Data Processing and Infrastructure Policy
This policy explains how data processed in connection with the CXR App platform is handled with regard to technical infrastructure, system architecture, hosting structure and external service providers. CXR App is offered and operated by Visual Memory Works GmbH (“VMW”). It is your point of contact for sales, billing, payment processing and support.
The platform is a cloud-based software infrastructure provided over the internet. For the continuity, security and performance of the services, various technical components, data centers and service providers may be shared.
ROLES IN DATA PROCESSING
Depending on their scope and purpose, the data processed on the platform is assigned to different roles:
- For account, subscription, payment and security data of users of the platform, as well as for support and contact inquiries and the operation of the website, VMW may be the controller within the meaning of Art. 4(7) GDPR. Further details are set out in the Privacy Policy and the GDPR / DSGVO Data Protection Notice.
- Where customers (businesses) upload data of their own clientele, their guests or visitors or other third parties to the platform, or collect such data through their apps, these businesses may be controllers. In this case, VMW acts as a technical infrastructure provider and processor within the meaning of Art. 28 GDPR on the basis of a data processing agreement.
The roles are classified in accordance with the GDPR and other applicable data protection law.
INFRASTRUCTURE AND HOSTING ARCHITECTURE
The services of the platform are hosted on a scalable and secure cloud infrastructure. The system architecture may consist of application servers, databases, file storage systems and network components.
To ensure service continuity, backup systems, load balancing and security layers may be used. The technical infrastructure may be updated and further developed over time.
DATA CENTERS AND GEOGRAPHIC LOCATION
The information website cxr.app is operated on a web server in Turkey. When the website is accessed, the technically necessary access data transmitted by your browser (for example IP address, date and time, page accessed) is processed there.
The applications of CXR App (Linke, Catalog, Menux, Eventix, Momento and Selecto) are to be migrated to Hetzner’s infrastructure in Germany for the European service; this migration is planned and not complete. For the target infrastructure, three servers in Germany and a separate backup or cloud environment with a takeover arrangement (failover) are planned. Until the migration is complete, processing may take place on the existing infrastructure; we will update this text once it is complete.
E-mail hosting for the mailbox info@visualmemoryworks.de is located in Germany. The website and the applications are separate systems with their own data flows; the hosting location cannot be inferred from the language of a page.
Since there is no adequacy decision of the European Commission for Turkey under Art. 45 GDPR, the processing of access data on the web server in Turkey is governed by Art. 46 or Art. 49 GDPR. Upon request, we will inform you which safeguard applies to this transfer.
Where personal data is transferred to countries outside the European Union or the European Economic Area, this takes place only under the conditions of Art. 44 et seq. GDPR. Further information is provided in the document International Data Transfers.
EXTERNAL TECHNOLOGIES AND SERVICE PROVIDERS
The following kinds of external technologies and service providers may be used in operating the platform:
- Cloud and hosting services (Hetzner)
- Database and data storage systems
- E-mail and notification services
- Payment and financial systems (Stripe)
- Security and monitoring tools
- Artificial intelligence technologies (OpenAI, Anthropic, Google) and data analytics
These service providers may access data only to the extent necessary to provide the services and are obliged to maintain data security within the scope of their contractual obligations. Further information is provided in the document Third-Party Services, Data Processors and Sub-processors.
The role of service providers under data protection law depends on the processing concerned. Hosting, e-mail and comparable infrastructure providers generally act as processors on behalf of and on the instructions of VMW (Art. 28 GDPR). Providers of AI functions may, depending on the service and configuration, be processors or independent controllers for their own purposes. Payment service providers such as Stripe process payment data partly on behalf of their business customers and partly as independent controllers for their own purposes, for example for fraud prevention or to comply with their own legal obligations; the providers describe the details in their privacy notices (for Stripe: Stripe Privacy Center). Transfers to countries outside the EU/EEA take place only if the requirements of Art. 44 et seq. GDPR are met.
ARTIFICIAL INTELLIGENCE AND AUTOMATED PROCESSING
Some functions of the platform may work together with artificial intelligence technologies and automated data processing. These systems may be used for functions such as text processing, data analysis, generating suggestions, classification or content creation.
Services from OpenAI, Anthropic and Google may be used for AI functions. Contracting parties, processing locations and transfer bases depend on the service actually used and the terms of the respective provider. The fact that the applications are to be operated on servers in Germany does not mean that all AI processing takes place in Germany; it may also take place outside Germany and outside the EU or EEA. Such a transfer takes place only under the conditions of Art. 44 et seq. GDPR.
Further information is provided in the document Use of Artificial Intelligence and Data Processing Notice.
ACCESS MANAGEMENT AND SECURITY
Technical and organizational security measures are implemented in the platform’s infrastructure, for example:
- technical measures to prevent unauthorized access
- role-based restriction of access permissions
- encryption and methods for secure data transmission
- regular system updates and security reviews
- monitoring and handling of possible security breaches
Further information is provided in the document Security and Infrastructure Policy.
CHANGES
This policy may be updated if the infrastructure technologies used, the service providers or the legal situation change. The current text applies from the day of its publication.
Please direct questions about this policy to Visual Memory Works GmbH, Elbestraße 10, 45768 Marl, Germany, e-mail: info@visualmemoryworks.de.