Privacy Policy

1. Data Controller

Data Controller within the meaning of the General Data Protection Regulation (GDPR):

2. General Information

(1) This Privacy Policy informs you about the type, scope, and purpose of the processing of personal data within our software "BISpicy Inventory Management" and the associated online services.

(2) Legal basis:

• General Data Protection Regulation (GDPR)
• German Federal Data Protection Act (BDSG)
• German Telemedia Act (TMG)

3. Collection and Processing of Personal Data

3.1 During Registration and Account Creation

What data is collected?

• Email address (required)
• Password (stored encrypted)
• Company name and address
• Registration timestamp

Legal basis: Art. 6(1)(b) GDPR (contract performance)

Storage period: Until account deletion + 30 days

3.2 During Use of the Software

What data is processed?

• Article data (products, prices, inventory)
• Customer data (names, addresses, contact details)
• Order data (orders, deliveries, invoices)
• Usage data (login times, activities)

Note: This data is processed on behalf of the customer (data processing agreement pursuant to Art. 28 GDPR).

Fault diagnosis (error logs): To detect and resolve technical faults, we log error events from server operation and from the user's browser (error message, technical call chain, timestamp, page accessed, browser identification, user ID). Access credentials, tokens and payment information are automatically redacted before storage. Detailed troubleshooting recording beyond error events takes place only for a limited time (maximum 72 hours), only upon express instruction with a documented reason, and ends automatically. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in fault-free operation) or Art. 28 GDPR within the scope of data processing. Retention period: error events 14 days, other technical operational data 3 days; automatic deletion thereafter.

Device purchase (§25a German VAT Act / margin scheme): When purchasing used devices (e.g. in a phone shop), in order to fulfil the statutory recording obligation (purchase ledger pursuant to §25a UStG in conjunction with the German Anti-Money Laundering Act) we store the seller's data – name, address, ID number and telephone number – as well as the device data (IMEI/serial number, purchase and sale price). Legal basis: Art. 6(1)(c) GDPR (compliance with a legal obligation). Access is restricted to authorised employees.

Email delivery of receipts, invoices and reports: On request, we send point-of-sale receipts, digital receipts and invoices (e.g. from the connected POS app) by email to the email address provided by the customer. Operators and authorised employees may also have reports, analyses and documents sent to a self-configured email address (email export). We process the respective email address solely to deliver the requested document. Legal basis: Art. 6(1)(b) GDPR (contract performance) or (f) GDPR (legitimate interest in the requested delivery); where a receipt is sent at the customer's voluntary request, it is based on their consent pursuant to Art. 6(1)(a) GDPR. The transfer is made solely to our server or to the mail service provider configured by the operator (a processor for delivery only); no disclosure to third parties for their own purposes takes place. Retention period: only for as long as required for delivery or the statutory retention of the document.

4. Data Transfer to Third Parties

(1) Principle: Your data will only be disclosed to third parties if:

• You have given consent (Art. 6(1)(a) GDPR)
• This is necessary for contract performance (Art. 6(1)(b) GDPR)
• There is a legal obligation (Art. 6(1)(c) GDPR)

(2) Data recipients:

Recipient	Purpose	Location	Legal Basis
DigitalOcean LLC	Hosting (BIS ERP, database, cloud backups in Spaces)	Frankfurt (EU)	Art. 6(1)(b) GDPR
Stripe Payments Europe Ltd.	Payment processing for software licenses	Dublin (EU)	Art. 6(1)(b) GDPR
Shipping carriers (DHL, DPD, GLS, Hermes, UPS, FedEx)	Shipping label creation, track & trace	EU	Art. 6(1)(b) GDPR
Marketplaces and shops (Amazon, eBay, Etsy, Shopify, Magento, WooCommerce, Shopware) — only when enabled	Order and article synchronization	EU / worldwide	Art. 6(1)(b) GDPR (upon the Controller's instruction)
Google LLC (Firebase Cloud Messaging)	Push notifications to connected POS devices (no personal content)	EU/USA (Standard Contractual Clauses)	Art. 6(1)(f) GDPR
Anthropic PBC (only when AI features are used)	AI-assisted recognition of incoming invoices, AI article creation, AI repricing (not used for model training)	USA (Standard Contractual Clauses)	Art. 6(1)(b)/(f) GDPR in conjunction with Art. 46 GDPR
Fiskaly GmbH (only when POS integration is active)	TSE cloud signing (KassenSichV / RKSV)	Germany / Austria	Art. 6(1)(c) GDPR (legal obligation)

The full list of processors and sub-processors with locations and processing purposes can be found in the Data Processing Agreement (DPA).

4.1 BIS AI Bridge: Connecting Your Own AI

The BIS AI Bridge is a program that runs on your own computer and connects your JTL database to an AI service of your choice (such as Claude, ChatGPT or Cursor). A clear separation applies:

• Your database contents do not reach us. Queries run exclusively between your computer and your AI service. We have no access to them at any time and store nothing from them.
• We only process licence data: licence key, a device identifier, the computer name, the program version and the number of calls per month. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).
• Your AI provider is not our sub-processor. You select it yourself and conclude the contract with it. You are responsible under data protection law for this transfer — please check the provider's terms, in particular whether your input is used to train models.
• The access log stays with you. Every query is logged on your computer; this file is not transmitted to us.

Exception — access via browser chats: If you connect the bridge to an AI service in the browser (such as claude.ai or ChatGPT), that service cannot start a program on your computer. In this case the query runs via our servers: we forward it to the BISConnect installation on your computer, which submits it to your database, and return the result to your AI service. The following applies:

• We process the query and its result as a processor under Art. 28 GDPR — just as with the other functions of BIS ERP. The Data Processing Agreement concluded with you applies.
• The result is deleted immediately after delivery and not stored permanently.
• You decide which route to use. If you want your data never to reach our servers, use an AI program on your own computer (such as Claude Desktop or Cursor) — then the local route described above applies.

5. Your Rights as a Data Subject

6. Data Security

We have implemented extensive technical and organizational measures:

• Encryption: TLS 1.3 for all data transfers
• Access controls: Role-based permissions
• Backups: Daily automatic backups
• Hosting: EU data centers

7. Contact

For questions about data protection, please contact: