Source: https://www.fortrabbit.com/privacy
Timestamp: 2019-04-23 20:15:11+00:00

Document:
We respect your right to privacy — isn't that what everybody is saying? Privacy is hard. We aim for a good balance between privacy, security, business needs, usability and legal regulations.
last modified: 1st of April 2019.
The following "websites" refer to the internet addresses: www.fortrabbit.com,help.fortrabbit.com, blog.fortrabbit.com and dashboard.fortrabbit.com.
In principle, we process personal data of our users only insofar as this is necessary to provide a functional website and our content and services.
The processing of personal data of our users takes place regularly only with the consent of the user.
An exception applies in cases in which prior consent is not possible for reasons of fact and the processing of the data is permitted by law.
In the processing of personal data necessary for the performance of a contract of which the data subject is a party, Art. 6 para. 1 lit. b DSGVO as legal basis. This also applies to processing operations required to carry out pre-contractual actions.
If processing of personal data is required to fulfill a legal obligation that is subject to our company, Art. 6 para. 1 lit. c DSGVO as legal basis.
If processing is necessary to safeguard the legitimate interests of our company or a third party and if the interest, fundamental rights and freedoms of the data subject do not prevail over the first interest, Art. 6 para. 1 lit. f DSGVO as legal basis for processing.
The personal data of the data subject shall be deleted or blocked as soon as the purpose of the storage is removed.
It may also be stored if provided for by the European or national legislator in EU regulations, laws or other regulations to which the controller is subject.
A blocking or deletion of the data takes place even if a prescribed by the standards mentioned storage period expires, unless there is a need for further storage of the data for a contract or fulfillment of the contract.
The following data is collected here: information about the browser type and the version used, the user's operating system, the IP address of the user, the date and time of access, websites from which the user's system accesses our website, websites, which are accessed by the user's system through our website.
In these purposes, our legitimate interest in the processing of data according to Art. 6 para. 1 lit. f DSGVO.
The data will be deleted as soon as they are no longer necessary for the purpose of their collection.
In the case of storing the data in log files, this is the case after no more than seven days, unless legal or technical reasons or the need for security make longer storage necessary.
The collection of the data for the provision of the website and the storage of the data in log files is essential for the operation of the website.
There is consequently no contradiction on the part of the user.
The cookies store and transmit data such as currency, session and account information, selection in ordering systems, CSRF tokens and potentially other metadata.
For this it is necessary that the browser is recognized even after a page break.
Cookies are stored on the computer of the user and transmitted by this on our side.
Already stored cookies can be deleted at any time.
If cookies are disabled for our website, not all features can be fully used.
On our website, we offer users the opportunity to register by providing personal information.
The data is entered into an input mask and transmitted to us and stored.
In addition to the data that the user enters in our input masks, the IP address of the user, location data and date and time of registration are also stored.
If the registration serves the fulfillment of a contract of which the user is a party or the implementation of pre-contractual measures, an additional legal basis for the processing of the data is Art. 6 (1) lit. b DSGVO.
User registration is required for the provision of certain content and services on our websites. In the case of registration for free trial offers, in particular the registration for the prevention of abuse is required.
Registration of the user in connection with the ordering of paid services is required to fulfill a contract with the user or to carry out pre-contractual measures.
This is the case during the registration process for the performance of a contract or for the performance of pre-contractual measures if the data are no longer necessary for the performance of the contract.
Even after conclusion of the contract, there may be a need to store personal data of the contracting party in order to comply with contractual or legal obligations, the latter in particular according to HGB and the tax law.
If the data are necessary for the fulfillment of a contract or for the execution of pre-contractual measures, a premature deletion of the data is only possible, as far as non-contractual or legal obligations preclude a deletion.
We regularly contact our registered customers via e-mail for updates, such as scheduled maintenance, new releases and updates inform security-relevant changes.
The data from the input mask are transmitted to us during registration.
In connection with the processing of data for the shipment of product information, no transfer of the data to third parties takes place.
The data will be used exclusively for sending the product information.
Legal basis for the processing of the data after the user has registered for the newsletter is the consent of the user Art. 6 para. 1 lit. a GDPR.
The collection of the user's e-mail address serves to provide the product information.
The data will be deleted as soon as they are no longer necessary for the purpose of their collection. The e-mail address of the user is therefore (as all contract-related data) stored as long as the customer maintains an active user account.
You may object to storage for the future if you terminate your customer account at the same time.
It is also possible to suspend the receipt of e-mails temporarily, but this does not end the storage of your e-mail address, which is required for the execution of the contract.
It is possible to contact the provided e-mail address.
In the case of contacting by e-mail, this also includes the necessary legitimate interest in the processing of the data.
For the personal data sent via e-mail, this is the case when the respective conversation with the user has ended.
The conversation ends when it can be inferred from the circumstances that the relevant facts have been finally clarified.
Statutory regulations, such as the obligation to store business mail, may preclude premature cancellation.
The user has the opportunity to revoke his consent to the processing of personal data at any time.
If the user contacts us by e-mail, he may object to the storage of his personal data at any time.
In such a case, the conversation can not continue.
You have the right to request information about whether the personal data concerning you are transmitted to a third country or to an international organization. In this connection, you can request the appropriate guarantees in accordance with. Art. 46 GDPR in connection with the transfer.
In the case of data processing for scientific, historical or statistical research purposes: This right of access may be restricted to the extent that it is likely that the realization of the research or statistical purposes is impossible or seriously impaired and the restriction is necessary for the performance of research or statistical purposes.
You have a right to rectification and / or completion to the controller, if the personal data you process is incorrect or incomplete.
You can correct many data yourself as a registered and registered customer. Incidentally, the responsible person must make the correction without delay.
In the case of data processing for scientific, historical or statistical research purposes: Your right of rectification may be limited to the extent that it is likely to render impossible or seriously affect the realization of the research or statistical purposes and the restriction is necessary for the performance of the research or statistical purposes.
If the processing of personal data concerning you has been restricted, these data may only be used with your consent or for the purpose of asserting, exercising or defending legal claims or protecting the rights of another natural or legal person or for important reasons the public interest of the Union or of a Member State.
Has the restriction of processing been applied to the o.g. If conditions are restricted, you will be informed by the person in charge before the restriction is lifted.
In the case of data processing for scientific, historical or statistical research purposes: Your right to restriction of processing may be limited to the extent that it is likely to render impossible or seriously affect the realization of the research or statistical purposes and the restriction is necessary for the performance of research or statistical purposes is.
You place acc. Art. 21 para. 1 DSGVO objection to the processing and there are no prior justifiable reasons for the processing, or you lay gem. Art. 21 para. 2 DSGVO Opposition to processing.
If the person responsible has made the personal data relating to you public and is in accordance with. Article 17 (1) of the GDPR, it shall take appropriate measures, including technical means, to inform data controllers who process the personal data that you have been identified as being affected, taking into account available technology and implementation costs Persons requesting deletion of all links to such personal data or of copies or replications of such personal data.
If you have asserted the right of rectification, erasure or restriction of the processing to the controller, the latter is obliged to notify all recipients to whom your personal data have been disclosed of this correction or deletion of the data or restriction of processing because, this proves to be impossible or is associated with a disproportionate effort. You have a right to the person responsible to be informed about these recipients.
In exercising this right, you also have the right to obtain that personal data concerning you are transmitted directly from one person responsible to another person responsible, as far as this is technically feasible. Freedoms and rights of other persons may not be affected.
You have the right at any time, for reasons arising from your particular situation, to prevent the processing of your personal data, which pursuant to Art. 6 para. 1 lit. e or f DSGVO takes an objection; this also applies to profiling based on these provisions.
In the case of data processing for scientific, historical or statistical research purposes: You also have the right, for reasons arising from your particular situation, to process personal data relating to you for scientific or historical research purposes or for statistical purposes. Art. 89 para. 1 GDPR is to be contradicted. Its right of objection may be limited to the extent that it is likely to render impossible or seriously affect the realization of the research or statistical purposes, and that the restriction is necessary for the performance of the research or statistical purposes.
However, these decisions may not be based on specific categories of personal data under Art. 9 (1) GDPR, unless Art. 9 (2) lit. a or g DSGVO applies and reasonable measures have been taken to protect the rights and freedoms as well as your legitimate interests.
With regard to the cases referred to in (1) and (3), the person responsible shall take reasonable measures to uphold the rights and freedoms as well as your legitimate interests, including at least the right to obtain the intervention of a person by the person responsible Position and contesting the decision.
Without prejudice to any other administrative or judicial remedy, you shall have the right to complain to a supervisory authority, in particular in the Member State of its place of residence, employment or the place of the alleged infringement, if you believe that the processing of your personal data relates to you Data violates the GDPR.
Techincally, fortrabbit staff is able to view and even edit all uploaded files and databases. Our aim is to be involved as little as possible. There is an internal policy for that. In many support cases knowledge about configuration or code is essential to find a solution. Where possible and acceptable we will ask for permission to look into your code upfront. In other security related cases, for instance fighting phishing attempts, it is required that we examine code pro-activly. This can take place in suspicion.
When deleting Apps or Accounts with us, we delete as much and as complete as possible. For some clients this comes as an surprise as they expect that we just hide data away, until they pay their open invoices.
You can interact with fortrabbit services on various transport protocols. We are storing connection data in log files with each access. This may include the request time, the IP address of the requestor, the protocol and version used, URL called, response status, the number of bytes delivered, a referrer and a user agent (browser and OS). We are doing so for security reasons — to avoid malicious and unauthorized access. We reserve the right to analyze and blacklist certain IPs from our services based on these access logs. We will delete those logs as soon as possible. Certain logs might kept for analysis and fraud protection.
fortrabbit Apps can be accessed via a TLS encrypted connection in various ways. All have in common that fortrabbit is not the Cerificate Authority and that the service is provided "as is". See our dedicated HTTPS & TLS help article for more.
You can see, explore and edit the data we store on you in the fortrabbit Dashboard, visit your Apps, Account, Companies, Billing Contacts.
You can correct the informations on you by editing your Account, Company and Billing Contact details in the Dasboard.
You can make use of your right to be forgotten by deleting your Apps, Companies and Account in the fortrabbit Dashboard. Deletion will be final, irreversible and permanent. Note that App backups will be deleted after retention period and that we still need to keep some billing related data for legal resons.
Sorry, there is no self-service tool to automatically restrict access on personal informations so far. But we are happy to help you with that. Please contact us.
Sorry, there is no self-service tool to automatically download the data we store on you. But we will happily fulfill your requests. Please contact us.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 46
 Art. 21
 Art. 21
 Art. 6
 Art. 89
 Art. 9
 Art. 9