Privacy policy (Datenschutzerklärung)
This is a convenience translation. Only the German version is legally binding.
In this policy, we inform you which personal data we process when you visit our website epatronic.com, when you send enquiries via our forms and when you use EUTHENIA ERP (euthenia.cloud), for what purpose and on what legal basis.
1. Controller
EPATRONIC Systems GmbH
Altrottstr. 31
69190 Walldorf
Represented by its Managing Director (Geschäftsführer) Damian Hillebrand
Email: [email protected]
We have not appointed a data protection officer, as there is no legal obligation to do so. You can reach us at the address above with any questions about data protection.
2. Principles: no cookies, no tracking
This website does not set cookies, does not use any analytics or audience measurement services, does not embed advertising scripts and does not create usage profiles. Section 6 explains how we measure the success of our Google ads without cookies. Fonts, images and scripts are hosted on our own server.
3. Accessing the website, hosting and delivery
When you access the website, technically necessary data is processed: IP address, date and time, page accessed, amount of data transferred, browser type and operating system. This is necessary to deliver the page and to keep operations secure (Art. 6(1)(f) DSGVO/GDPR). Our web server does not store any access logs.
Hosting: The server is located in a data centre of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in Nuremberg (Germany). Hetzner acts as our processor.
Content delivery network: The website is delivered via the network of Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA). Cloudflare forwards all requests to our server, protects against attacks and caches content such as images and stylesheets; in doing so, Cloudflare processes in particular your IP address (Art. 6(1)(f) GDPR; our legitimate interest is secure and fast delivery). Cloudflare is certified under the EU-US Data Privacy Framework, on which transfers to the USA are based (Art. 45 GDPR).
HOAI fee calculator: The fee calculator at epatronic.com/honorarrechner.html runs entirely in your browser. Your entries (e.g. chargeable costs, fee zone, work stages) are not transmitted to us or to third parties and are not stored; they are lost when you close the page. Only the technically necessary data of the page request described above are processed.
4. Enquiry forms
On our contact page and on the pages about EUTHENIA Retail and EUTHENIA Construction, you can send us an enquiry using forms.
What data: Subject, name, company, email address, optionally telephone number, your message and, for product enquiries, additional details (e.g. number of branches, sector, employees).
Purpose and legal basis: We use the details to answer your enquiry and, where applicable, to prepare an offer or a demo (Art. 6(1)(b) GDPR, pre-contractual measures, and point (f) GDPR, answering general enquiries). We need the mandatory fields in order to be able to reply to you; an enquiry is not possible without them.
Processing: The form is transmitted to our server in Germany. The enquiry is not stored in a database there but delivered by email to our mailbox (exception: the click ID of a Google ad without any further details, section 6). For sending emails, we use STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, as our processor.
Acknowledgement of receipt: You receive an automatic confirmation at the email address provided. It only contains your name and the selected subject. To prevent the form from being misused to send messages to third-party addresses, we send at most three confirmations per address per day.
Protection against misuse: To ward off automated enquiries, we use a check field that is invisible to humans and limit the number of enquiries. For this purpose, your IP address or email address is held as a counter for a maximum of 24 hours in a cache on our server (Art. 6(1)(f) GDPR).
Storage period: We delete your enquiry as soon as it has been dealt with conclusively and no statutory retention obligations apply; if the enquiry leads to a contract, the retention periods under commercial and tax law apply.
5. EUTHENIA ERP (cloud application at euthenia.cloud)
Registration and trial period: For registration, we process the company name, first name and surname, email address and your password (exclusively as a cryptographic hash value), as well as your choice between sample data and an empty database, and the version and time of your acceptance of the General Terms and Conditions (AGB) (evidence of conclusion of the contract). We send you a confirmation link (valid for 24 hours), check the registration and inform you of the approval, the end of the 30-day trial period (reminders 7 and 2 days beforehand) or a rejection (Art. 6(1)(b) GDPR). Registration data that is only required for the confirmation is deleted after 30 days at the latest. If you came via a Google ad, we also store its click ID (section 6).
Login and security: We process your access credentials, the times of your first and last login and – if two-factor authentication is enabled – an encrypted key for your authenticator app and hashed recovery codes. Security-relevant events and changes to data are logged (action, time, user, IP address, browser identifier) in order to detect misuse and to be able to trace changes (Art. 6(1)(b) and (f) GDPR). We remove the IP address and browser identifier from this log after 90 days.
Storage in the browser: EUTHENIA stores your session (login token) in your browser’s session storage, which is cleared when the tab is closed, and settings such as theme, language and your tenant’s company data in local storage. This storage is strictly necessary for the service you have requested (§ 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act)); EUTHENIA does not set cookies. An overview of all entries can be found under Cookies and storage in the browser.
External content (only with consent): For the address of a lead in sales, EUTHENIA embeds a map section from the OpenStreetMap Foundation (St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom). When it is loaded, your IP address is transmitted to the provider; the provider may store its own data in your browser and processes the data under its own responsibility. The map section only loads once you consent in the EUTHENIA cookie dialogue or click “Load once” in the individual case (§ 25(1) TDDDG, Art. 6(1)(a) GDPR); without consent, a placeholder is shown. Your choice is stored in your browser’s local storage. You can withdraw your consent at any time with effect for the future via “Cookie settings”. An adequacy decision of the EU Commission exists for the United Kingdom (Art. 45 GDPR). We deliver the other maps in EUTHENIA (live tracking, regional map), including the map data (© OpenStreetMap contributors), from our own server; no data is transmitted to third parties in the process.
Your company’s data: We process the data you record in EUTHENIA (e.g. customers, documents, employees, files) as a processor exclusively on your instructions (Art. 28 GDPR) on the basis of the Data Processing Agreement (AVV); the protective measures are described on the page Security & data protection. Your company is the controller for this data.
Subscription and payment (Stripe): If a company books a plan, payment and invoicing are handled by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (“Stripe”). For this purpose, we transmit to Stripe the company name, the email address of the administrator making the booking and the services booked; you enter payment data (e.g. card number, IBAN) and billing address directly with Stripe, and we do not receive them. From Stripe, we receive the status of the subscription (plan, seats, term, payment status). The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and, for invoices, the statutory retention obligation (point (c)). Stripe processes payment data partly under its own responsibility (e.g. for fraud prevention and on the basis of regulatory obligations); in doing so, data may also be transmitted to Stripe, Inc. in the USA, which is certified under the EU-US Data Privacy Framework. More information at stripe.com/de/privacy.
Withdrawal form: If you declare withdrawal from a subscription using our withdrawal form, we store your name, company, email address, your message and the time in order to process and evidence the withdrawal (Art. 6(1)(b) and (c) GDPR); you receive an acknowledgement of receipt. We retain the details until the retention periods under commercial and tax law have expired.
Hosting and email: The application runs on servers of Hetzner Online GmbH in Nuremberg (Germany); documents are stored in the same data centre. We send emails via STRATO GmbH. Both act as our processors.
Data backup: To ensure availability and recovery after incidents (Art. 32 GDPR), we back up the application’s data (database, uploaded documents, configuration) every night and before every update. The backups are already encrypted on the server; the decryption key is held neither on the server nor by the storage provider. We store a copy on storage provided by STRATO GmbH (Otto-Ostrowski-Straße 7, 10249 Berlin; data processing in Germany or the EU), with which a data processing agreement (Art. 28 GDPR) is in place. We retain daily backups for 7 days, weekly backups for 4 weeks and monthly backups for 6 months.
Storage period: We store account and tenant data for the duration of use or of the contract; thereafter, we delete it unless statutory retention obligations prevent this. Deleted data may remain in the encrypted backups for up to six months; these are then overwritten.
6. Google Ads – measuring success without cookies
We place advertisements with Google (Google Ads). If you click on one of our ads, Google appends a random click identifier (parameter “gclid”) to the address of our page. Our pages pass this identifier on in the links when you click further and as a hidden field in the forms; nothing is stored in or read from your browser for this purpose, and no script from Google is loaded.
What we store: If you then send an enquiry, register for EUTHENIA or your trial period is approved, we store on our server in Germany only the click identifier, the type of event (enquiry, registration, approval), for enquiries the selected subject, and the time – without name, email address or any other details. In the forwarded enquiry email, we note “Source: Google ad”.
Transmission to Google: We upload these entries to our Google Ads account so that Google can count which ads led to enquiries and registrations. The recipient is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google can associate the identifier with the data that Google itself collected when the ad was clicked; Google is responsible for this (Google’s privacy policy). A transfer of data to the USA by Google cannot be ruled out; Google is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).
Purpose, legal basis, duration: We want to know which ads are worthwhile and to align our advertising budget accordingly (legitimate interest, Art. 6(1)(f) GDPR). We delete the entries after 90 days. You can object (section 8) – or simply avoid the identifier by accessing our page directly rather than via an ad, or by removing “gclid” from the address.
7. Recipients and processors
We only pass on your data to service providers that we need for operations and that are contractually bound by our instructions: Hetzner Online GmbH (hosting, Germany), Stripe Payments Europe, Limited (payments and invoices for booked plans, Ireland; see section 5), STRATO GmbH (email delivery and storage location of the encrypted backups, Germany) and Cloudflare, Inc. (delivery and protection of the website, USA). We only load the OpenStreetMap map section in EUTHENIA with your consent; the provider receives your IP address in the process (section 5). We only transmit the click identifiers of ad visits to Google (section 6); data is not sold.
8. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). To exercise these rights, please contact the address given in section 1.
Right to object (Art. 21 GDPR): Insofar as we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims.
Right to lodge a complaint: You may lodge a complaint with a data protection supervisory authority, in particular the one competent for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart.
9. No automated decision-making
We do not make any decisions based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR. Registrations for EUTHENIA are checked and approved by us personally.
10. Changes
We adapt this policy when our website, our services or the legal situation change. The version published here at any given time applies.
As of: October 2026