1. Data Controller
The Data Controller responsible for personal data processed on this website and via the platform is:
ReguLib (Caspar Vogel & Mathieu Ribeiro GbR)
Collenbachstraße 27, 40237 Düsseldorf, Germany
Email: contact@regulib.com
2. Hosting & Data Location
Our platform and web applications are hosted exclusively on infrastructure provided by Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany). Databases, application logic, and uploaded evidence files are stored and processed strictly within ISO 27001-certified data centers located in Germany. Processing relies on Art. 6(1)(f) GDPR (legitimate interest in delivering a secure, performant, and stable cloud infrastructure).
3. Categories of Data Processed & Retention Periods
Account & User Profile Data: We process your name, work email address, and company name to fulfill our contractual obligations and manage user access rights (Art. 6(1)(b) GDPR). Account data is retained for the active duration of your organization's subscription and deleted within 30 days of account cancellation, unless statutory tax or commercial retention obligations apply.
Billing & Transaction Metadata: Payment processing is handled via Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland) and its parent company Stripe, Inc. (USA). We do not store full payment card details on our servers. International data transfers to Stripe, Inc. in the USA are safeguarded under the EU-U.S. Data Privacy Framework (DPF) pursuant to Art. 45 GDPR. Pursuant to statutory commercial and tax laws (§ 147 AO, § 257 HGB), transaction metadata, receipts, and invoices are retained for 10 years following the end of the tax year in which they were issued.
Transactional System Emails: Account activations, password resets, and workflow notification emails are transmitted via AhaSend B.V. (hosted within the EU/Germany) based on contract performance (Art. 6(1)(b) GDPR). System logs of transmitted transactional emails are retained for no longer than 30 days.
Customer Support Communication: Inquiries sent to our email support are processed via ALL-INKL.COM - Neue Medien Münnich (Hauptstraße 68, 02742 Friedersdorf, Germany) based on our legitimate interest in providing effective customer care and responding efficiently to platform inquiries (Art. 6(1)(f) GDPR). Correspondence is retained for as long as necessary to handle your request and up to 6 years if subject to statutory commercial retention under § 257 HGB.
Server & Security Logs: Technical access parameters (including IP addresses, browser specs, timestamp, and HTTP request headers) are logged temporarily for up to 14 days to maintain operational security, prevent unauthorized access, and defend against cyberattacks (Art. 6(1)(f) GDPR).
4. Terminal Access & Zero Tracking (§ 25 TDDDG)
ReguLib operates a cookie-free promotional site. We do not use third-party tracking pixels, marketing cookies, or cross-site behavioral analytics.
Access to and storage of information on your end device (such as JSON Web Tokens or essential session identifiers stored in localStorage/sessionStorage for user authentication) is carried out strictly pursuant to § 25(2) No. 2 TDDDG (Telecommunications Digital Services Data Protection Act), as it is strictly necessary to deliver the SaaS service explicitly requested by the user.
5. Your Data Rights & Right to Object
Under Articles 15–21 GDPR, you have the following rights:
- Access & Data Portability (Arts. 15, 20 GDPR)
- Rectification & Erasure (Arts. 16, 17 GDPR)
- Restriction of Processing (Art. 18 GDPR)
Right to Object (Art. 21 GDPR): Where your personal data is processed on the basis of legitimate interests pursuant to Art. 6(1)(f) GDPR (e.g., server log analysis or support communication), you have the right to object to such processing at any time on grounds relating to your particular situation by contacting contact@regulib.com.
You also have the right to lodge a complaint with a competent supervisory authority:
State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW)
Kavalleriestraße 2–4, 40213 Düsseldorf, Germany
6. Automated Decision-Making
We do not utilize automated decision-making or profiling producing legal effects within the meaning of Art. 22 GDPR.
7. Data Protection Officer
Pursuant to Art. 37 GDPR and § 38 BDSG, ReguLib is not legally required to designate a formal Data Protection Officer. For all privacy inquiries, please contact contact@regulib.com.