Privacy Policy

1. Data Controller

Data Controller within the meaning of the General Data Protection Regulation (GDPR):

2. General Information

(1) This Privacy Policy informs you about the type, scope, and purpose of the processing of personal data within our software "BISpicy Inventory Management" and the associated online services.

(2) Legal basis:

• General Data Protection Regulation (GDPR)
• German Federal Data Protection Act (BDSG)
• German Telemedia Act (TMG)

3. Collection and Processing of Personal Data

3.1 During Registration and Account Creation

What data is collected?

• Email address (required)
• Password (stored encrypted)
• Company name and address
• Registration timestamp

Legal basis: Art. 6(1)(b) GDPR (contract performance)

Storage period: Until account deletion + 30 days

3.2 During Use of the Software

What data is processed?

• Article data (products, prices, inventory)
• Customer data (names, addresses, contact details)
• Order data (orders, deliveries, invoices)
• Usage data (login times, activities)

Note: This data is processed on behalf of the customer (data processing agreement pursuant to Art. 28 GDPR).

Device purchase (§25a German VAT Act / margin scheme): When purchasing used devices (e.g. in a phone shop), in order to fulfil the statutory recording obligation (purchase ledger pursuant to §25a UStG in conjunction with the German Anti-Money Laundering Act) we store the seller's data – name, address, ID number and telephone number – as well as the device data (IMEI/serial number, purchase and sale price). Legal basis: Art. 6(1)(c) GDPR (compliance with a legal obligation). Access is restricted to authorised employees.

4. Data Transfer to Third Parties

(1) Principle: Your data will only be disclosed to third parties if:

• You have given consent (Art. 6(1)(a) GDPR)
• This is necessary for contract performance (Art. 6(1)(b) GDPR)
• There is a legal obligation (Art. 6(1)(c) GDPR)

(2) Data recipients:

Recipient	Purpose	Location	Legal Basis
DigitalOcean LLC	Hosting (BIS ERP, database, cloud backups in Spaces)	Frankfurt (EU)	Art. 6(1)(b) GDPR
Stripe Payments Europe Ltd.	Payment processing for software licenses	Dublin (EU)	Art. 6(1)(b) GDPR
Shipping carriers (DHL, DPD, GLS, Hermes, UPS, FedEx)	Shipping label creation, track & trace	EU	Art. 6(1)(b) GDPR
Marketplaces and shops (Amazon, eBay, Etsy, Shopify, Magento, WooCommerce, Shopware) — only when enabled	Order and article synchronization	EU / worldwide	Art. 6(1)(b) GDPR (upon the Controller's instruction)
Google LLC (Firebase Cloud Messaging)	Push notifications to connected POS devices (no personal content)	EU/USA (Standard Contractual Clauses)	Art. 6(1)(f) GDPR
Anthropic PBC (only when AI features are used)	AI-assisted recognition of incoming invoices, AI article creation, AI repricing (not used for model training)	USA (Standard Contractual Clauses)	Art. 6(1)(b)/(f) GDPR in conjunction with Art. 46 GDPR
Fiskaly GmbH (only when POS integration is active)	TSE cloud signing (KassenSichV / RKSV)	Germany / Austria	Art. 6(1)(c) GDPR (legal obligation)

The full list of processors and sub-processors with locations and processing purposes can be found in the Data Processing Agreement (DPA).

5. Your Rights as a Data Subject

6. Data Security

We have implemented extensive technical and organizational measures:

• Encryption: TLS 1.3 for all data transfers
• Access controls: Role-based permissions
• Backups: Daily automatic backups
• Hosting: EU data centers

7. Contact

For questions about data protection, please contact: