Privacy statement

In this privacy statement we inform you about which personal data we collect in the course of your use of www.ecratum.com and www.relatico.com and for what purpose that data is used. You can access this information at any time at https://www.ecratum.de/privacy and https://www.relatico.com/privacy-statement.


1. Verantwortliche Stelle/Kontakt

The controller within the meaning of the data protection laws is:

ecratum GmbH
Schwedter Str. 17
10119 Berlin


You can reach our data protection officer at datenschutz@ecratum.de.Please note: if you use ecratum as an employee of a company, ecratum is a processor for that company. In that case the respective company is the controller for your registration and for the processing of the data you upload. In that case please also refer to that company's privacy statement.


2. Subject matter of data protection

The subject matter of data protection is personal data. Under Art. 4(1) GDPR this is all information relating to an identified or identifiable natural person; this includes, for example, names or identification numbers.


3. Collection and use of your data

3.1 Automated data collection

When you access our website, your device automatically transmits data for technical reasons. The following data is stored separately from any other data you may transmit to us:
‍
- Date and time of access
- Browsertyp / Version
- verwendetes Betriebssystem
- URL of the previously visited website
- Volume of data sent

This data is stored exclusively for technical reasons and is at no point attributed to a specific person.

3.2 Anfragen 

If you send us enquiries by email or post, the details from your enquiry, including the contact details you provide there, are stored and used in order to process the enquiry. As a rule we store your enquiry for the standard limitation period, that is three years from the end of the year in which you sent us the enquiry, unless it is subject to statutory retention periods or is needed for longer to preserve, enforce or defend against claims in the specific case.We collect this data in order to receive and process your enquiry, Art. 6(1)(b) GDPR.

3.3 Registration and use of ecratum or relatico

​You can register in order to use ecratum's customer and supplier management platforms. All data that has to be provided as part of registration is marked as such. Alternatively, as a company being approached, you can also provide certain requested data without registering, or view or download the information offered.

When using the platform you can also upload any (personal) data, store it on our servers and share it with third parties.

We collect and process this data in order to be able to provide you with the account (Art. 6(1)(b) GDPR). The data is stored for as long as you do not delete the account or the data you uploaded to us, plus the retention period of our backups (see section 10).

Please note: ecratum and relatico are also communication tools and work in a similar way to email. If you share data with third parties (for example suppliers), we also store that shared data for the respective recipients, comparable to an email that is stored in the recipient's mailbox. The data you have shared therefore remains available to the recipient, even if you delete your account or the data in your account. Please contact the respective recipient if they should delete your data as well.


4. Newsletter

We offer free newsletters. With our newsletter we inform you regularly about general and industry, product or country specific aspects of our supplier management solution and about ways of optimising supplier management with the help of our products and services, which are as a rule of great interest to all users of the ecratum platforms.

ecratum also provides information about your use of ecratum or relatico, the aggregate use by your colleagues and by your suppliers. Anonymised key figures provide information about the performance of you, your company and your suppliers relative to other users, companies and suppliers. As part of the service you automatically receive newsletters with this user and performance related information by email after registering.

You can unsubscribe from ecratum newsletters at any time free of charge. Every newsletter contains information on how you can unsubscribe with effect for the future. In this case your personal data is collected and processed in order to provide you with the newsletters you ordered, Art. 6(1)(b) GDPR.


5. Cookies
We store so called “cookies” in order to offer you a comprehensive range of functions and to make using our websites more convenient. “Cookies” are small files that are stored on your computer with the help of your internet browser. If you do not want cookies to be used, you can prevent cookies from being stored on your computer through the corresponding settings in your internet browser. Please note that the functionality and the range of functions of our offering may be limited as a result.Specifically, we use the cookies listed at the following link: https://www.ecratum.de/legal/cookies​

We use session cookies for the technical operation of the website. These are deleted when the browser is closed.

​These cookies cannot identify you as a person. In any case, the use of cookies is justified on the basis of our legitimate interest in designing our website to meet demand and in its statistical evaluation, and on the basis that your legitimate interests do not override that interest, Art. 6(1)(f) GDPR.


6. Google Analytics

We use Google Analytics, a web analytics service provided by Google LLC (“Google”). Google Analytics collects pseudonymous data from you about your use of our website, including your shortened IP address, and uses cookies. This data is transferred to a Google server in the USA and stored there. Google will use this information to evaluate your use of the website on our behalf, to compile reports on the use of our website and to generate further analyses and evaluations associated with the use of our website and of the internet. Google may also transfer this information to third parties where this is required by law or where third parties process this data on Google's behalf.​

Google is certified under the EU-U.S. Privacy Shield. For the USA, the European Commission decided on 12 July 2016 that an adequate level of data protection exists under the rules of the EU-U.S. Privacy Shield (adequacy decision, Art. 45 GDPR). Further information is available at https://www.privacyshield.gov

​Your data remains stored at Google Analytics for a period of 14 months. After that period the data is deleted and only aggregated statistics are retained.​

You can find more detailed information about how Google uses your data in Google's privacy policy: https://www.google.com/policies/privacy/

You can deactivate Google Analytics with a browser add on if you do not want website analytics. You can download it here: http://tools.google.com/dlpage/gaoptout?hl=de. You can also object to the use of Google Analytics by opting out at the following link: https://www.ecratum.de/legal/cookies

Google Analytics is used on the basis of our legitimate interest in designing our website to meet demand, in its statistical evaluation and in advertising it efficiently, and on the basis that your legitimate interests do not override that interest, Art. 6(1)(f) GDPR.​


7. Services used

Webflow: Our website is presented with the help of Webflow, a platform whose main purpose is to showcase our product, the Relatico software. Webflow records data about visits and interactions on our website in order to improve the user experience. The data transfer to the USA takes place in compliance with international data protection standards.

Mailjet: We use Mailjet for our email marketing. This service processes information such as email addresses and content you send us in order to get in touch with you and to send you relevant information.

Google Tag Manager: We use Google Tag Manager to manage our website tags. This service collects anonymised data about your use of our website, which helps us optimise our online presence.

Crisp Widget: We use the Crisp Widget for live chat support on our website. When you use the chat, your messages and interactions are recorded so that we can offer you efficient support.

Google Analytics 4: In order to better understand visitor behaviour on our website, we use Google Analytics 4. This service records anonymised information about your interactions on our website.

Contact form: If you use our contact form, the personal data you provide, such as your name and email address, is stored and processed in order to communicate with you.

Direct registration: Our website links to our software (relatico and relatico.NEXT). When you register we collect data such as your name, your email address and a password in order to give you access to these functions.Hubspot: We use HubSpot, a service provided by HubSpot Inc., on our websites for analytics purposes.

This is online marketing software. We use it for our email marketing (newsletters as well as automated mailings, for example to provide downloads), social media publishing and analytics, reporting, contact management (CRM), landing pages and contact forms.​

For reach and conversion measurement, HubSpot also collects pseudonymous usage statistics of our website for us on the basis of cookies. You can object to this collection at the following link: https://www.ecratum.de/legal/cookies

​We use HubSpot on the basis of our legitimate interest in efficiently advertising our services, and on the basis that your legitimate interests do not override that interest, Art. 6(1)(f) GDPR.

HubSpot processes data in the USA. There is no adequacy decision by the European Commission for the USA. However, HubSpot is certified under the EU-U.S. Privacy Shield Framework. Further information is available at https://www.privacyshield.gov

You can find further information about HubSpot's data processing in the privacy policy of HubSpot Inc., available at: https://legal.hubspot.com/de/privacy-policy


8. Automated individual decisions or profiling measures

We do not use automated processing to reach a decision, nor profiling.


9. Disclosure of data

As a matter of principle, your personal data is disclosed without your express prior consent only in the cases listed below:

- Where it is necessary in order to investigate unlawful use of our services or for legal prosecution, personal data is forwarded to the law enforcement authorities and, where applicable, to injured third parties. This only takes place where there are concrete indications of unlawful or abusive conduct. Data may also be disclosed where this serves to enforce terms of use or other agreements. We are also legally obliged to provide information to certain public bodies on request. These are law enforcement authorities, authorities that prosecute administrative offences subject to fines, and the tax authorities.

- This data is disclosed on the basis of our legitimate interest in combating misuse, prosecuting criminal offences and securing, asserting and enforcing claims, and on the basis that your rights and interests in the protection of your personal data do not override that interest, Art. 6(1)(f) GDPR, or on the basis of a legal obligation under Art. 6(1)(c) GDPR

- We rely on contractually bound third party companies and external service providers (“processors”) to provide the services. In such cases, personal data is disclosed to these processors to enable them to carry out further processing. These processors are carefully selected by us and reviewed regularly to make sure your rights and freedoms are preserved. The processors may use the data exclusively for the purposes we specify and are further contractually obliged by us to handle your data exclusively in accordance with this privacy statement and German data protection law. In detail, we use the processors listed at https://www.ecratum.de/privacy/technical-providers. Data is disclosed to processors on the basis of Art. 28(1) GDPR, alternatively on the basis of our legitimate interest in the economic and technical advantages associated with the use of specialised processors, and on the basis that your rights and interests in the protection of your personal data do not override that interest, Art. 6(1)(f) GDPR.

- In the course of the further development of our business, the structure of ecratum GmbH may change, in that its legal form is changed or subsidiaries, business divisions or components are founded, bought or sold. In such transactions, customer information is transferred together with the part of the business being transferred. Whenever personal data is disclosed to third parties to the extent described above, we ensure that this is done in accordance with this privacy statement and the applicable data protection laws.

Any disclosure of personal data is justified by the fact that we have a legitimate interest in adapting our corporate form to economic and legal circumstances where necessary, and that your rights and interests in the protection of your personal data do not override that interest, Art. 6(1)(f) GDPR.


10. Erasure of your data

We erase or anonymise your personal data as soon as it is no longer required for the purposes for which we collected or used it under the sections above. As a rule we store your personal data for the duration of the usage or contractual relationship via the website, plus a reasonable period during which we keep backup copies after erasure, unless that data is needed for longer for legal reasons, for criminal prosecution, or to secure, assert or enforce legal claims.

Where data has to be retained for legal reasons, it is blocked. The data is then no longer available for further use.

‍
11. Your rights as a data subject

11.1 Right of access
You have the right to obtain from us, at any time upon request, information about the personal data concerning you that we process, to the extent set out in Art. 15 GDPR. You can submit a request by post or by email to the address given above.

11.2 Recht zur Berichtigung unrichtiger Daten
You have the right to request that we correct the personal data concerning you without delay, should it be inaccurate. Please contact us at the addresses given above.

11.3 Right to erasure
You have the right to request that we erase the personal data concerning you, under the conditions described in Art. 17 GDPR. In particular, those conditions provide for a right to erasure where the personal data is no longer necessary for the purposes for which it was collected or otherwise processed, as well as in cases of unlawful processing, where an objection has been raised, or where an obligation to erase exists under Union law or the law of the member state to which we are subject. For the data retention period, see section 10 of this privacy statement. To exercise the above right, please contact us at the addresses given above.

11.4 Right to restriction of processing
You have the right to request that we restrict processing in accordance with Art. 18 GDPR. This right exists in particular where the accuracy of the personal data is disputed between the user and us, for the period required to verify that accuracy; where the user, having a right to erasure, requests restricted processing instead of erasure; where the data is no longer required for the purposes we pursue but the user needs it to assert, exercise or defend legal claims; and where the successful exercise of an objection is still in dispute between us and the user. To exercise the above right, please contact us at the addresses given above.

11.5 Right to data portability
You have the right to receive from us the personal data concerning you which you have provided to us, in a structured, commonly used, machine readable format in accordance with Art. 20 GDPR. To exercise the above right, please contact us at the addresses given above.

11.6 Widerspruchsrecht
You have the right, on grounds relating to your particular situation, to object at any time under Art. 21 GDPR to the processing of personal data concerning you which is carried out, among other things, on the basis of Art. 6(1)(e) or (f) GDPR. We will stop processing your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

11.7 Right to lodge a complaint You also have the right to address complaints to a competent supervisory authority. The supervisory authority responsible for Berlin is, for example:

Berlin Commissioner for Data Protection and Freedom of Information
Friedrichstraße 219
10969 Berlin 
mailbox@datenschutz-berlin.de

You can find a list of all European data protection authorities here (English):
http://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm


12. Changes to this privacy statement

The current version of this privacy statement is always available at

https://www.ecratum.de/privacy bzw.

https://www.relatico.com/privacy-statement abrufbar.

Stand: 1. Oktober 2018