GDPR / DSGVO Data Protection Notice
These GDPR data protection notices give you a short overview pursuant to Art. 13 GDPR. They can be read on their own; detailed information is provided in the Privacy Policy, and particulars for contact and support forms are provided in the Contact and Support Privacy Notice.
CONTROLLER
The controller is Visual Memory Works GmbH (“VMW”), Elbestraße 10, 45768 Marl, Germany, represented by its managing director Ilker Secaat KARA (Local Court of Gelsenkirchen, HRB 18062). CXR App is offered and operated by Visual Memory Works GmbH (“VMW”). It is your point of contact for sales, billing, payment processing and support.
Contact person for data protection inquiries: Prof. Ergün Kalaycı, e-mail: erguen.kalayci@visualmemoryworks.de. He receives data protection inquiries for Visual Memory Works GmbH. This function does not entail a formal appointment as data protection officer within the meaning of Art. 37 GDPR.
Telephone: +49 2365 5033557.
PURPOSES AND LEGAL BASES
We process your personal data, in particular identity and contact data, account and subscription data, billing data, usage data, technical logs and your messages, for the following purposes:
- Handling and responding to your inquiry and providing and billing the services, insofar as this serves the performance of a contract or pre-contractual measures: Art. 6(1)(b) GDPR
- Handling other inquiries, ensuring security and improving the services on the basis of our legitimate interests: Art. 6(1)(f) GDPR
- Compliance with legal obligations, for example retention obligations under commercial and tax law: Art. 6(1)(c) GDPR
- Processing that requires consent: Art. 6(1)(a) GDPR
The processing of your contact and support inquiry is not based on consent.
Where businesses place their own customer data in their apps, those businesses are controllers; VMW processes this data as a technical service provider and processor pursuant to Art. 28 GDPR. The role of the respective business is assessed separately.
RECIPIENTS AND THIRD COUNTRIES
We pass on data only to service providers insofar as this is necessary for hosting, payment processing, communication or AI functions and these services are actually used. These include Hetzner (hosting in Germany once the planned migration of the applications is complete), Stripe (payment processing for payments to VMW) and, for AI functions, OpenAI, Anthropic and Google.
The role of service providers under data protection law depends on the processing concerned. Hosting, e-mail and comparable infrastructure providers generally act as processors on behalf of and on the instructions of VMW (Art. 28 GDPR). Providers of AI functions may, depending on the service and configuration, be processors or independent controllers for their own purposes. Payment service providers such as Stripe process payment data partly on behalf of their business customers and partly as independent controllers for their own purposes, for example for fraud prevention or to comply with their own legal obligations; the providers describe the details in their privacy notices (for Stripe: Stripe Privacy Center). Transfers to countries outside the EU/EEA take place only if the requirements of Art. 44 et seq. GDPR are met.
To process payments for the CXR subscription and, where applicable, the setup, we process information such as transaction ID, amount, currency, payment and refund status, and billing data. Full card numbers and comparable payment instrument data are intended to be collected directly by the payment service provider and not stored on VMW’s systems. The role of the payment service provider under data protection law is not the same for every transaction.
The information website is operated on a web server in Turkey. Since there is no adequacy decision of the European Commission for Turkey under Art. 45 GDPR, the processing of access data on the web server in Turkey is governed by Art. 46 or Art. 49 GDPR. Upon request, we will inform you which safeguard applies to this transfer.
Services from OpenAI, Anthropic and Google may be used for AI functions. Contracting parties, processing locations and transfer bases depend on the service actually used and the terms of the respective provider. The fact that the applications are to be operated on servers in Germany does not mean that all AI processing takes place in Germany; it may also take place outside Germany and outside the EU or EEA. Such a transfer takes place only under the conditions of Art. 44 et seq. GDPR.
RETENTION PERIOD
We store your data only for as long as necessary for the stated purposes or as long as statutory retention obligations apply. Short overview:
- Account and customer content: They are stored for as long as the account is active. When the account is terminated, access is closed and deletion is carried out without delay. The account and customer content are removed from the active systems and from the associated backups within 30 days at the latest. If data is restored from a backup, data that has already been deleted must not be made usable again.
- AI chat history: Where necessary, the history of a conversation is stored for a maximum of six months from the last interaction in that conversation. After that, it is deleted or effectively anonymized. Justified requests for earlier deletion are reviewed separately.
- Invoices and accounting records: They are stored for the duration of the applicable statutory retention obligations. Statutory obligations and specific legal disputes are each handled with their own required periods; they do not justify retaining all account content.
- Support correspondence and technical logs: They are stored for as long as necessary for processing, traceability and security; after that, they are deleted or anonymized. No fixed period applies to them. The support targets of 24 and 48 hours are response targets, not retention periods.
Details on all data types are provided in the Privacy Policy and in the document “Data Retention, Deletion and Anonymization Policy”.
YOUR RIGHTS
Where the statutory requirements are met, you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). Where processing is based on your consent, you can withdraw it at any time with effect for the future; the lawfulness of the processing carried out before the withdrawal remains unaffected. The provision of your data is neither required by law nor by contract; however, without the information needed for processing, we may not be able to respond to your inquiry.
AI results should be reviewed by users before they are used. If automated decisions take place that produce legal effects concerning you or similarly significantly affect you, these will be explained separately.
To exercise your rights, please contact erguen.kalayci@visualmemoryworks.de (contact person for data protection inquiries: Prof. Ergün Kalaycı).
RIGHT TO LODGE A COMPLAINT
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for VMW is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Postfach 20 04 44, 40102 Düsseldorf, telephone +49 211 38424-0, e-mail poststelle@ldi.nrw.de, www.ldi.nrw.de.