Source: https://basecase.com/privacy
Timestamp: 2019-04-22 12:45:12+00:00

Document:
For all questions about matters of data protection in connection with the use of our platform you can also contact our Data Protection Officer at any time. He can be reached under the above postal address and under the e-mail address given above (mark your communication: “FOA Data Protection Officer”).
B. What personal data is collected and for what purpose?
The processing of these access data is necessary in order to make the visit to the platform possible and to ensure the permanent functionality, auditability and security of our systems. The access data are in addition saved for the foregoing purposes in internal logfiles, in order to develop our platform further with regard to the usage patterns of our visitors (e.g. if the proportion of mobile devices on which the pages are called up rises) and in order to administer our platform in a general way. Log entries are deleted after one year. The legal basis is Art. 6, para. 1, lit. b GDPR.
In addition, BaseCase processes personal data, provided to it in connection with the initial business contact or in connection with existing customer relations and which is necessary to establish or maintain a customer relationship, a business contact or for rendering the services offered by BaseCase. This includes the user’s full name, e-mail address, telephone and fax numbers, address, IP address, the name of the client company, the user’s position within the client company, the industry sector in which the client company operates, and the usage of apps. The information can be entered via the website – e.g. the contact form to become a BaseCase Partner – by e-mail or transmitted in some other way. The legal basis is Art. 6, para. 1, lit. b GDPR. For providing its services BaseCase requires at least the first name, the last name and the e-mail address of everyone a client company has authorized to have access (users). The person designated by the client company as the administrator of the customer’s access shall compile a list of all authorized users for BaseCase. The legal basis is Art. 6, para. 1, lit. b GDPR.
The client company shall ensure, and BaseCase accepts no responsibility, that the client company is authorized by the users to provide BaseCase with their personal data.
Analytics are based upon the tracking of individual users. Users explicitly ‘opt-in’ to this tracking, and can revoke this permission at any time. If they would like their account and all tracking data to be removed, they can simply send a request by email to either support@basecase.com, or to a duly appointed ‘administrator’ within their organization. Analytics data can be reviewed by BaseCase (for debugging, performance and compliance reasons) and by duly appointed ‘administrators’ or ‘analysts’ within the user’s organization. The legal basis is Art. 6, para. 1, lit. a GDPR.
BaseCase is a SaaS (Software-as-a-Service) provider. When using the services offered by BaseCase (software and server capacity) additional company and business data is transferred to BaseCase (e.g. pictures or description of products) that is not protected under data protection laws.
BaseCase warrants that the client company’s company data processed on the servers provided will be viewed by BaseCase employees only upon the client company’s express wish, e.g. in connection with support requests. BaseCase shall not analyse or use the company data transmitted for its own purposes provided this is not necessary for performing the contract with the respective client company.
BaseCase shall, upon request, regularly inform its customers and their employees as well as other interested parties (the recipients) in its newsletter of improvements, extensions or changes to the services offered. Subscription to the newsletter requires that the recipient states his/her e-mail address and that consent to the sending of the newsletter is given in advance. Should you confirm your e-mail address, we shall store your e-mail address, the time of registration and the IP address used for the registration for such time until you cancel the newsletter. This storage serves only the purpose of sending you the newsletter and being able to provide your registration. Every recipient can object to having the Newsletter sent at any time by e-mail to unsubscribe@basecase.com. Additionally, an opt-out link is integrated into the footer of every Newsletter. You will not incur any costs – beyond the cost of your internet access – by subscribing to the Newsletter or by objecting to having it sent. The legal basis is Article 6, para. 1, lit. a GDPR.
For a part of our service it is necessary for us to insert cookies. A cookie is a small text file which is saved by your browser on your device. Cookies are not inserted to execute programs or to load viruses into your computer. Instead the main purpose of cookies is to provide a product or service especially tailored to yourself and to make use of our services as time-saving as possible.
Unique identifier for your browser / client, to allow for certain technical operations (such as copy-paste) that are otherwise not supported on all browsers / clients.
Some system status, such as whether you are in offline mode or not In this way we wish to enable you to use our platform in a convenient and individual way. These services are based on our foregoing legitimate interest, and the legal basis is Art. 6, para. 1, lit. f GDPR.
We store personal data only for as long as is necessary to fulfil contractual or statutory duties for which the data were collected. We then erase the data immediately, unless we still need these data.
This is legally permissible and requisite, pursuant to Art. 6, para. 1, lit. b GDPR, for the handling of contracts with yourself or for the execution of precontractual actions which are being carried out at your request.
BaseCase’s servers are currently in the USA and are operated by SoftLayer Technologies, Inc. 4849 Alpha Road, Dallas, TX 75244, USA (“SoftLayer”). All of the data more particularly described under B – personal data and company-related data – is processed and stored solely, or at least inter alia, on SoftLayer Technologies’ servers. SoftLayer Technologies’ server centres hold the SOC 2 certification (for more information please see Basecase’s Data Sheet Security).
BaseCase shall pass on analytics data (see above, B, 3) to the client company for their continual optimisation of their apps.
Should we pass data on to our service providers, these data may only be used for performance of their tasks. We select and commission these service providers carefully. They are bound contractually to follow our instructions, have suitable technical and organisational measures for the protection of the rights of data subjects, and are monitored by ourselves on a regular basis.
We store personal data only for as long as is necessary to fulfil contractual or statutory duties for which the data were collected. We then erase the data immediately, unless we still need these data until expiry of the statutory period of limitation for purposes of evidence in civil claims or due to statutory duties of storage. If you would like a copy of our Records Retention Schedule, please contact us at the address above.
Thereafter we must also store some of your data for purposes of book-keeping. We have an obligation to do so under statutory duties of documentation which may arise under the German Commercial Code, the German Tax Code, the German Credit and Loans Act, and the German Money Laundering Act. The periods stipulated there for storage of documents are two to ten years.
You also have the right to object to the data processing based on Art. 6, para., lit. e or f GDPR. Finally, you have the right to complain to the regulatory authority to which we are subject. You can exercise this right at a regulatory authority in the member country of your place of residence, of your workplace, or of the place of alleged breach. In Berlin where BaseCase is located the competent regulatory authority is: Data Protection and Freedom of Information Officer, Friedrichstrasse 219, 10969 Berlin.
Under Article 7, para. 3 of the GDPR you have the right at any time to withdraw to us any consent which has once been given. This will have as a consequence that in future we no longer continue the data processing based on this consent. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
Insofar as we process your data on the basis of legitimate interests under Art. 6, para. 1, lit. f GDPR, you have the right under Art. 21 GDPR to object to the processing of your data and to mention grounds relating to your particular situation that in your opinion speak in favour of prevailing legitimate interests. Where personal data are processed for direct marketing purposes, you have a general right of objection which will also be implemented by us without your stating reasons.
For all questions about matters of data protection in connection with the use of our website you can also contact our Data Protection Officer at any time. He can be reached under the above postal address and under the e-mail address given above (mark your communication: “FOA Data Protection Officer”).
Your IP address may be shortened so that no associations to your person are possible. The processing of these access data is necessary in order to make the visit to the website possible and to ensure the permanent functionality and security of our systems. The access data are in addition saved for the foregoing purposes in internal logfiles, in order to develop our website further with regard to the usage patterns of our visitors (e.g. if the proportion of mobile devices on which the pages are called up rises) and in order to administer our website in a general way. The legal basis is Art. 6, para. 1, lit. b GDPR.
Please note that filling out mandatory fields on the website may be a form of data collection and that these fields are marked accordingly. Mandatory fields must be filled out before we can offer the desired service you require. All other information is voluntary and will be used solely to process your request, for statistical internal purposes or to improve our offer to you.
BaseCase shall, upon request, regularly inform its customers and their employees as well as other interested parties (the recipients) in its newsletter of improvements, extensions or changes to the services offered, and of general marketing information. Subscription to the newsletter requires that the recipient states his/her e-mail address. Should you confirm your e-mail address, we shall store your e-mail address, the time of registration and the IP address used for the registration for such time until you cancel the newsletter. This storage serves only the purpose of sending you the newsletter and being able to provide your registration. Every recipient can object to having the newsletter sent at any time by e-mail to unsubscribe@basecase.com. Additionally, an opt-out link is integrated into the footer of every newsletter. You will not incur any costs – beyond the cost of your internet access – by subscribing to the newsletter or by objecting to having it sent. The legal basis is Article 6, para. 1, lit. a GDPR.
We use our own cookies in particular to note that information placed on our website has been displayed to you – so that on your next visit to the website it does not need to be displayed again.
Our website uses Hubsport, an inbound-marketing automation software of Hubspot Inc, 25 First Street, 2nd Floor Cambridge, MA 02141, USA (“Hubspot”). Hubspot collects personal information about the users of BaseCase’s website in order to provide specific information and offers about BaseCase tailored to your interests. HubSpot runs its analytics on first-party cookies. Should personal data be transmitted to the USA, Google has acceded to the EU-US Privacy Shield. To avoid being included as part of the analytics report you need to clear cookies within the browser. You could also use a private browser like Chrome’s Incognito Mode or Firefox’s Private Browsing feature. In addition to the browser-level settings you can set an opt-out cookie, so you can remove yourself from all HubSpot tracking.
You also have the right to object to the data processing based on Art. 6, para., lit. e or f of the GDPR. Finally, you have the right to complain to the regulatory authority to which we are subject. You can exercise this right at a regulatory authority in the member country of your place of residence, of your workplace, or of the place of alleged breach. In Berlin where BaseCase is located the competent regulatory authority is: Data Protection and Freedom of Information Officer, Friedrichstrasse 219, 10969 Berlin.
BaseCase is aware of the fact that the data processed on this website are sensitive. We maintain up-to-date technical measures to ensure data security, particularly for the protection of your personal data against dangers during data transmissions and against cognizance by third parties. These are amended in each case to reflect the current state of technology. To secure the personal data which you have stated on our website, we use transport layer security (TLS), which encrypts the information which you have entered.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 21
 Art. 6
 Art. 6