Conclusion
The business concludes this agreement in the app under Settings → Contracts & privacy: electronically by a person who may sign for it, or in writing with a signed printout that it uploads there. The electronic format is sufficient (Art. 28(9) GDPR). The processor has signed the agreement electronically.
The agreement takes effect when it is concluded. It applies as long as the contract of use for Sollmaß under the terms exists, including the trial, and ends with it. What happens to the data afterwards is governed by the section “Term, deletion, evidence”.
Parties
Client (controller): the trade business that uses Sollmaß, with the company name and address it states when concluding the agreement.
Contractor (processor): High5Manufaktur GmbH, Am Buchenhain 2, 76359 Marxzell, Germany — product Sollmaß, domain sollmass.de. Contact: [email protected], phone +49 7248 25592-70.
The business remains in control of the business data. Sollmaß processes it only to provide the app.
Not processing on behalf, but the operator's own processing: requests via this website, trial applications and the invoices for the licences. For these, the privacy policy applies.
Subject matter and purposes
Hosting and operation of the software. Instructions: only what the business records or triggers in Sollmaß. Purpose: performance of the contract, no own use of the client data.
Operating system for the trades: master data (business, team, customers, sites), jobs, documents (from quote to invoice/payment reminder), payment ledger, time, stock, audit, optional AI actions, sending of the e-mails from the app. DATEV CSV is an export to the business, not a transfer by us.
Data
Client and end customer data: contacts, sites, jobs, documents, payments, times and absences, stock, files and photos from job sites, signatures, audit. In addition, messages that come into the app: e-mails from the business's mailbox including attachments, WhatsApp messages and emergency calls with the caller's details.
Users' account data, sign-in by magic link (stored only as a hash), sessions, log.
Employees' location data only if the business switches on GPS at clock in and clock out.
Special categories (Art. 9 GDPR) are not the purpose of the software. If the business enters an absence as “sick”, health data is nevertheless created. The business decides whether it keeps this information; an absence can also be entered without a reason.
Instructions and location
Processing only within the app and on the documented instructions of the business. Place of processing: servers of Hetzner Online GmbH in the Falkenstein/Vogtland data centre, Germany. Data leaves the EU only via the sub-processors named below and via the services that the business sets up itself.
Sub-processors
- Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen: servers, database (Postgres), files and backups of the application, Falkenstein/Vogtland data centre.
- Cloudflare, Inc., San Francisco, USA: DNS, network and protection against attacks for app.sollmass.de, sending of all e-mails from the app ([email protected]) and, if set up, the R2 object storage for uploaded files. Transfer to the USA on the basis of the EU-US Data Privacy Framework, in addition EU standard contractual clauses.
- IONOS SE, Elgendorfer Str. 57, 56410 Montabaur: AI functions via the IONOS AI Model Hub in a data centre in Germany, only if the business uses AI functions, for the request in question — text and photos. If IONOS is set up, text and photos go only there.
- OpenAI, Google (Gemini) or xAI: only if the business uses AI functions, for the request in question — text and photos as long as IONOS is not set up, and uploaded audio files for transcription (OpenAI or Google). Transfer to the USA on the basis of the EU-US Data Privacy Framework where the provider is certified, otherwise on the basis of the EU standard contractual clauses.
- OpenStreetMap map service (staticmap.openstreetmap.de, openstreetmap.org): only when the map in the Schedule is opened, with the IP address of the device and the coordinates of today's assignments.
We inform the business in advance about new sub-processors; the business can object for good cause.
Services of the business
If the business sets up its own access data, we transfer data on its instructions to the provider it has chosen. These providers are not our sub-processors; the business concludes the necessary contracts itself.
- Its e-mail mailbox (IMAP), from which the app fetches messages and attachments.
- Meta (WhatsApp Business Cloud API) for incoming messages.
- Its SMS service for the emergency alert to the on-call staff. The SMS contains the name, phone number and address from the job and goes only to the scheduled on-call staff, never to the caller.
- Other interfaces that it enters, for example accounting or bank access.
We store access data for these services in encrypted form (AES-256-GCM) and do not display it again.
Obligations and technical and organisational measures
Client separation in every query and in the database, roles with a scope of visibility (owner, office, field, subcontractor), processing bound by instructions, support with data subject rights, notification of personal data breaches.
Access by magic link, tokens and sessions only as a hash. Transmission with TLS, from Cloudflare to the server through an encrypted tunnel, HSTS. Third-party access data encrypted. Issued documents locked in content and with a checksum, payment ledger without subsequent changes, log of all important actions.
To be open: the database and files are stored unencrypted on the server; disk encryption is not set up. The daily backup is stored on the same server. We will set up an encrypted off-site copy as soon as the storage needed for it has been decided — it will then be added to the list of sub-processors in advance.
Term, deletion, evidence
The agreement applies as long as the business uses Sollmaß. After the end of the contract, the business can read and export its data for 30 days, after a trial without an order for 90 days from the end of the trial. After that, we shut down the business: we delete personal data that is not subject to a statutory retention obligation; records subject to retention remain blocked until the end of the period and are then deleted (Art. 28 (3) (g) GDPR). Details: Terms and conditions, section 3. Evidence: journal of audit events, document hash, payment ledger.
Before the shutdown, the business exports its data (GoBD export, DATEV, CSV). What it does not export and what we are not required to keep — times, orders, stock ledger, site diary — is gone after that.
The records that commercial and tax law require are kept: issued documents with document copy, payment ledger, incoming invoices, log. Period: until 31 December of the year of the shutdown plus eight years; after that, we delete them. Example: shutdown in 2026, deletion from 1 January 2035.
Other periods: incoming messages without a job 2 years, backups 14 days (disk backups 7 days).
Data subject rights: contacts can be anonymised in the app; issued documents keep their document copy, because tax law requires this (Art. 17 (3) (b) GDPR). Evidence: journal of audit events, document hash, payment ledger.
Questions: [email protected].
Other legal texts
Legal notice · Privacy · Terms and conditions · Right of withdrawal
