Privacy policy

Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Hosting

The website is hosted at Cloudflare. The provider is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, represented for customers in the EEA by Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany.

When you visit the website, Cloudflare processes technically necessary data such as IP address, time of access, page requested, browser type and operating system in server logs in order to deliver the site and protect it against attacks. These logs are kept only briefly and are not combined with other data. The legal basis is Art. 6 (1) (f) GDPR, our legitimate interest in a secure and stable operation of the website.

Cloudflare may also process data in the USA. Cloudflare is certified under the EU-US Data Privacy Framework; the EU Commission's standard contractual clauses apply in addition. Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/

Getting in touch

If you write to us by email or via the contact form, we process the details you give us (for example name, email address, company and the content of the message) in order to handle your request.

The contact form transmits your details in encrypted form to our own server at Cloudflare, which forwards them to us by email without storing them. It also sends a confirmation with a copy of your details to the email address you enter in the form.

We send the confirmation to you through the service Resend (Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA), which processes the message in its EU region; the transfer is based on the European Commission's standard contractual clauses. Resend's privacy policy: https://resend.com/legal/privacy-policy

Your message ends up in a mailbox at Google (Gmail), and anything you write to info@scernetta.com is forwarded there by Cloudflare Email Routing. For users in the EEA the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google therefore receives the content of your enquiry and may also process data in the USA; Google LLC is certified under the EU-US Data Privacy Framework. Google's privacy policy: https://policies.google.com/privacy

The legal basis is Art. 6 (1) (b) GDPR (steps prior to entering into a contract) or Art. 6 (1) (f) GDPR (our legitimate interest in answering requests). We keep the request for as long as it takes to handle it, and beyond that only where statutory retention obligations apply.

The software itself

The desktop program SCERNETTA DDD analyses tachograph data locally on your machine. Card files and results are not transmitted to us.

At first start the program connects once to api.scernetta.com to exchange the activation code for a licence. This transmits the code and a technical fingerprint of the computer, no personal data and no card data. Stored are the code, the fingerprint, the time of activation and the issued licence with its expiry date, together with the company name the code was issued for. The connection runs through Cloudflare, whose server logs briefly contain the IP address, as described above. At every start the program also asks downloads.scernetta.com which version is the newest. Like any request this transmits the IP address, and nothing else about the user, the licence or the computer. This connection also runs through Cloudflare. Starting a trial in the program’s start window also transmits the computer’s fingerprint to api.scernetta.com. If a trial licence is issued, we store the time, the fingerprint, the end date and the trial licence, but no name and no company.

This policy covers the website and the desktop program. The SCERNETTA API connects to our licence service at license.scernetta.com. What is sent and stored there is described in the API guide and the licence agreement.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and objection to processing based on legitimate interests (Art. 21 GDPR). To exercise them, use the contact address above.

You may also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority at your place of residence. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW).