Privacy policy

Controller

BumbleDev UG (haftungsbeschränkt) i. G. represented by its managing director [Name] [Street and number] [Postcode and city] Germany Email: mail@bumbledev.com

In brief

We only process the data we need to provide palmtreeCRM. We do not use any tracking or analytics tools, show no ads and load neither fonts nor any other content from third-party servers. We only use cookies where they are technically necessary. There is no automated decision-making, including profiling.

Hosting

palmtreeCRM runs on servers of netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany, in data centres in Germany. netcup processes the data solely on our behalf and according to our instructions, under a data processing agreement pursuant to Art. 28 GDPR.

Sending emails

We send the emails of palmtreeCRM, such as the links to confirm an address and invitations, through Brevo (Brevo SAS, Paris, France). For this, Brevo processes the recipient’s email address, their name where we know it and the content of the email on our behalf, under a data processing agreement pursuant to Art. 28 GDPR. The legal basis is that of the purpose the email serves, as described in the sections on orders and invitations.

Visiting the website

When you visit the website, your browser necessarily sends data to our server, in particular your IP address, the date and time of the request, the address requested and details of your browser and operating system. We process this data to deliver the website and to keep it running securely and reliably, and keep it no longer than needed for that. The legal basis is our legitimate interest in a working and secure website (Art. 6(1)(f) GDPR). The connection is encrypted with TLS.

Cookies

We only set two cookies, both technically necessary:

• “__session” keeps you signed in. It is deleted when you sign out and otherwise expires after seven days.
• “language” remembers the language you picked on the start page and expires after one year.

Storing these cookies is strictly necessary for the features you ask for (Section 25(2) no. 2 TDDDG). The legal basis of the processing involved is Art. 6(1)(b) GDPR for signing in and Art. 6(1)(f) GDPR for the language.

Protection against abuse

Before you sign in, order palmtreeCRM or accept an invitation, your browser solves a small computing task (ALTCHA) that makes automated attacks expensive. The task is created and checked on our own server; no data is passed to third parties and no cookies are set. We also count for a short time how often sign-ins are attempted from an IP address and for an account, and slow down too many attempts. These counters are only held in the server’s memory and are deleted once their time window has passed, after about an hour at the most. The legal basis is our legitimate interest in protecting your account and our systems (Art. 6(1)(f) GDPR).

Contact by email

When you email us, for example our sales team, we process what you send us to answer your inquiry. The legal basis is Art. 6(1)(b) GDPR where your inquiry aims at a contract, and otherwise our legitimate interest in answering it (Art. 6(1)(f) GDPR). We delete your inquiry once it is settled, unless statutory retention obligations stand in the way.

Orders and user accounts

When you order palmtreeCRM, we process the details from the order form: the name and address of your company, your VAT ID if you give one, the plan you chose, and the first name, last name, email address and password of your user account. We only store the password as a cryptographic hash. Before the account can be used, we email you a link to confirm your address. We need these details to conclude and perform the contract, to give you access and to send you an invoice by email every month (Art. 6(1)(b) GDPR); without them, we cannot provide palmtreeCRM.

Orders whose address nobody confirms are deleted after a week. Otherwise we delete the data of your account when the contract ends. We keep invoices and other documents relevant for tax purposes for as long as commercial and tax law requires, usually up to ten years (Art. 6(1)(c) GDPR in conjunction with Section 257 HGB and Section 147 AO).

Invitations

Admins can invite further people to their team by entering their email address and role; we then email them a link to join on the admin’s behalf. Whoever accepts the invitation sets their first name, last name and password themselves. An invitation can be accepted for seven days and is kept until it is accepted or withdrawn by an admin. The legal basis is the performance of our contract with your company and its legitimate interest in inviting its team (Art. 6(1)(b) and (f) GDPR).

Data you enter in palmtreeCRM

For the customers, contacts, correspondence, documents and tasks that you and your team enter in palmtreeCRM, your company is the controller within the meaning of the GDPR. We process this data solely on your behalf and only to provide palmtreeCRM, as a processor under Art. 28 GDPR. We are happy to conclude a data processing agreement with you; just write to mail@bumbledev.com.

Recipients

We only pass your data on to our hosting provider and our email service provider, which process it on our behalf, and to authorities where we are legally obliged to. We do not sell any data.

Your rights

You have the right to ask us for the following; just write to mail@bumbledev.com:

• information about the data we process about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure of your data (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• your data in a common, machine-readable format (Art. 20 GDPR)

Right to object: Where we process your data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object to it at any time on grounds relating to your particular situation (Art. 21 GDPR).

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one responsible for us: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany.