Privacy Policy

1. Controller

The controller responsible for the processing of personal data on this website is:

Power Doc 365 GmbH
Im Mediapark 5
50670 Köln

Telefon: +49 (0) 211 54241112
E-Mail: info@powerdoc365.com

2. What this site is and how access works

This website presents our products to invited business contacts. You received an organization-specific access link by email. Each access link is assigned to a specific client organization — the company we are in contact with — so we know which organization is viewing the showcase. The link is not assigned to you as an individual person.

When you open your organization's invite link, we create an access session for your browser: a cookie named showcase_sessionis stored on your device. It contains a randomly generated session identifier and is used solely to grant you access to the showcase and to record which client organization the session belongs to. On our server we store, for each session, the assigned client organization, a cryptographic hash of the session secret, your browser's user-agent string, and creation/last-use/expiry timestamps.

The storage of this access cookie is necessary to provide the showcase access requested by opening the organization-specific invite link and is therefore permitted under section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG). The associated server-side processing is based on Art. 6(1)(f) GDPR; our legitimate interest is to provide the invitation-only showcase securely and to prevent unauthorized access.

The cookie is not used for advertising, and the cookie identifier is not disclosed to advertising or third-party analytics providers. Our hosting provider may process the associated server data on our behalf as described in section 8. The cookie is valid for a maximum of 90 days; the corresponding session record on our server expires after the same period and may be revoked by us earlier (for example when an agreed access window ends).

3. Server log files

When you access this website, our servers automatically process technical connection data, including your IP address, date and time of access, requested URL, HTTP status code, referrer, and browser user-agent. We process this data to deliver the website securely, diagnose technical errors, and prevent misuse and attacks.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the website. Server log data is retained for at most 90 days unless longer storage is necessary to investigate a security incident.

4. Usage analytics (Umami)

To understand which of our products and materials are of interest to the organizations we invite, we measure how the showcase is used. We use Umami, a privacy-friendly analytics software that we host ourselves on our own infrastructure. No data is transmitted to any third-party analytics provider.

We record the following events:

• page views (which showcase pages are opened),
• product views (which product is opened from the overview),
• tab clicks on product pages (e.g. opening a presentation, an embedded prototype, or a document),
• images viewed in full-screen mode,
• clicks that open external content in a new tab (recording only the provider's hostname, never the full link),
• activation of embedded external content after the confirmation described in section 5 (again recording only the provider's hostname).

Each event is labelled with the name of the client organization your access link is assigned to. Events are not labelled with your name, email address, or the session identifier from the access cookie.

Technical data processed

Umami processes the following technical data with each event: the page URL, the referrer, browser type and version, operating system, device type, screen size, language, and the country/region derived from your IP address. Umami itself does not use cookies. To group events into visits, Umami derives a technical identifier from your IP address and browser characteristics.

Can individual visitors be identified?

Umami uses the technical identifiers described above to group events into visits, so different browsers (for example, two colleagues from the same organization) may appear as different visitors in our statistics. We do not provide Umami with your name, email address, or the identifier contained in the access cookie, and we do not use Umami's identify functionality to assign persistent identifiers to individual users — the only attribute we attach is the name of your organization. Our analysis is performed at the level of the client organization; we do not intend to attribute usage to specific individual contact persons, and we do not combine analytics data with names or email addresses.

5. Embedded third-party content

Product pages can contain tabs with content embedded from external providers, for example interactive prototypes (such as Figma) or other embedded presentations. This content is not loaded automatically: when you open such a tab, we first show a notice naming the provider, and the content is only loaded after you actively confirm. Your confirmation is stored in your browser for the current browser session only and is not evaluated for any other purpose.

Once you load the content, your browser establishes a direct connection to the servers of the respective provider. That provider thereby processes your IP address, technical browser data, and the referrer; it may set or read its own cookies and, if you have an account with the provider and are logged in, it may be able to link the visit to that account. Depending on the provider, this can include processing in countries outside the EU/EEA. The respective provider's own privacy policy applies to this processing; the provider is named in the notice shown before loading.

Documents (PDFs) and images shown on this website are hosted by us and are not loaded from third parties. Tabs and buttons that merely open external content in a new browser tab do not establish a connection to the provider until you click them.

The legal basis for embedding this content is Art. 6(1)(f) GDPR. Our legitimate interest is presenting our products in an interactive form, which is the purpose of this showcase.

6. Purpose and legal basis of the usage analytics

We process the analytics data described in section 4 to evaluate which products and materials the organizations we invite are interested in, and to prepare and improve our sales communication with those organizations.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest). Our legitimate interest is the needs-based preparation of our sales activities towards the invited business contacts: knowing which showcased products an organization looked at allows us to focus follow-up conversations on relevant topics and to improve our materials. The processing is limited to usage of this invitation-only showcase, is largely aggregated at organization level, and does not target individual persons, so we consider the impact on your rights and freedoms to be low.

7. Storage duration

• Access sessions: the cookie and the server-side session record are valid for a maximum of 90 days and are deleted when they expire or are revoked.
• Analytics data: retained for at most 12 months and then deleted.
• Server log files: see section 3.

8. Hosting and processors

This website and our self-hosted Umami analytics instance are operated on servers located in Germany, hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen. The hosting provider acts as our processor under Art. 28 GDPR. Our Umami analytics data is not transferred to countries outside the EU/EEA; embedded third-party content may involve transfers to other countries as described in section 5.

9. Requirement to provide data and automated decision-making

The technical data required for the access session must be processed in order to provide access to the showcase. Without the access cookie, the restricted showcase cannot be used. Beyond that, there is no legal or contractual obligation to provide personal data; the analytics data described in section 4 arises automatically when the showcase is used.

We do not use the data for automated decision-making within the meaning of Art. 22 GDPR and do not create individual lead scores or individual behavioral profiles.

10. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), and restriction of processing (Art. 18 GDPR), as well as the right to data portability under the conditions of Art. 20 GDPR.

Right to object (Art. 21 GDPR): You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Art. 6(1)(f) GDPR. To object, contact us using the details in section 1. If you object, we will no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The supervisory authority responsible for our company is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.

11. Contact

For any questions about this privacy policy or the processing of your data, please contact us using the details listed in section 1.