BISpicy Inventory Management - Cloud Software
Data Controller within the meaning of the General Data Protection Regulation (GDPR):
(1) This Privacy Policy informs you about the type, scope, and purpose of the processing of personal data within our software "BISpicy Inventory Management" and the associated online services.
(2) Legal basis:
What data is collected?
Legal basis: Art. 6(1)(b) GDPR (contract performance)
Storage period: Until account deletion + 30 days
Proof of the business declaration and the terms: When you register, or when you provide the confirmation afterwards, we store on your user account that the business declaration (§ 14 German Civil Code) was made and the terms and conditions were accepted, together with the version of the terms, the time (UTC) and the way of confirmation (e.g. registration in the customer center, in the POS app or in BISpicy ERP, login with Google, confirmation provided afterwards in BISpicy ERP or in the customer center). Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (our legitimate interest in being able to prove that we supply only to businesses and under which version of the terms). Storage period: as for the user account, i.e. until account deletion + 30 days.
Documentation of deletion requests: If a customer requests deletion of its tenant (Art. 17 GDPR or Art. 28(3)(g) GDPR) or destruction of an existing backup, we document the request: company name, customer number, identifiers of tenant, request and user accounts as well as the database name, channel and time of receipt, the evidence text, the person who recorded it, the customer's confirmation including its choice (data package or waiver) and – for the destruction of a backup – the express declaration and the company name entered. We store the recipient's e-mail address only in shortened form and as a check value (SHA-256); the address for the closing e-mail only until it has been sent. Legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 5(2) and Art. 24(1) GDPR (proof that we fulfilled the request or instruction) and Art. 6(1)(f) GDPR (our legitimate interest in being able to prove this in a dispute); to this extent there is no right to erasure of this record (Art. 17(3)(b) and (e) GDPR). Where we rely on Art. 6(1)(f) GDPR you may object (Art. 21 GDPR). Storage period: ten years from the end of the year in which the request was executed, withdrawn or not confirmed; afterwards we delete the record automatically. Copies in the routine backups of our database service are overwritten after seven days at the latest.
What data is processed?
Note: This data is processed on behalf of the customer (data processing agreement pursuant to Art. 28 GDPR).
Fault diagnosis (error logs): To detect and resolve technical faults, we log error events from server operation and from the user's browser (error message, technical call chain, timestamp, page accessed, browser identification, user ID). Access credentials, tokens and payment information are automatically redacted before storage. Detailed troubleshooting recording beyond error events takes place only for a limited time (maximum 72 hours), only upon express instruction with a documented reason, and ends automatically. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in fault-free operation) or Art. 28 GDPR within the scope of data processing. Retention period: error events 14 days, other technical operational data 3 days; automatic deletion thereafter.
Card payment diagnostics (payment trace log): The POS app keeps a 48-hour process log of payment transactions on the device (payment method, card type, masked card number, amount, terminal result); it is only transmitted to us upon explicit request with a documented reason, where it is deleted after 60 days. In addition, in the case of an uncertain payment, the cashier can, on their own initiative, send us an incident report from the dialog (voluntarily, after explicit confirmation). It contains the card terminal receipt (merchant receipt) with the card number truncated to the last four digits, the terminal ID (T-ID), time and amount as well as other details printed on the receipt (e.g. card expiry date, authorisation, trace and receipt number, merchant number (VU number), EMV data) and the process log of the transaction. The purpose is to clarify whether the card was charged. The card number is truncated in the POS app and again on our server; the full number is not stored. Legal basis: we process the report on behalf of the merchant (Art. 28 GDPR); for the merchant, the processing is based on Art. 6(1)(b) GDPR (processing of the payment transaction) or Art. 6(1)(f) GDPR (legitimate interest in clarifying uncertain payments). The report is filed as a support case; the receipt text is deleted automatically 18 months after the case is closed (if not closed: 18 months after creation), at the latest when the business account is deleted.
Device purchase (§ 25a German VAT Act / margin scheme): When an operator buys used devices at the till (POS app or web POS), for example a phone shop, we process the related data on its behalf. The operator concerned is responsible; we act as its processor (Art. 28 GDPR). Please direct requests about your rights to the operator; requests addressed to us we forward. Which data: The purchase ledger contains details of the seller (name, address, telephone number and e-mail address if provided, as well as ID number and date of birth if recorded), of the device (description, IMEI or serial number, purchase and sale price, time) and of the payout (payment method, transaction reference, cancellation). The purchase ledger is kept in BISpicy ERP; the POS app transfers its purchases there. In BISpicy ERP, the ID number and date of birth are visible only to persons with a dedicated permission, and every access is logged. The POS app also adds name, address and contact details to the operator's customer file, but never the ID number, date of birth or ID copies. At the operator’s request, the POS app sends a purchase receipt with these details, including the ID number and date of birth, as a PDF by e-mail to the address entered; if the operator has no mail server of its own, it is sent via our server without us storing the content. If the operator pays out a purchase via PayPal, we transmit the seller's PayPal e-mail address and the amount to PayPal via the operator's PayPal connection and store both with the transaction. Reading the ID and ID copy: Only with the consent of the ID holder does the POS app read the machine-readable zone and, where printed, the address with the camera, or take a copy of the ID (Section 20(2) of the German Identity Card Act, PAuswG; for passports Section 18(3) of the German Passport Act, PassG). Text recognition runs on the device; the camera image is not stored. Of the ID copy, the POS app stores only a version on which details that are not needed are blacked out and which is marked as a copy. ID copies and photos of the device's condition remain on the till device; they are currently neither transmitted to us nor included in the POS app's cloud backup. Without consent, the details are copied by hand from the ID presented. Pending purchases: A pending purchase that has not yet been completed is not transferred to BISpicy ERP. It is stored in the POS app's database and, if the operator uses the POS app's cloud backup, also in those backups. The POS app removes the personal data of a pending purchase immediately when it is discarded, otherwise no later than 30 days after it was created; they are kept only if they are the sole proof of a payout. Legal basis: The operator determines it as the controller. As a rule, this is Art. 6(1)(b) GDPR for the purchase, the pending purchase and the payout (contract with the seller), Art. 6(1)(c) GDPR in conjunction with § 25a(6) UStG and § 147 AO (German Fiscal Code) for the tax records and vouchers (device, prices, payout), and Art. 6(1)(f) GDPR for the ID number and date of birth (legitimate interest in being able to prove where the device came from and to prevent the purchase of stolen goods) and for adding the seller to the customer file (legitimate interest in a single customer file, so that purchases, sales and repairs of the same person are linked). Where the operator relies on point (f), the seller may object on grounds relating to his or her particular situation (Art. 21 GDPR). If the seller does not want to be added to the customer file, the POS app does not create a customer. Reading the ID with the camera and the ID copy additionally require consent (Section 20(2) PAuswG, for passports Section 18(3) PassG, Art. 6(1)(a) GDPR); consent is voluntary and can be withdrawn at any time with effect for the future (Art. 7(3) GDPR). Retention period: The operator determines how long the data are kept; as a rule, it must keep tax records and vouchers for eight or ten years (§ 147(3) AO). We store the data on its behalf for as long as it uses our software; deletion after the end of the contract is governed by the data processing agreement. We delete cloud backups of the POS app after the period set by the operator (30 days by default, at most 365 days). The POS app informs the ID holder of the purpose and deletion period of an ID copy before it is taken.
Email delivery of receipts, invoices and reports: On request, we send point-of-sale receipts, digital receipts and invoices (e.g. from the connected POS app) by email to the email address provided by the customer. Operators and authorised employees may also have reports, analyses and documents sent to a self-configured or operator-designated email address (email export, automatic report delivery, see below). We process the respective email address to deliver the requested document and, for the operator who sends it, to document the sending. Legal basis: Art. 6(1)(b) GDPR (contract performance) or (f) GDPR (legitimate interest in the requested delivery); The operator concerned is responsible for sending receipts to its customers; we act as its processor (Art. 28 GDPR). When a digital receipt is sent as a link, the address is not stored; to protect against abusive mass sending we only retain a non-reversible check value of the address for two days, plus the time, till and receipt of the sending for 90 days. Legal basis: Art. 6(1)(b) GDPR (issuing the receipt in the form requested by the customer as part of the purchase) and, for the check value, Art. 6(1)(f) GDPR (prevention of abuse). The transfer is made solely to our server or to the mail service provider configured by the operator (a processor for delivery only); no disclosure to third parties for their own purposes takes place. Dispatch log: For emails that an operator sends to its customers via BISpicy ERP (such as invoices, order confirmations and quotations, including DIN A4 invoices from the POS app), we keep a log on its behalf containing recipient and copy addresses, subject, time, document and dispatch result; we do not store the content or attachments in it, and we do not record delivery or reading. The operator concerned is responsible; we act as its processor (Art. 28 GDPR). Please direct requests about your rights to the operator; requests addressed to us we forward. Retention period: entries on invoices, orders, order confirmations and quotations that are assigned to a customer and were accepted by the mail server: until the end of the sixth calendar year after the year of sending; all other entries: 90 days. When a digital receipt is sent as a link, the address is not stored (see above).
Automatic report delivery: Businesses with Insights (reports) can have monthly POS reports sent to up to five recipients they name (e.g. their tax advisor). The respective business is the controller; we act as its processor (Art. 28 GDPR). Before the first delivery, the recipient confirms receipt themselves via link. We store the e-mail address, the times of consent, refusal and unsubscribe, who entered the recipient, the delivery record and a change log; we delete this data three years after the recipient was removed. Every e-mail contains an unsubscribe link. Please direct requests regarding your rights to the business; requests addressed to us are forwarded.
Change of the login e-mail address: If a person changes their e-mail address in the Customer Center, we store, to secure the account, the previous and the new address, the time, a shortened IP address and the confirmation code only as a check value. The change takes effect only once the link sent to the new address has been confirmed; the previous address receives a notice. The legal basis is Art. 6(1)(b) GDPR (contract) and point (f) (protection against account takeover). Retention period: 90 days, followed by automatic deletion.
Login protection and login log: To protect against password guessing, we temporarily throttle password logins (BISpicy ERP, customer center, POS app, warehouse app, web POS, tax advisor access, super-admin area) after failed attempts. A block lasts 60 minutes at most and increases in steps starting at one minute. For this we count failed attempts per account and IP address, per IP address and per account. The counter per account and IP address also records when a login from that location last succeeded: anyone who has logged in successfully from a location within the last 30 days is not locked out there by failed attempts of third parties. Only pseudonymous counters (HMAC-SHA256 check values) are stored; the e-mail address and IP address are not stored there in plain text. In the daily deletion run we delete counters per IP address and per account as soon as 25 hours have passed since the last event and no block is active, and counters per account and IP address 31 days after the last event. We are responsible for these counters. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is the security of accounts and systems (recital 49, Art. 32 GDPR). You may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR).
For a successful login, a failed attempt and the start of a block we also write an entry with e-mail address, IP address and browser or app identifier to the login log of the business for which the user account exists. If an active account exists under the same e-mail address at several businesses, each of these businesses receives the entry for the failed attempt. Nothing is logged for unknown e-mail addresses. For a successful login we store the time, IP address and number of logins on the user account. Authorized users of the business see the login log in the user administration. The respective business is the controller for the login log and the details on the user account; we process them as its processor (Art. 28 GDPR). Please send requests concerning your rights to the business; requests addressed to us are forwarded. Storage period: login log 90 days, then automatic deletion; the IP address of the last login on the user account 90 days at most. For every login we keep a session with device name or browser identifier, device type, IP address and times; the same applies to sessions as to the login log (the business is responsible, we act as its processor). Ended or expired sessions are deleted 90 days after they end; in the usage history of the sessions we clear the email address and device name after the same period. Password reset links and invitation links are deleted seven days after they expire; an expired, unaccepted invitation to link an existing account remains as a note without an e-mail address. We also evaluate the time of last use under our own responsibility in order to determine the use of your business (billing by devices, inactivity before a deletion, offloading of dormant accounts); the legal basis is Art. 6(1)(b) GDPR where you are our contractual partner yourself, otherwise point (f); our legitimate interest is correct billing, the detection of inactive accounts and a stable, resource-efficient operation of our servers. If a business has not been used for 30 days and has neither a running licence nor a subscription, we may offload its database in encrypted form; on the next access we make it available again unchanged (details in the data processing agreement under “Dormant accounts”). We keep the record of this (times and last use of the business) until the business is deleted. We keep the device identifier and times of the sessions until the business is deleted, and the use per person and day for as long as we have to prove the billing. You may object to this processing on grounds relating to your particular situation (Art. 21 GDPR).
Device log of the POS devices: When a POS device in your business is decommissioned, deleted, signed out or released for re-pairing, we record in the business's tenant: the device, the action, the time, the person ID and role of the acting person, the shortened IP address (IPv4 to the /24 network, IPv6 to the /48 network), whether the device was in operation at that time, the device's last contact and, for an action by our support, an identifier of the super-admin access. The purpose is the traceability of security-relevant interventions in the POS system. The IP address is stored only in shortened form and is not shown in the customer center; actions by our support appear there as “BISpicy-Support”. The log is visible to users of the business with the right “Edit POS sync”. The respective business is the controller; we process the data as its processor (Art. 28 GDPR). Please address requests about your rights to the business; requests addressed to us we forward. Storage period: We remove the personal reference (acting person, role, shortened IP address, super-admin identifier) after 90 days. We keep device, action, time, operating state and the indication whether our support acted, for as long as your business uses BISpicy, until the end of the tenth calendar year after the entry as evidence towards the tax authority (§ 146a (4), § 147 AO, Germany) and then delete them automatically. The log serves solely as evidence of these interventions and is not intended for monitoring the performance or behavior of employees.
Protection of registration and “forgot password”: We also limit the number of requests for registration, for requesting the confirmation email again and for a link to reset the password. To do so, we count requests per IP network (one IPv4 address or one IPv6 /64 network), newly created accounts additionally per IPv4 address or IPv6 /48 network and, for spelling variants of the same address, per mailbox (email address in a normalized spelling: upper and lower case and a suffix after a plus sign are not distinguished), emails for resetting or re-confirming per existing user account and, without personal reference, the total number of newly created businesses per hour and per 24 hours and the total number of these emails per hour. Only pseudonymous counters (HMAC-SHA256 check values) are stored; the email address and the IP address are not stored there in plain text. We delete the counters in the daily deletion run once 25 hours have passed since the last event and no block is active. We take the number of newly created businesses from the business data (time of creation), without any personal reference. We are responsible for these counters. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is protection against the automated mass creation of accounts and against the sending of unwanted emails to third parties (Recital 49, Art. 32 GDPR). You may object to this processing on grounds relating to your particular situation (Art. 21 GDPR). We send a welcome email only once your email address is confirmed: via the link in the confirmation email or in an email for resetting the password or, when you log in with Google, by Google. The confirmation email itself contains no details from the registration form.
Login with Google (optional): With your Google account you can register and log in to BISpicy ERP, the customer center, the POS app and the warehouse app, and log in to the Archive, the web POS and BISpicy Parcel Station. Your browser or app is redirected to Google for this; we do not receive your Google password. From Google we receive your name, your email address, the identifier of your Google account, the information whether Google has confirmed the email address and, if stored, the address of your profile picture (we do not store the profile picture). If the login has to go to Google a second time (for example after the terms have been confirmed), we pass the email address of the Google account you just chose as a sign-in hint so that you do not have to select it again. For this process we set a session cookie that ends with the browser session; it is strictly necessary (Section 25(2) no. 2 TDDDG). We create an account, or link it to an existing account, only if Google reports the address as confirmed. Google processes data under its own responsibility in accordance with the Google privacy policy. Legal basis: Art. 6(1)(b) GDPR where you yourself are our contractual partner (carrying out the login you chose), otherwise Art. 6(1)(f) GDPR; our legitimate interest is to offer you the login you chose in a secure way. Where we rely on point (f), you may object (Art. 21 GDPR). Storage period: Google identifier and confirmation status until the account is deleted. Logging in with email address and password is equally possible. Logging in with Google does not give us access to your Gmail mailbox; Gmail mailboxes are connected to the Archive only via IMAP (section 3.15).
Login via your employer's identity service: If it is set up for your business, you can log in with your employer's identity service (currently Microsoft Entra ID). The service belongs to your employer, not to us: it checks your credentials and, where applicable, a second factor; we do not receive your password. Your browser is redirected to the service for this; processing there is governed by your employer's agreement with the service provider. In doing so we pass the e-mail address entered on our login page to the service as a sign-in hint; in addition, to limit abuse, we count login steps per network for ten minutes using a pseudonymised check value (HMAC) of the IP address (we are responsible for this ourselves, Art. 6(1)(f) GDPR). We receive and store the identifier of the organisation and your object identifier in the directory, the role in BISpicy ERP derived from the application role assigned to you (we check the application role itself at every login), the indication whether the service confirmed multi-factor authentication, and, at first login, name and e-mail address if an account is newly created for you. We match you solely by organisation and object identifier, never by e-mail address. The respective business is responsible for the account and role details in BISpicy ERP; we process them as its processor (Art. 28 GDPR). Please direct requests concerning your rights to the business; requests addressed to us are forwarded. Legal basis: for the account and role details, the business determines the legal basis as the controller. Storage period: identifiers until the link is removed or the account is deleted; the log of set-up and linking (who established, removed or changed which connection, and when) until the account or the business is deleted; rejected logins in the login log 90 days. Automatic user sync (SCIM 2.0), if your business sets it up: Your employer's identity service transmits to us your name, e-mail address, your login name in the directory, your object identifier and whether your account is active; we then create your account, keep these details up to date and deactivate the account when your employer removes you there – all sessions with your user account then end (a register PIN is blocked separately by your business). Matching uses the object identifier only, never the e-mail address. We adopt the transmitted e-mail address only if it belongs to the domain of your login name; otherwise we use your login name. We process these details as your business's processor (Art. 28 GDPR), which determines the legal basis. In addition we store the active status according to the directory and, where your business has switched on role takeover, the assigned role; your directory can retrieve these details (name, e-mail address, login name, active status) from us. We delete a log of the sync without e-mail addresses after 90 days, and the person's sync status as soon as the link is removed, the connection is disconnected or your account is deleted; entries in the user log remain until the account or the business is deleted. Removal in the directory deactivates your account; only the business deletes it.
Tour tracking in the warehouse app (“Tour” mode) and in the driver view in the browser (if your business uses it): If your business delivers with its own vehicles and uses tour tracking, drivers scan the parcels at loading and at handover. This produces, per parcel, times and a result, an expected arrival per delivery point (calculated, without location tracking and without GPS) and, per stop, a proof of delivery with the name and signature of the person receiving the goods, reservations, remarks and photos of the goods and of the drop-off place. The business is responsible; we process these data on its behalf (Art. 28 GDPR) and create no evaluations or rankings per person. The business’s customers see in the customer portal and by email the times of pick-up, arrival and handover and the expected arrival, never the name of the driver; they can retrieve the receipted delivery note with the name and signature of the person receiving the goods in the portal. If the business has switched it on, we also send the receipted delivery note for its own deliveries after handover, in its name, as a PDF (without photos) to the email address of the order, including to private customers, but not if deliveries for different customers are handed over at one stop. Likewise only if the business has switched it on, the person receiving the goods can acknowledge receipt on their own phone: the driver’s device shows a QR code with a link that is valid for 10 minutes and only once; the page shows the business’s privacy information, sets no cookies and stores no data on the phone. We are ourselves responsible for the access log of our web server when this page is opened (section 3.8). Your business informs you about the processing; before switching it on, it confirms that the involvement of the employee representation body, where one exists, has been clarified. Storage period: we remove the reference to the driver in the scans 12 months after the delivery day, and on the proof of delivery at the end of the third calendar year after handover; we delete photos after 12 months (in the case of a reservation or a delivery left at the drop-off place, handed over damaged or refused, at the end of the third calendar year after handover), and name, signature and receipted delivery note six years after the end of the calendar year of handover. Handovers not yet transmitted remain on the driver’s device in the storage of the app or the browser until they are transmitted or discarded; in the driver view in the browser, rejected and discarded handovers remain visible for up to seven days and are deleted the first time it is opened after that. We delete a link for acknowledging receipt on one’s own phone 24 hours after it expires or after the handover is completed. If the handover is completed with it, name, signature and reservation are included in the proof of delivery; otherwise we delete them with the link, but a reservation entered there is included in the proof of delivery of that stop. We delete the entry for the email with the receipted delivery note in our e-mail dispatch log after 90 days. Please direct requests concerning your rights to the business; requests addressed to us are forwarded.
Appointments can be booked online via our appointment planner: appointments with us via our booking page bispicy.com/app/booking/bispicy, appointments with businesses that use the appointment planner via their booking page at https://bispicy.com/app/booking/<business>. You receive a confirmation by email if you provide an email address; the business you book with (for appointments with us: we) is notified of the booking.
Arranging a call-back: On our contact pages bispicy.com/kontakt.html and bispos.app/kontakt.html you can book a telephone call-back from us. The booking runs via the same appointment planner; your details are sent to our server at bispicy.com. We are the controller (contact details in section 1). Name and telephone number are mandatory, as we cannot call you without them. The email address is optional. If you provide it, we will only write to you there about this appointment: the confirmation, where applicable a reminder before the appointment, and a message if we have to cancel or change the appointment. We do not send advertising to this address.
Protection against misuse: For every online booking in the appointment planner, including via a business's booking page, and for every online table reservation via a restaurant's reservation page on bispos.app, we store the IP address from which it was sent. This allows us to limit the number of bookings per sender and hour, in the appointment planner also across all businesses, and to investigate accumulated or fictitious bookings afterwards. We set this protective measure uniformly for all businesses; we are therefore always the controller for the IP address, even if you book with a business. We do not pass it on to the business. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting the booking pages and calendars against mass or fictitious bookings. We delete the IP address after 7 days at the latest; the booking itself remains. You can object to this processing on grounds relating to your particular situation (Art. 21 GDPR, section 6 “Right to object”); please contact us for this, even if you booked with a business.
What data is processed?
Purpose: Scheduling, confirming and handling the booked appointment, for a call-back the call. Via the appointment planner, only messages about this appointment are sent to your email address: the confirmation and, depending on the business's settings, a reminder before the appointment as well as messages in the event of cancellation or change. We use the IP address exclusively for protection against misuse (see above).
Controller: For bookings via our own booking page (bispicy.com/app/booking/bispicy) and for call-backs via our contact pages we are the controller. Businesses that use the appointment planner for their own customers, and restaurants that accept table reservations via their reservation page on bispos.app, are themselves controllers for these bookings or reservations; in that case we process the data on their behalf (data processing pursuant to Art. 28 GDPR). Please direct any questions or requests regarding them to the respective business. The IP address is an exception: we are the controller for it also for these bookings (see “Protection against misuse”).
Legal basis: For appointments with us and call-backs, Art. 6(1)(b) GDPR (steps prior to entering into a contract, taken at your request, or performance of the contract), insofar as you yourself are or wish to become our contractual partner. If you book on behalf of a business that is or wishes to become our customer, for example as its employee, Art. 6(1)(f) GDPR (legitimate interest in answering enquiries from our customers and prospective customers). For the IP address, Art. 6(1)(f) GDPR applies (see “Protection against misuse”). The processing is not based on consent. For bookings with a business, the business determines the legal basis; details can be found in its privacy policy.
Storage period: We store appointments with us and call-backs for as long as they are needed for scheduling and handling the appointment, and beyond that only insofar as statutory retention obligations exist. We store bookings with businesses on their behalf; the business decides for how long, and deletion after the end of its contract with us is governed by the data processing agreement. We delete the IP address after 7 days at the latest. We log the sending of emails about an appointment without their content (recipient address, subject, time, result) and delete these entries after 90 days.
In the customer portal (Kundencenter) on bispicy.com you take part in promotions – currently the BISpicy Startaktion (launch promotion) for businesses of all sectors that are new to BISpicy, which offers a starting credit of €15 and – for businesses that take in repairs – free months for the repair status page. No application or receipt is required.
What data is processed?
Purpose: Carrying out the promotion (activating and extending the repair status page; checking, crediting and offsetting the starting credit; review and correction at your request; and, where applicable, reclaiming the credit in the event of abuse).
Legal basis: Art. 6(1)(b) GDPR (carrying out the promotion in accordance with the promotion terms).
Evaluation of promotion codes: We store the promotion code you redeemed together with your participation. We evaluate this information only in aggregate form (number of participations per code) to see which of our advertising works; we do not pass it on to SumUp or other third parties. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is the planning of our advertising. You may object to this evaluation at any time (Art. 21 GDPR); your participation remains unaffected. We delete the code together with your participation.
Automated check, crediting and offsetting: Each day, the system checks whether the requirements for the free months and the starting credit are met, using the criteria stated in the promotion terms (paid TSE licence, first SumUp card payment – terminal or Tap to Pay –, turnover threshold); if they are met, it activates the status page or credits the balance without any further action and then automatically applies the credit as a customer balance at Stripe to your next invoice. The system decides on the forfeiture of the starting credit only from 3 February 2027 onwards, so that daily closings transmitted late with payments up to 31 January 2027 are still taken into account. The check relies solely on these criteria, which are the same for all participants, does not evaluate you as a person and can only grant or not grant a benefit. Insofar as it constitutes an automated decision within the meaning of Art. 22 GDPR, it is necessary for carrying out the promotion (Art. 22(2)(a) GDPR). In any case, you have the right to obtain human intervention, to express your point of view and to contest the decision (Art. 22(3) GDPR): upon your message, a member of staff reviews the case and may credit the balance subsequently or – as long as it has not yet been offset – reverse it; we record the reason, the time and the person handling the case. Simply contact us (see contact details below).
Offsetting via Stripe: For the offsetting, Stripe Payments Europe Ltd. (see Section 4) receives the amount, internal identifiers (user, booking and participation identifiers plus a technical key preventing duplicate bookings) and your Stripe customer number; Stripe already receives your payment data for the billing of your licences.
Disclosure to SumUp: SumUp only receives aggregated figures on the promotion without names or details of individual participants – and a figure only if it is based on at least five participants.
Storage period: We store participation, check and correction data for as long as benefits under the promotion may be granted or claims arising from it exist, and beyond that only insofar as statutory retention obligations require. The crediting of the balance and its offsetting are accounting records and are retained under Section 147 of the German Fiscal Code (AO) until 31 December of the eighth year after the year in which the credit was granted.
Businesses that operate a BISpicy Shop hosted by us have the legally required electronic withdrawal function ("Withdraw from contract", Section 356a German Civil Code) in their shop. If you use this function as a customer of such a shop, the respective merchant is the controller; we process the data on its behalf (processing under Art. 28 GDPR). Please direct questions and requests to the merchant.
Which data is processed?
Purpose: Receipt, confirmation and proof of the withdrawal; where the shop is connected to BISpicy ERP, transfer as a return.
Storage period and location: The statement is kept in the shop database on our servers (DigitalOcean, Frankfurt) and stored for three years from the end of the year of receipt; after that we delete it automatically, and a retention hold may suspend the deletion. Where the shop is connected to BISpicy ERP, the withdrawal is additionally transferred as a return; commercial and tax-law retention periods apply to it.
E-mail delivery: The confirmation of receipt is sent to the e-mail address you provided, and a notification to the merchant. Delivery runs via the merchant's own SMTP access, otherwise via our system mail server (Hetzner Online GmbH, Germany). The withdrawal e-mails contain only a short summary, never the reason or free text. Further information, in particular on the legal basis, can be found in the privacy policy of the respective merchant.
Businesses that operate a BISpicy Shop hosted by us use our servers for this (DigitalOcean, Frankfurt). If you buy from such a shop as a customer, create a customer account there or use the shop's contact form, the respective merchant is the controller; we process the data on its behalf (processing under Art. 28 GDPR). Please direct questions and requests to the merchant.
Which data is processed?
Purpose: Operating the shop on the merchant's behalf (customer account, order processing), sending the order confirmation and the e-mails about the customer account and password, and forwarding your contact enquiry to the merchant.
Storage period: The contact form stores neither your message nor your address; the message is only forwarded to the merchant's contact e-mail address. Only the pseudonymous check value (HMAC) of your IP address is stored as counter key for the sending limit; we delete it after 25 hours at the latest. We delete entries for account and password e-mails (without e-mail address and without token in plain text) after 7 days. For each order confirmation sent we keep a proof of dispatch without the e-mail address: pseudonymous check value (HMAC) of the recipient address, checksum of the content, and the versions of the e-mail templates, the withdrawal instructions, the general terms and conditions and the shipping and payment terms. It is retained for six years from the end of the calendar year (Section 257(1) no. 3, (4) and (5) German Commercial Code; Section 147(1) no. 3, (3) and (4) German Fiscal Code). We keep the proof of dispatch on the merchant's behalf; it enables the merchant to demonstrate compliance with its information duties (Section 312m(2) German Civil Code). The legal basis is determined by the merchant as controller; details can be found in the merchant's privacy policy. We store customer accounts and orders until the merchant deletes them or instructs us to delete them; the merchant decides how long they are kept.
E-mail delivery: Delivery runs via the merchant's own SMTP access, otherwise via our system mail server (Hetzner Online GmbH, Germany). Further information, in particular on the legal basis of the processing by the merchant, can be found in the privacy policy of the respective merchant.
We operate a demo shop ourselves at shop.bispicy.com, in which we demonstrate the BISpicy Shop software. We are the controller within the meaning of the GDPR for this demo shop (contact details under section 1); section 3.6 does not apply there. The demo shop serves demonstration purposes: we do not fulfil, charge for or deliver orders placed there. Please use fictitious details for test accounts and test orders.
What data is processed?
Purposes and legal bases:
Storage period:
Recipients: The demo shop runs on our servers at DigitalOcean (Frankfurt); we send and receive e-mails via Hetzner Online GmbH (Germany). No payment service provider processes payments in the checkout. Details on these recipients are given in section 4. Your rights under section 6 apply here as well; where we rely on Art. 6(1)(f) GDPR, you may object to the processing (Art. 21 GDPR).
When you access bispicy.com, bispos.app or one of our applications under bispicy.com, our web server records every request in an access log: your IP address, date and time, the address requested together with the request method, the status code, the amount of data transferred, the previously visited page (referrer) and the identifier of your browser (user agent). Error messages of the web server may additionally contain your IP address and the address requested.
Purpose and legal basis: Delivering the pages, secure operation, error analysis and the detection and prevention of attacks and abuse; Art. 6(1)(f) GDPR. Our legitimate interest is the secure and stable operation of our websites.
Storage period: The logs are rotated daily and deleted automatically after 15 days at the latest; longer only where needed to investigate a specific security incident, and only until it is closed. In our server's daily backups they remain for up to seven further days.
Recipients: The web server runs at DigitalOcean in Frankfurt (details in section 4). You may object to the processing on grounds relating to your particular situation (Art. 21 GDPR, section 6).
Our Windows programs BISpicy Connect, BISpicy Print, BISpicy KDS, BISpicy AI Bridge and BISpicy Parcel Station regularly ask our server (bispicy.com) whether a new version is available and download it if so. With this request, the following information is transmitted and stored:
The content of your data and the name of your computer are not transmitted during the update check. Technically, your IP address reaches our server with every request; we do not store it in the database of the update check. It appears only in the web server's access log (section 3.8). To prevent misuse we count requests and new installations per sender address (for IPv6 per /64 network): the only counter key is a pseudonymous check value (HMAC) of the sender, which we keep only in a cache and which expires at the latest 48 hours after the last counted request; the address itself is not stored in plain text for this purpose.
The programs send this request automatically; it is a prerequisite for the program to find and offer new versions and security updates by itself. Without it (for example if your network blocks bispicy.com) the program stays on its current version until you install a new version from our website. The "Show a notice only" setting in the customer centre does not change this.
Purpose and legal basis: secure delivery of new versions, staged roll-out, halting and withdrawal of faulty versions, and protecting the update check against misuse; Art. 6(1)(f) GDPR; where the update is necessary for performing the contract on the programs, additionally Art. 6(1)(b) GDPR. Our legitimate interest is the secure and trouble-free operation of the programs and of our customers' installations. You may object to the processing on grounds relating to your particular situation (Art. 21 GDPR, section 6).
Storage period: We delete the data on an installation 12 months after its last request. If your business or account is deleted, we delete the associated installation reports with the next clean-up run, which takes place every ten minutes.
Recipients: The update check runs on our servers at DigitalOcean in Frankfurt. The programs download the program file itself from our content delivery network (DigitalOcean Spaces, with Cloudflare as a sub-processor of DigitalOcean); connection data (IP address) arises there. Details on these recipients are in section 4.
Businesses that use BISpicy ERP or the BISpicy cash register can release a separate, read-only access to selected accounting and cash register data to their tax advisor or another firm in the Customer Center. This can also be a bookkeeping or payroll office. This section informs you if you are invited to such an access or use it (Art. 13 and 14 GDPR). Your access account applies to your email address, regardless of how many businesses invite you. Each business sees only the details of its own release.
Who is responsible
Which data we process and where it comes from
From the inviting business we receive (Art. 14 GDPR; the details do not come from publicly accessible sources):
If we create a new access account for you, we take email address, name, firm name and language from this first invitation. Later invitations from other businesses do not change your account.
From you directly we collect (Art. 13 GDPR):
We do not use your details for advertising.
Purposes and legal bases
Recipients
Storage period
Deletion takes place automatically in the daily deletion run. In the routine backups of our database service, deleted data remains for up to seven days.
Cookie and storage in the browser
Your rights
Deletion
Obligation to provide data and automated decisions
Businesses that use BISpicy ERP or the BISpicy cash register can offer their customers a portal at portal.bispicy.com/<address of the business>. There you can see data that the business keeps about you and releases for this purpose, such as orders with shipment status, invoices and returns. Business customers can also, where the business permits it, order there, accept quotes and request quotes, report address changes and shop in the purchasing portal. A portal account is created if you accept an invitation from the business or from a person in your company authorised to send one or – where the business has set up sign-in with Microsoft for your company – when you sign in for the first time with your organisation’s Microsoft account (work, school or university account). The business sends you an invitation by hand by email. If you are already linked to the portal, you will find a link to the portal in the business’s invoice and order emails. If the business has switched on the purchasing portal, all persons of its portal sign in with their email address, their own password and a code from an authenticator app (second factor) or, where set up for their company, with Microsoft; you set the password yourself when accepting the invitation or via a link sent to you by email. Otherwise there is no password: you sign in with a code or link that you receive by email. This section informs you if you use the portal or the ordering app “BISpicy Einkauf”, are invited to it or request access.
Who is responsible
Which data we process on behalf of the business
For its customer, the business sees whether a portal account is linked, since when, and when you last signed in. Emails are sent via the business’s mail server or, if it has not set one up, via our mail server at Hetzner Online GmbH (Germany). The data are stored on our servers at DigitalOcean in Frankfurt (section 4).
Sign-in with Microsoft
If the business has set up sign-in with Microsoft for your company, your browser is redirected to Microsoft to sign in. Microsoft checks your credentials and, where applicable, a second factor; the processing there is governed by your company’s agreement with Microsoft. We provide the application “BISpicy Einkauf”; Microsoft is neither our processor nor that of the business in this respect. Your company consents to the application once and determines via app roles who may order, approve or manage; without an assigned app role, sign-in is not possible. We assign you solely via the identifier of your organisation and your object identifier, never via the email address. A session after sign-in with Microsoft lasts at most 12 hours. As long as your company’s connection is active, you sign in with a linked account only with Microsoft. Microsoft gives no warranty and accepts no liability for the application “BISpicy Einkauf”.
Deliveries
If the business delivers with its own vehicles and uses tour tracking, you see in the portal, for the delivery points assigned to you (without an assignment, for all delivery points of your company), the deliveries of the last 14 and the next 7 days: delivery day, status, times of pick-up, arrival and handover, the expected arrival and the delivery note numbers. You can retrieve the receipted delivery note as a PDF; it contains the name and signature of the person who took over the delivery, reservations with text, reasons, the remark of the driver and the number, title and checksum of the photos, not the images. You do not see the name of the driver; no location data are collected. Persons to whom a delivery point is expressly assigned receive, if the business has switched it on, an email when a delivery is on its way (with an expected time window) and when it has been delivered. If you take over and acknowledge a delivery, the business informs you before you sign on the driver’s device or, if it offers this, on the page you open via a QR code on your own phone; your name and signature appear on the receipted delivery note, which the authorised persons of your company can retrieve in the portal and which the business, if it has switched this on, sends as a PDF to the email address of the order.
Reminder before the order cut-off
In the purchasing portal you can have an email reminder sent to you before the order cut-off if no order exists yet for one of your delivery points for the next delivery day. The reminder is sent only if you switch it on yourself in the header bar; the setting applies to all delivery points of the company for which you order. The legal basis is your consent given to the business (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future by switching off the reminder in the header bar; we then delete your consent immediately.
Ordering app “BISpicy Einkauf” (Android) – privacy notice
With the Android app “BISpicy Einkauf”, persons at business customers shop in the purchasing portal of a business: scanning with the camera or a handheld scanner, also without a network connection, basket, order, approval and deliveries. We are the provider of the app: BISpicy – Bernhard Binder, Untergath 53, 47805 Krefeld, Germany, email support@bispicy.com (further contact details in section 1); you download the app via Google Play. The app only works if your supplier has switched it on for its portal and you have a portal account there. No account can be created in the app, and there is no sign-in with Microsoft in the app (the Microsoft application of the same name, see “Sign-in with Microsoft”, concerns only the portal in the browser). As in the portal, the business is responsible for everything you do in the app; we process these data on its behalf (Art. 28 GDPR). You can open your supplier’s legal notice and privacy policy in the app before signing in.
On your device the app stores your sign-in (encrypted with a key from the Android Keystore that does not leave the device), scans not yet transferred, a catalogue for display without a network connection (article name, article number, codes, last known price) and random keys that prevent duplicate orders. Android does not back up these data to a cloud and does not transfer them to a new device. The app evaluates the camera image only on the device; it is neither stored nor sent. The app uses the internet, the network status (to detect whether a connection exists), the camera at your request and the interface of Zebra handheld scanners; it does not request access to location, contacts, photos or Bluetooth. Storing and reading on the device is strictly necessary for the use you requested (section 25(2) no. 2 TDDDG).
What your supplier sees: for your account, the signed-in devices with name, app version, day of sign-in and day of last use (without time of day); it can sign devices out. It sees your orders and approvals as in the portal.
Recipients: The app sends data only to our servers at DigitalOcean in Frankfurt (section 4). It contains no analytics, advertising or crash reporting services and does not itself send any data to Google.
What we are responsible for ourselves: the access logs of our web server (section 3.8) and the counters against misuse (see “What we process ourselves”). Google’s terms and privacy policy apply to downloads and updates via Google Play. Google provides us with aggregated statistics on the app (e.g. number of installations, Android versions, countries) and, if you have agreed in Android to share usage and diagnostic data with Google, crash reports without name or email address. We see reviews that you write on Google Play with the name displayed there and can reply to them. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to provide the app, keep it stable and reply to reviews. If you take part in the closed test, we enter the email address of your Google account in the tester list on Google Play and remove it when the test ends or you leave (Art. 6(1)(b) GDPR).
Security: The app connects only via encrypted connections. We store the sign-in identifier only as a check value; it is valid only for the app and only for the portal of this business. At most 10 devices can be signed in per account. The app can reach only the functions released for it; administration of the company account, documents, complaints and deleting the account remain in the portal in the browser.
Storage period: The sign-in of a device ends after 30 days without use, at the latest 90 days after sign-in, and also when you or your supplier sign the device out, when your supplier switches off the app or the portal, and when your account is deleted. We delete the device data 7 days after the end of the sign-in, immediately together with your account. We delete the records of transferred scans after 30 days. On signing out and as soon as the sign-in is no longer valid, the app removes the sign-in, the catalogue and the keys against duplicate orders from the device; scans not yet transferred remain on the device for your account until they have been transferred or you discard them in the app. On uninstallation, Android removes all data of the app. Otherwise the periods of the portal apply (see “Storage period”).
Your rights, signing out and deletion: You see your devices in the app and in the portal under “Account” and sign them out there. You delete your portal account in the portal in the browser under “Account”; we then also delete your devices and the records of your scans. You exercise your rights under section 6 against the business for the data in the portal and in the app, and against us for our own processing (support@bispicy.com). Using the app is voluntary; you can also order in the portal in the browser.
What we process ourselves
Cookie and storage in the browser
Storage period
Your rights
For businesses
If you send us a support request (by email, e.g. to support@bispicy.com or support@bispos.app, or via the Customer Center), we process as controller (contact details in section 1):
Purposes: handling your request, remedying reported faults and improving our software; if your business has agreed a support allowance, also billing the allowance and services beyond it. We evaluate the effort per business and month internally, not per person handling it.
Legal bases: Art. 6(1)(b) GDPR where you are yourself our contracting party or are entering into a contract with us; Art. 6(1)(f) GDPR where you enquire for a business that is our customer, and for the internal evaluation of the effort – our legitimate interest is to support our customers and to bill agreed services. You may object to processing under point (f) on grounds relating to your particular situation (Art. 21 GDPR). Retention as a business letter is based on Art. 6(1)(c) GDPR in conjunction with § 257 HGB and § 147 AO.
Who sees the data: the persons at our company who deal with support. If your business has a support allowance, its owners and the persons authorised for it receive a statement of the time recorded per request (ticket number, date, type of service, minutes); they do not see who recorded the time or our internal notes. A fault report may result in an entry in our public list of faults, without your name, without your business and without figures from your data. We send and receive emails via our mail server at Hetzner Online GmbH (Germany); the requests are stored on our servers at DigitalOcean in Frankfurt (section 4).
Storage period: we keep requests together with replies, attachments and time bookings for as long as your customer account exists, afterwards until the end of the sixth calendar year after the last message of the request, and then delete them automatically. We delete requests that are not assigned to a customer account at the end of the sixth calendar year after their last message.
The details are voluntary; without a way to contact you, however, we cannot answer your request.
If you register in BISpicy ERP, in the Customer Center or in the POS app, including with your Google account, we ask: “How did you hear about us?” Answering is optional. You can choose TikTok, Instagram, Facebook, YouTube, Google/search, Recommendation or Other; the default is “No answer”. We are the controller (contact details in section 1).
Pre-selection in the browser: If you open the registration in BISpicy ERP or in the Customer Center via a link with a campaign tag (e.g. “utm_source=tiktok” in a link from our TikTok profile), the page pre-selects the matching channel in the selection field. This happens only in your browser. Nothing is stored on your device for this (no cookie, no browser storage), and the form does not transmit the tag itself. We only receive the channel that is in the field when you submit the form; you can change it beforehand or choose “No answer”. If you register with Google, we keep your choice in your session on our server until you return from Google. As with every page request, the address you opened appears in our web server’s access log (section 3.8); we do not evaluate it for the source information.
Installation source in the POS app (only with your consent): When you register in the POS app, there is also the checkbox “Send where I installed the app from”. It is not pre-ticked. Only if you tick it does the app, once during registration, read the campaign tag of the Play Store link through which you installed the app, via the interface provided for this purpose by the Google Play Store on your device (Google Play Install Referrer API), and send it to us with your registration. Only source, medium, campaign and content (utm_source, utm_medium, utm_campaign, utm_content) are taken over, each limited to 64 characters consisting of lower-case letters, digits, hyphens and underscores. We do not take over any other parts of the link, such as click identifiers of advertising networks; we discard values that do not match this pattern. If the link contains no campaign tag, for example when you install directly from the Play Store, nothing is transmitted. Without the checkbox the app reads nothing. The app does not store the information on your device. What Google processes when the Play Store link is opened is governed by Google’s privacy policy.
On your user account we store:
We store this only if a new account is created in the process, and only once: later answers do not change the entry.
Purpose: we want to see which advertising and which channels bring new customers to us, and for this we count new accounts per week and channel. We do not create profiles from this, do not pass the information on and do not link it to analytics or advertising cookies; independently of this, we only use Google Analytics with your consent (section 5). We do not make automated decisions within the meaning of Art. 22 GDPR on this basis.
Legal bases: for the optional selection, Art. 6(1)(f) GDPR. Our legitimate interest is to measure the success of our advertising and to use our advertising budget in a targeted way. We only ask for one channel from a fixed list; the answer is optional and is only evaluated internally. You may object to this processing at any time (Art. 21 GDPR); you do not need to give reasons. For reading the installation source in the POS app and its further processing, the legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You may withdraw it at any time with effect for the future (Art. 7(3) GDPR); this does not affect the lawfulness of the processing carried out until then.
Who sees the data: only BISpicy’s administrators. They see the source per account in our customer administration and the weekly count per channel. Your business and its users do not see it. The data is held in our central database on our servers at DigitalOcean in Frankfurt (section 4).
Storage period: we delete the entry automatically 24 months after it was recorded, and also together with your user account, when your business is deleted and as soon as you object or withdraw your consent. Copies in the routine backups of our database service are overwritten after seven days at the latest.
Objection and withdrawal: you can delete the entry yourself: in the Customer Center under “Profile” (“Delete source information”) and in the POS app under Settings → Tax & Compliance → Account & Licenses. An informal message to support@bispicy.com is also sufficient; we will then delete the entry. The information is not required by law or by contract: without it, you register in the same way and use BISpicy without restriction.
We run our own profiles on social networks. We are responsible for them (contact details in section 1); the respective operator is responsible for the platform itself:
What the operators process: When you visit our profiles, react to posts or write to us, the operator processes your data under its own terms, also for its own purposes such as advertising and in some cases in third countries such as the USA. The operator alone is responsible for this, except for the statistics (next paragraph). Details, including the safeguards for transfers to third countries, and your settings are described in the privacy policies of Meta (Facebook), Instagram, LinkedIn, TikTok, Google (YouTube) and X.
Statistics (insights): The operators provide us with aggregated statistics about our profiles and posts, for example on reach and interactions. We use them to measure the impact of our posts and to improve our content. Insofar as we are jointly responsible with the operator for creating these statistics (Art. 26 GDPR), the agreements that Meta, LinkedIn and TikTok have published on this apply; under them, the operator takes on in particular informing users and answering their requests:
Comments and direct messages: We read and answer comments on our posts and messages to our profiles; in doing so, we process your profile name and profile picture, the content of your comment or message and our reply. An AI assistant helps us read and answer them. If we ask in a post for a keyword to be commented, we send you the requested content by direct message. We may hide or delete comments on our posts, for example in the case of insults or third-party advertising.
Legal bases: Art. 6(1)(f) GDPR. Our legitimate interest is to measure the impact of our posts, to talk to prospects and customers via our profiles, to answer questions quickly, to send requested content and to keep our profiles free of insults and third-party advertising. If your message concerns a contract with us or its preparation, the legal basis is Art. 6(1)(b) GDPR.
Recipients and third countries: Apart from the operators, the recipients are our processors: Anthropic PBC, USA, for the AI assistant, and our hosting provider DigitalOcean (section 4). The transfer to Anthropic in the USA is based on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR); you can obtain a copy from us on request.
Storage period: We store comments and messages for as long as this is necessary to deal with your request. If your message results in a support request, an offer or a contract, the periods of the respective section apply, for example section 3.12 for support requests. On the platform, they remain stored until you, we or the operator delete them.
Your rights: You can exercise your rights under section 6 against us and, insofar as we are jointly responsible with an operator, also against the operator (Art. 26(3) GDPR). You may object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR, section 6, “Right to object”). Whether you comment or write to us is up to you; without a comment or message we cannot answer you.
An administrator of your business connects a Gmail or Google Workspace mailbox to the Archive (the email archive in BISpicy ERP, in the customer center and at dms.bispicy.com) via IMAP like any other mailbox, using an app password created in the Google Account of the mailbox. We currently do not offer a connection via Google’s Gmail API (“Connect Google account”); we receive no data from your mailbox through that interface. Via IMAP, the Archive reads the existing and newly arriving emails in the specified folder (default: inbox) and, after an automatic pre-selection, transfers them into your business’s archive; it does not change, send or delete anything in the mailbox. We store the app password encrypted and delete it when an administrator removes the mailbox in the Archive. Independently of this, the app password can be revoked at any time in the Google Account; after that, the Archive retrieves nothing more from this mailbox.
The respective business is the controller for the email archive; we process the emails as its processor (Art. 28 GDPR; details in the data processing agreement under “E-mail archive”). The business determines the legal basis. Archived emails remain in your business’s archive until the retention period has expired and your business deletes them. Please send requests concerning your rights to the business; requests addressed to us are forwarded.
(1) Principle: Your data will only be disclosed to third parties if:
(2) Data recipients:
| Recipient | Purpose | Location | Legal Basis |
|---|---|---|---|
| DigitalOcean LLC | Hosting (BISpicy ERP, database, cloud backups in Spaces) | Frankfurt (EU); access from the USA possible (EU-US Data Privacy Framework, Art. 45 GDPR; alternatively standard contractual clauses, Art. 46 GDPR) | Art. 6(1)(b) GDPR |
| Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen | E-mail sending and receiving (system mail server, if no own SMTP account is configured; mailboxes of the domains bispicy.com and bispos.app) | Germany (EU) | Art. 6(1)(b) GDPR |
| Cloudflare, Inc. (engaged by DigitalOcean) | Content delivery network for file storage (delivery of images, downloads and files from DigitalOcean Spaces, e.g. product images of the BISpicy Shops; connection data/IP) and security and DNS services of the DigitalOcean platform – engaged by DigitalOcean as its own sub-processor; no separate contractual relationship with us | EU/USA (EU-US Data Privacy Framework, Art. 45 GDPR, and standard contractual clauses, Art. 46 GDPR) | Art. 6(1)(f) GDPR |
| Stripe Payments Europe Ltd. | Payment processing for software licenses | Dublin (EU) | Art. 6(1)(b) GDPR |
| Shipping carriers (DHL, DPD, GLS, Hermes, UPS, FedEx) | Shipping label creation, track & trace | EU | Art. 6(1)(b) GDPR |
| Marketplaces, shops and ERP systems (Amazon, eBay, Etsy, Shopify, Magento, WooCommerce, Shopware, Gambio, Shopee, Whatnot, TikTok Shop, Odoo) — only when enabled | Order and article synchronization | EU / worldwide | Art. 6(1)(b) GDPR (upon the Controller's instruction) |
| EDI service providers and EDI partners of the business (e.g. Editel/eXite, Comarch; direct AS2 connection to suppliers) — only when enabled | Transmission of orders to suppliers and receipt of order confirmations, despatch advices and invoices (EDI) | depending on service provider or partner | Art. 6(1)(b) GDPR (upon the Controller's instruction) |
| Google LLC (Firebase Cloud Messaging) | Push notifications to connected POS devices (no personal content) | EU/USA (Standard Contractual Clauses) | Art. 6(1)(f) GDPR |
| Anthropic PBC | AI features of BISpicy ERP (only when used): AI-assisted recognition of incoming invoices, AI article creation, AI repricing; AI assistant for comments and direct messages on our social media profiles (section 3.14); not used for model training | USA (Standard Contractual Clauses) | Art. 6(1)(b)/(f) GDPR in conjunction with Art. 46 GDPR |
| Fiskaly GmbH (only when POS integration is active) | TSE cloud signing (KassenSichV / RKSV); in Austria registration and reporting of the cash register to FinanzOnline (RKSV) with VAT ID or tax number, company name and address of the business and the FinanzOnline credentials of the cash register web service user (participant ID, user ID, PIN – not stored by BISpicy; held by Fiskaly GmbH for the registration and further reports of the cash register to FinanzOnline). Retention at BISpicy: the RKSV register data (identifiers of the signature unit and of the cash register, legal-entity identifier) are retained; the legal-entity identifier is deleted 7 years after the end of the calendar year in which the licence ends, the technical identifiers remain. DEP7 backups of Austrian cash registers are stored for as long as the customer account exists. When the account is deleted, they are provided in the export package, the references to them are then deleted, and the backed-up files in object storage are removed together with the storage files of deleted accounts | Germany / Austria | Art. 6(1)(c) GDPR (legal obligation) |
The full list of processors and sub-processors with locations and processing purposes can be found in the Data Processing Agreement (DPA).
The BISpicy AI Bridge is a program that runs on your own computer and connects your JTL database to an AI service of your choice (such as Claude, ChatGPT or Cursor). A clear separation applies:
Exception — access via browser chats: If you connect the bridge to an AI service in the browser (such as claude.ai or ChatGPT), that service cannot start a program on your computer. In this case the query runs via our servers: we forward it either via a queue to your BISpicy AI Bridge or to the BISpicy Connect installation in your network, which submits it to your database, and return the result to your AI service. The following applies:
Cookies are small text files that are stored on your device when you visit our website. They help us to ensure the functionality of the website and to improve your user experience.
We distinguish between the following cookie categories:
| Category | Description | Consent | Storage period |
|---|---|---|---|
| Necessary cookies | These cookies are absolutely necessary for the basic functions of the website (e.g. session management, storing your cookie choice in the cookie bispicy_cookie_consent). |
No consent required (Section 25(2) no. 2 TDDDG; Art. 6(1)(f) GDPR) | Session / 1 year |
| Statistics cookies | These cookies help us to understand how visitors interact with our website. The data is collected under a pseudonymous identifier and transmitted to Google (details under 5.3). Google Analytics is only loaded after you have consented. | Consent required (Section 25(1) TDDDG; Art. 6(1)(a) GDPR) | _ga and _ga_W71690PF4V: up to 2 years |
We do not use marketing or advertising cookies on bispicy.com. The cookie selection therefore offers no category for them.
We use Google Analytics 4, a web analytics service of Google Ireland Limited (“Google”). Google Analytics uses cookies that allow an analysis of how the website is used.
googletagmanager.com._ga and _ga_W71690PF4V, the page viewed, the referrer, the time and events such as clicks on download, Play Store and app-start links, the submission of contact and enquiry forms and general usage events (e.g. scroll depth, clicks on outbound links). According to Google, Google Analytics 4 does not store IP addresses; the client ID is personal data. Google Signals and ad personalisation are switched off; the consent types for advertising (ad storage, user data and personalisation for advertising) always remain denied._ga and _ga_W71690PF4V stay on your device for up to 2 years unless you delete them earlier or withdraw your consent. Google Analytics automatically deletes event data in our account after 2 months and user-level data (user identifier) 14 months after the last activity; aggregated reports that do not relate to individual visitors are not affected.Google Consent Mode (Basic): We run Google Analytics in the “Basic” mode of Google Consent Mode. This means: without your consent no Google code is loaded, no cookies are set and no data is sent to Google. Cookieless or “modelled” measurements without consent do not take place either; our visitor numbers may therefore be lower.
Cookie settings
You can change your cookie settings at any time by clicking the cookie button at the bottom left of the page or by using the following link:
You can withdraw your consent to the use of cookies at any time with effect for the future. Withdrawing is as easy as giving consent. Use the cookie settings (button at the bottom left) or delete the cookies in your browser. Withdrawing your consent to “Analytics” ends the measurement immediately and deletes the Google cookies on your device.
Objection on grounds relating to your particular situation: Where we process personal data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation. The legal basis of each processing operation is stated in this privacy policy where that processing is described. After an objection we will no longer process the data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
Objection to direct marketing: Where we process personal data for direct marketing purposes, you may object to this at any time without giving reasons; this also applies to profiling to the extent that it is related to such direct marketing. After your objection we will no longer process your data for direct marketing purposes.
How to object: No particular form is required; the easiest way is by e-mail to support@bispicy.com or by post to BISpicy - Bernhard Binder, Untergath 53, 47805 Krefeld, Germany. Where we process data as a processor on behalf of a business (this is stated for each processing operation), please address your objection to that business; we will forward objections sent to us.
We have implemented extensive technical and organizational measures:
For questions about data protection, please contact:
Last Updated: November 14, 2026