payment service provider; we do not receive this data.
- Communication. When you contact us through any communication channel (e.g. by email or telephone), we may record your name, your email address, your telephone number, the name of your company, the type of your enquiry, the content of your messages and any other information you provide to us.
- Applications. If you apply for a position advertised on our careers page, you do so by email to hello@echoryflow.com. We then process the information and documents you send us, in particular your name, your contact details, the position you are applying for, your CV and, where applicable, your salary expectations and any further information you provide voluntarily.
- Cookies and tracking technologies. To operate our website, we use a technically necessary cookie to store your consent decision and cookie-free audience measurement (Plausible Analytics). In addition, with your consent we use Google Analytics 4, Microsoft Clarity, the LinkedIn Insight Tag, HubSpot and our own cookie for campaign attribution; we use Google Tag Manager to manage these services. More information on cookies and tracking technologies can be found below in Section 9.
- Use of the echory platform. When you use the echory platform (in the browser or via the echory desktop app), we process as controller in particular your account and login data (e.g. name, business email address, company, role and permissions, and information on two-factor authentication), contract and billing data, and technical usage and log data (e.g. access and security logs, device and version information of the desktop app). Content processed within the platform, in particular audio data and transcripts of live conversations and data from connected systems (e.g. CRM), we process as a processor on behalf of our customers (see Section 1). On the Basic plan, we use anonymised and aggregated data derived from customer data for internal analytics, the improvement of our product, the training and optimisation of our own AI models and aggregated market insights; anonymised data can no longer be attributed to any person. Data obtained through Google APIs, such as calendar data, is excluded from this. On the Professional and Business plans, we use customer data for these purposes only with the customer's prior written consent. Details are set out in Section 4.8.1 of our Terms of Service.
- Customer and account management (CRM) and email communication. We keep users of the echory platform, i.e. users who take out a subscription and invited team members, as contacts in our CRM system (HubSpot). In doing so, we process in particular name, business email address, company, role, selected plan and the end of the trial. We use this data for customer and account management, for support and for service messages, e.g. a reminder that your trial is ending. We only send you marketing and lifecycle emails (e.g. news about products, features and offers, and tips on using echory) if you have consented to this through the double opt-in procedure. We analyse opens and clicks to improve our emails. We store your consent and its confirmation, any withdrawal and the version of the consent text for evidence purposes. You can withdraw your consent at any time via the unsubscribe link in every email or in your profile, and you can object to processing for customer and account management in accordance with Section 8.
In most cases we collect personal data directly from you, e.g. when you visit our website, fill in a form or contact us by email. If you are invited to the echory platform as a team member, we receive your name and email address from the user who invited you. As with most websites, we and our third-party providers collect your data automatically when you use our website. Detailed information on the processing activities we carry out, the categories of personal data, the legal bases, the purposes and the duration of each processing can be found in Annex 1.
4. Purposes and legal bases of processing
The purposes and legal bases for processing your personal data may vary from case to case. In principle, we process your personal data in accordance with the General Data Protection Regulation ("GDPR") and the German Federal Data Protection Act ("BDSG") for the following purposes and on the following legal bases:
(i) For the performance of a contract or prior to entering into a contract
We process your personal data to fulfil contractual or quasi-contractual obligations, or to provide you with information at your request prior to a possible conclusion of a contract, e.g. to handle your early access or demo request or event registration, to process a subscription or to answer enquiries. The legal basis for the processing is Art. 6(1)(b) GDPR.
(ii) Compliance with a legal obligation
Where we are subject to legal obligations that require the processing of your personal data, we process your personal data for this purpose (e.g. a statutory obligation to retain data). The legal basis for the processing is Art. 6(1)(c) GDPR.
(iii) Our legitimate interests
We also process your personal data to pursue our legitimate interests (such as our legal or economic interests, the secure provision of our website or the cookie-free statistical analysis of its use), unless your conflicting interests or fundamental rights and freedoms that require the protection of your personal data override them. The legal basis for the processing is Art. 6(1)(f) GDPR.
(iv) On the basis of your consent
In some cases we process your personal data on the basis of your consent. Where we need your consent, we will tell you in advance which personal data we want to use and how we will use it. You are not obliged to give us your consent. If you have given us your consent to collect, use or share your personal data in a certain way, you have the right to withdraw your consent at any time with effect for the future. Please note that neither refusing nor withdrawing your consent has adverse consequences for you. However, without your consent we may not be able to provide certain services for which data processing is necessary. The legal basis for your consent is Art. 6(1)(a) GDPR. The legal basis for storing information on, or accessing information from, your terminal device is Section 25(1) TDDDG.
5. How long we store your personal data
We process your personal data only for as long as necessary to fulfil the purposes for which it was collected. This also covers the pursuit of our legitimate interests and statutory retention and documentation obligations that we must observe.
Once the purposes have been fulfilled, your personal data is generally deleted. Statutory retention and documentation obligations usually range between two and ten years and arise, for example, from Section 147 of the German Fiscal Code (Abgabenordnung) or Section 257 of the German Commercial Code (Handelsgesetzbuch).
On request, we delete the data collected and stored for the use of our website. We also carry out deletion ourselves at regular intervals, unless there is a particular interest in continued storage in an individual case, e.g. in the event of cyber attacks.
When determining the retention period required in each case, we take into account the amount, nature and sensitivity of the data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process your personal data and the applicable legal provisions.
Where statutory retention and documentation obligations or the protection of our legitimate interests, which override your conflicting interests, require longer retention, for example in the event of legal disputes, your personal data will also be stored and processed for a longer period. The specific retention periods for the individual processing operations can be found in Annex 1.
6. How we share your personal data
We may share your personal data with the following persons:
(i) Service providers and advisers: We share your personal data with contractors and service providers who are subject to appropriate confidentiality agreements, which may include web hosting and maintenance providers, technology support providers, email communication providers, analytics providers, data storage providers, payment service providers and developers. All service providers we use are subject to confidentiality obligations and are required to process your personal data only on our behalf and in accordance with our instructions, unless they process your data themselves as controllers (e.g. when we use the services of lawyers and tax advisers).
(ii) Corporate transactions: We may share the personal data we have collected if we sell or transfer all or part of our business or assets (including any shares) or a part or combination of our products, services or business units. In such a case, we will make reasonable efforts to ensure that all transferred data is processed in accordance with this privacy policy.
(iii) Enforcement authorities, law enforcement authorities and other authorities, government agencies and other public bodies: We may disclose your personal data to third parties if required by law or if we may reasonably assume that such action is necessary to (i) act in accordance with applicable laws and comply with requests from authorities; (ii) detect or respond to possible civil or criminal violations, such as breaches of agreements or laws; or (iii) otherwise protect the rights, property or personal safety of us, our team members or other persons.
(iv) With your consent: We may share your personal data with third parties or publish it if you give your consent to this.
Detailed information on the service providers we engage can be found in Annex 2 to this policy.
7. Transfers to third countries
It is possible that we or one of our service providers or partners process your data in a so-called third country, i.e. outside the European Economic Area, or access it from such a country (for example to carry out maintenance work). If this is the case, we ensure that your data is nevertheless subject to an adequate level of protection by applying one or more of the following safeguards:
- There is an adequacy decision of the European Commission for the country concerned (e.g. the United Kingdom) or the company concerned (e.g. companies certified under the EU-US Data Privacy Framework). With such a decision, the European Commission determines that a level of data protection essentially equivalent to that in the EU can be expected.
- We conclude the standard contractual clauses adopted by the European Commission for the transfer of personal data to third countries, where appropriate in combination with suitable additional measures. The decision and the model text of these standard contractual clauses can be found here.
- The transfer takes place on the basis of appropriate safeguards, such as binding corporate rules within the meaning of Art. 47 GDPR.
8. Your rights as a data subject
With regard to the processing of your personal data, you have the following rights:
(i) Right of access: Under Art. 15 GDPR, you have the right to obtain confirmation from us as to whether personal data concerning you is being processed by us. If this is the case, you have the right to access this personal data, in particular (i) information on the categories of personal data, the purposes of processing and information on how we determine retention periods, (ii) information on the recipients or categories of recipients to whom we disclose your personal data, in particular recipients in third countries, and (iii) under certain circumstances, a copy of the data that is the subject of the processing.
(ii) Right to rectification: Under Art. 16 GDPR, you have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you.
(iii) Right to erasure: Under Art. 17 GDPR, you have the right to obtain from us the erasure of your data without undue delay if (i) the personal data is no longer necessary for the purposes for which it was collected or otherwise processed, (ii) your data is processed on the basis of your consent and you withdraw it, (iii) you have objected to the processing under Art. 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you have objected to the processing under Art. 21(2) GDPR, (iv) your personal data is processed unlawfully, or (v) the erasure of your personal data is required to comply with a legal obligation to which we are subject.
(iv) Right to restriction of processing: Under Art. 18 GDPR, you have the right to request the restriction of processing. This means that you can request that we limit the purposes of processing. A right to restriction exists if (i) you have contested the accuracy of the personal data, (ii) the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead, (iii) we no longer need the personal data for the purposes of processing, but we need it, for example, for the establishment, exercise or defence of legal claims, or (iv) you have objected to the processing under Art. 21(1) GDPR, pending verification whether our legitimate grounds override yours.
(v) Right to information: Under Art. 19 GDPR, you have the right to be informed about the recipients to whom any rectification, erasure or restriction of processing of your personal data has been communicated.
(vi) Right to data portability: Under Art. 20 GDPR, you have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, or to request its transmission to another controller, insofar as the processing is based on your consent or a contract and is carried out by automated means.
(vii) Right to withdraw consent: Under Art. 7(3) GDPR, you have the right to withdraw consent you have given at any time with effect for the future. You can change your cookie settings at any time via the "Privacy Settings" link in the footer of our website.
RIGHT TO OBJECT UNDER ART. 21 GDPR
OBJECTION ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION
UNDER ART. 21(1) GDPR, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, TO THE PROCESSING OF YOUR PERSONAL DATA IF THIS PROCESSING IS CARRIED OUT FOR THE PURPOSES OF OUR LEGITIMATE INTERESTS, INCLUDING PROFILING BASED ON THIS (E.G. FOR CREDIT ASSESSMENT). YOUR PERSONAL DATA WILL THEN NO LONGER BE PROCESSED UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.
IN ADDITION, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO PROCESSING FOR DIRECT MARKETING PURPOSES.
CONTACT
YOU CAN DECLARE YOUR OBJECTION INFORMALLY BY POST OR EMAIL, ADDRESSED TO:
Echory GmbH
Graf-Adolf-Platz 15
40213 Düsseldorf
Germany
Email security@echoryflow.com
(viii) Right to lodge a complaint: You have the right to lodge a complaint with the competent supervisory authority against the processing of your personal data or any other decision by echory. The supervisory authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Postfach 200444, 40102 Düsseldorf, Germany.
(ix) Contact: To exercise your rights as a data subject, you can contact us informally by post or email using the contact details given in Sections 2 and 12.
9. Cookies and tracking
Cookies are small text files that are stored on your terminal device (e.g. PC/laptop, tablet or smartphone). These text files are downloaded by your browser when you visit our website. If a cookie is not deleted automatically (e.g. immediately after your visit to our website), the cookie and the information stored in it are sent back to the website that created it (first-party cookie) or to another website to which it belongs (third-party cookie) the next time you call up this website with the same device or browser. In this way, the website "recognises" that it is the same user and enables certain functions. Under the term "cookie" we also include other tracking technologies, such as local storage or so-called pixels. These technologies serve similar purposes, which is why they are treated together below. Depending on their purpose, the different types of cookies are further distinguished.
We obtain your consent through our consent dialogue, which we operate entirely on our own infrastructure using the open-source solution Klaro!. Until you make a decision, no cookies requiring consent are set. You can change or withdraw your choice at any time via the "Privacy Settings" link in the footer of every page. Further details can be found in our Cookie Policy.
Functional cookies. When we use functional cookies, we process your personal data to provide basic functions of our website and of the services you have requested, and to store your cookie settings. Without these cookies, we could not provide the website, or only with limited functionality.
We use the following cookie in this category:
Name: echory_consent
Purpose: Stores your privacy choice so that we do not have to ask again on every visit.
Data: Privacy choice.
Storage period: 6 months.
Cookie-free audience measurement. We use Plausible Analytics (Plausible Insights OÜ, Estonia). Data is collected without cookies and without storing information on your terminal device; your IP address is not stored, and a daily changing hash value that cannot be reversed is generated to distinguish visits. Only aggregated information is recorded (page visited, referral source, device type, browser, operating system, country of origin). Processing takes place on servers in the EU. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the statistical analysis of the use of our website. The script merely checks whether the entry "plausible_ignore" exists in your browser's local storage, which website operators can use to exclude their own visits from counting; the script does not create such an entry itself.
Non-functional cookies. There are also so-called non-functional cookies. These cookies, which are not functionally necessary for the operation of our website, include, for example, cookies for analysing user behaviour on websites. We only use them with your express consent, which you give via our consent dialogue and can withdraw at any time. In addition, we use Google Tag Manager (provided by Google Ireland Limited), an administration tool for controlling tracking scripts. Google Tag Manager itself does not set any cookies and, according to the information on our website, does not process any personal data; it serves solely to deliver other services technically after you have given your consent.
We use the following cookies in this category:
Name: Google Analytics 4 (_ga, _ga_<ID>)
Purpose: Distinguishing users, maintaining session state.
Data: pseudonymised user ID, page views, session data, technical device and browser data, truncated IP address, referrer URL.
Storage period: cookies 2 years; data retention in Google Analytics 14 months.
Name: Microsoft Clarity (_clck, _clsk, CLID)
Purpose: Links sessions to a Clarity user ID, combines the page views of a session and detects first-time visits.
Data: Clarity user ID, session and interaction data, technical device and browser data.
Storage period: _clck 1 year, _clsk 1 day, CLID 1 year.
Name: LinkedIn Insight Tag (bcookie, lidc, li_sugr, UserMatchHistory, AnalyticsSyncHistory)
Purpose: Browser identifier for recognition, data centre selection, probability-based recognition, synchronisation of advertising identifiers, attribution of visits to campaigns.
Data: Browser identifier, page views, technical data, where applicable attribution to your LinkedIn account.
Storage period: bcookie 1 year, lidc 1 day, li_sugr 90 days, UserMatchHistory and AnalyticsSyncHistory 30 days each.
Name: echory_attr (campaign attribution)
Purpose: Stores the channel through which you first reached our website in order to assess the effectiveness of our marketing activities. In the event of a later purchase, we transmit a pseudonymous identifier together with the purchase.
Data: Campaign parameters, referring domain, first page visited.
Storage period: 90 days.
Name: HubSpot (hubspotutk, __hstc, __hssc, __hssrc), only after your consent to the "HubSpot" option
Purpose: Recognising your browser so that we can link an enquiry submitted via a HubSpot form to your previous visits and to the source through which you found us; recording sessions.
Data: Visitor identifier, domain, timestamps of the first, last and current visit, number of sessions.
Storage period: hubspotutk and __hstc 6 months, __hssc 30 minutes, __hssrc until the end of the browser session.
10. Obligation to provide your personal data
There is no contractual or statutory obligation to provide us with your personal data in order to use our website. However, if you want to contact us, request access or a demo, register for an event, take out a subscription or use our services, certain information may be required so that we can process your request, perform the contract or contact you.
11. Automated decision-making and profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, if the decision is not necessary for entering into or performing a contract, is not required by mandatory legal provisions or is not based on your explicit consent. echory does not use automated decision-making, including profiling, in connection with the website unless we have explicitly informed you of such procedures.
12. How to contact us
Please contact us at security@echoryflow.com if you have any questions, comments or other concerns regarding this privacy policy.
13. Changes to this privacy policy
We update this privacy policy from time to time. In the event of material changes, we update the date at the beginning of this policy.
Annex 1: Description of processing operations
| Processing operation and categories of personal data | Purposes of processing | Legal bases | Retention period |
|---|---|---|---|
Visiting our website:
| To establish a smooth connection to our website To check the security and stability of the system For other administrative purposes | Legitimate interest in providing secure websites that meet users' needs (Art. 6(1)(f) GDPR). | Vercel stores runtime logs for between one hour and a maximum of 30 days, depending on the plan; they are then deleted. |
Consent management (Klaro!):
| Storing and documenting your cookie choice | Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR; Section 25(2) no. 2 TDDDG. | 6 months. |
Cookie-free audience measurement (Plausible):
| Statistical analysis of website use to improve our offering | Legitimate interest (Art. 6(1)(f) GDPR). | The random value used to generate the hash is deleted every 24 hours; after that, the hash can no longer be attributed to any visit. The aggregated statistics, which contain no personal data, are kept for as long as we use the service. |
Web analytics and marketing (Google Analytics 4, Microsoft Clarity, LinkedIn Insight Tag, HubSpot, campaign attribution):
| Analysing use and improving the usability of our website Detecting usability problems Measuring the effectiveness of our campaigns and building audiences for ads The partners (in particular LinkedIn) may also use the data for their own purposes | Your consent (Art. 6(1)(a) GDPR; Section 25(1) TDDDG), both for access to your terminal device and for the subsequent processing. | In line with the lifetime of the respective cookies (see Section 9); Google Analytics: 14 months. Microsoft Clarity: session recordings 30 days, recordings marked as favourites or randomly sampled, and heatmaps up to 9 months. Campaign attribution: 90 days. |
Early access or demo request:
| Handling your request, contacting you, preparing and setting up access or the demo With consent: information about products, features and offers by email and/or telephone | Pre-contractual measures (Art. 6(1)(b) GDPR) Legitimate interest in handling requests effectively (Art. 6(1)(f) GDPR) Marketing contact: consent (Art. 6(1)(a) GDPR) | Until the purpose no longer applies (e.g. final handling of the request), you request erasure or you withdraw your consent, at the latest three years after the last contact. |
Event registration:
| Processing the registration and organising the event Sending confirmations of receipt and attendance | Pre-contractual measures or measures preparing a contract (Art. 6(1)(b) GDPR) Legitimate interest in organising the event (Art. 6(1)(f) GDPR) | At the latest three years after the last contact, unless statutory retention obligations prevent this. |
Waitlist:
| Informing you when your access becomes available | Pre-contractual measures at your request (Art. 6(1)(b) GDPR) | Until you unsubscribe or the entry is no longer needed, at the latest three years after the last contact. |
Subscription and payment processing:
| Concluding and billing paid subscriptions Compliance with commercial and tax law obligations With consent: attributing the purchase to the marketing activity | Performance of contract (Art. 6(1)(b) GDPR) Legal obligation (Art. 6(1)(c) GDPR) Campaign identifier: consent (Art. 6(1)(a) GDPR) | Contract and invoice data for up to ten years in accordance with the periods under commercial and tax law. |
When you contact us (by email, telephone or post):
| Handling your enquiry Conducting the communication Preventing spam | Depending on why you contact us: contract or pre-contractual measures (Art. 6(1)(b) GDPR), or Our legitimate interests in handling your enquiry (Art. 6(1)(f) GDPR) | As soon as the data is no longer required to achieve the purpose, at the latest three years after your enquiry has been answered, unless statutory retention obligations prevent this. |
Customer and account management (CRM) and email communication:
| Customer and account management, support and service messages (e.g. reminder that the trial is ending); with consent: sending marketing and lifecycle emails (news, offers, usage tips) and analysing opens and clicks; evidence of consent given | For users who take out a subscription: performance of contract (Art. 6(1)(b) GDPR); for invited team members: legitimate interest in customer and account management (Art. 6(1)(f) GDPR); marketing and lifecycle emails and email tracking: consent (Art. 6(1)(a) GDPR, Section 7(2) no. 2 UWG, Section 25(1) TDDDG); evidence of consent: Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR | Contact data for the duration of the contractual relationship or use until the account is deleted, and up to three years after the end of the contract or deletion of the account; marketing data until consent is withdrawn; evidence of consent up to three years after withdrawal (regular limitation period). |
Applications:
| Conducting the application process and deciding on the establishment of an employment relationship | Section 26 BDSG, Art. 6(1)(b) GDPR | Six months after the application process has been completed; in the event of employment, for the duration of the employment relationship. |
Annex 2: List of current service providers and advisers
| Service provider | Services / data processed | Location / safeguards |
|---|---|---|
| Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA | Website hosting and form submission (serverless function). Data processed: IP address, date and time, pages or files requested, amount of data transferred, browser type and version, operating system, referrer URL; form data. | Delivery via servers in the Frankfurt am Main region (EU); provider in the USA. Safeguards: data processing agreement with standard contractual clauses; Vercel is certified under the EU-US Data Privacy Framework. |
| Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia | Cookie-free audience measurement. Data processed: aggregated information on the page visited, referral source, device type, browser, operating system, country of origin. | EU. Safeguards: data processing agreement (part of Plausible's terms of service). |
| Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland | Google Tag Manager (management of tracking scripts) and Google Analytics 4 (consent-based web analytics). Data processed: pseudonymised user ID, page views, truncated IP address, session data, browser version, device type. | EU (Ireland); USA (Google LLC). Safeguards: data processing agreement, EU-US Data Privacy Framework, standard contractual clauses. |
| Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland | Microsoft Clarity (consent-based session recordings and heatmaps). Data processed: interaction data, Clarity user ID, technical data. | EU (Ireland); USA (Microsoft Corporation). Safeguards: EU-US Data Privacy Framework, standard contractual clauses. |
| LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland | LinkedIn Insight Tag (consent-based campaign analysis and audience building). Data processed: cookie identifiers, page views, technical data, where applicable attribution to the LinkedIn account. | EU (Ireland); USA (LinkedIn Corporation). Safeguards: EU-US Data Privacy Framework, standard contractual clauses. |
| Notion Labs, Inc., 2300 Harrison St, 2nd Floor, San Francisco, CA 94110, USA | Storage and management of early access and demo requests. Data processed: name, business email address, company, team size, position. | USA. Safeguards: data processing agreement; standard contractual clauses. |
| HubSpot Ireland Limited, 1 Sir John Rogerson’s Quay, Dublin 2, Ireland | Customer relationship management (CRM) for customer and account management, sending marketing and lifecycle emails (including double opt-in and analysis of opens and clicks); management of event registrations and the waitlist. Data processed: name, business email address, company, position or role, selected plan, end of trial, consent and subscription status, open and click data, registration status; with your consent, cookie identifiers (see Section 9). | EU (Ireland); data centre in the EU (Frankfurt am Main, Germany); processing in the USA by HubSpot, Inc. cannot be ruled out. Safeguards: data processing agreement; HubSpot, Inc. is certified under the EU-US Data Privacy Framework. |
| Sendinblue SAS (Brevo), 106 Boulevard Haussmann, 75008 Paris, France | Sending confirmations of receipt and attendance. Data processed: name, email address, content of the confirmation. | EU (Belgium). Safeguards: data processing agreement (part of Brevo's terms of service). |
| Stripe Payments Europe Limited, The One Building, 1 Grand Canal Street Lower, Dublin 2, Ireland | Payment processing for subscriptions. Data processed: name, email address, billing address, plan, billing interval, payment status and amount; payment data held exclusively by Stripe. | EU (Ireland); processing in the USA by Stripe cannot be ruled out. Stripe processes the data for payment processing on our behalf and, for its own purposes such as fraud prevention and compliance with its own legal obligations, as an independent controller. Safeguards: standard contractual clauses, where applicable EU-US Data Privacy Framework. |
| Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg | Hosting of the echory platform and sending of the platform's transactional emails (e.g. invitation and setting the password). Data processed: account and login data, contract data, technical usage and log data. | EU (Frankfurt am Main, Germany). Safeguards: data processing agreement. |
| INSTRAT Technology ApS, Denmark | Software development, maintenance and technical support of the echory platform with task-related and logged access. Data processed: account and usage data, insofar as required for the respective task. | Denmark (EU); remote access from Bangladesh. Safeguards: data processing agreement; standard contractual clauses for remote access. |
| Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland | Microsoft 365 for email communication and document storage. Data processed: content and metadata of your emails to us, e.g. for enquiries and applications. | EU; processing in the USA by Microsoft Corporation cannot be ruled out. Safeguards: data processing agreement, EU-US Data Privacy Framework, standard contractual clauses. |
| Tax advisers and lawyers | Tax and legal advice, accounting. Data processed: as required for the respective advice, e.g. contract and invoice data. | Independent controllers subject to professional secrecy obligations. |