Privacy Policy

1. Privacy at a Glance

General Information

The following information provides a simple overview of what happens to your personal data when you visit this website or use the Begehung.pro platform. Personal data is any data that can be used to personally identify you.

Legal Basis

Data processing is carried out on the basis of the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and the German Telecommunications-Digital Services Data Protection Act (TDDDG).

2. Responsible Party

Responsible for data processing on this website and for the account and contract data of platform users:

For the content a customer enters into the platform, i.e. inspections, photos, notes, and reports, the customer is the controller within the meaning of the GDPR. The provider processes this content as a processor acting on instructions (§ 5(4) and § 9(1) of the Terms and Conditions, § 1(2) of the DPA). We are ourselves responsible for users’ account and contract data, the server logs, the AI telemetry, the registration of devices for push notifications, and protecting the link pages.

Data Protection Officer

We are not legally required to appoint a data protection officer. For all questions about data protection and for exercising your rights, you can reach us at datenschutz@begehung.pro.

3. Hosting and Technical Infrastructure

This website and the servers of the Begehung.pro web app run on Google Cloud Run (Google Cloud EMEA Limited, Ireland) in St. Ghislain, Belgium. For the website, we engage Google as our processor. The platform’s database, sign-in, file storage, and server-side functions are hosted by Supabase in Frankfurt am Main, Germany. Which service providers process customer data on our behalf, where they are established, where they process data, and which safeguards apply to transfers to third countries is set out in our subprocessor list.

Email Mailbox and Email Delivery

Our email mailbox is hosted by united-domains AG, Germany; the servers are located in Germany. All emails sent by the platform are delivered via Amazon Web Services (Amazon SES) in Frankfurt am Main (see section 5, email delivery of the platform).

Media Content Storage

Photos, audio files, signatures, generated reports, report templates, company logos, profile pictures, proof photos from external persons, and uploaded import documents are stored in Supabase file storage (Frankfurt am Main, Germany). The storage buckets are private and separated by tenant. Transmission occurs via TLS; according to the provider’s commitment, data is stored with AES-256 encryption. A daily backup of these files is kept at Google Cloud Storage (Google Cloud EMEA Limited) in Frankfurt am Main, Germany; draft reports, uploaded import documents, data exports (ZIP archive), and the archives of the data return are excluded.

4. Data Processing on the Website

Contact and Appointment Booking

This website does not contain a contact form. Contact is established in three ways: through the Calendly booking window, which is only loaded when you click, by email to the address stated in the legal notice, and by phone. When booking an appointment, you enter your name and email address directly with Calendly (see section 9). For inquiries by email or phone, we process the information you provide to us.

Processing is based on Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in efficient processing of inquiries).

Email inquiries remain in our mailbox until the matter is concluded. Retention afterwards is determined by commercial and tax law retention periods.

Replies to Inquiries

We send replies to your inquiries from our mailbox at united-domains AG, Germany. The website itself does not send any emails. Your email address is used exclusively for processing your inquiry and not for marketing purposes unless you have provided separate consent.

5. Data Processing in the Begehung.pro Platform

The Begehung.pro platform (web app and mobile app) processes extensive data as part of on-site documentation. For the content a customer enters into the platform, the customer is the controller; the provider processes it as a processor acting on instructions. The following overview explains what data is collected, how it is processed, and how long it is stored.

Types of Data Collected

• Photos: Images that users upload to an inspection in the web app. During upload, the file name, dimensions, file size, and, from the metadata, the capture time are stored, as are location coordinates and bearing where the image contains them. The image is downscaled and retains its embedded metadata, such as the camera model.
• Audio files: Recordings that users upload to an inspection in the web app, for example from a dictation device or as a voice message. A dedicated server on Google Cloud Run in Belgium converts third-party formats into a uniform format; the platform then automatically creates a transcript (see AI-powered processing). Transmission and storage are encrypted.
• Text notes and assessments: Manual entries such as condition assessments, finding descriptions, meter readings, and free-text comments.
• Generated reports: Reports and protocols created from captured data as PDF, and additionally as a Word file for a draft. The conversion from Word to PDF runs on a dedicated server on Google Cloud Run in Belgium. On request, the platform compiles all data of a sealed version into a ZIP archive; this also runs on Google Cloud Run in Belgium.
• Account data: Name, email address, profile picture, company affiliation, and login credentials (passwords are stored exclusively as hashes).
• Signatures: Handwritten signatures of attendees as images, drawn on the user’s device or via the draft page.
• Contact details of third parties: Salutation, name, function, company, email address, phone number, postal address, and notes on customers’ contacts, attendees, recipients of protocols and reports, and external persons responsible for actions.
• Details of sent emails: recipient address, type, subject and content blocks of the email, sender with display name and reply-to address, triggering user, time, delivery status (accepted, delivered, bounced, reported as spam), an error code, and the email service’s notifications verbatim.

Source of the Data

If a user does not register themselves, we create their account at the customer’s request: the customer gives us the person’s name and email address, and we invite them via Supabase’s invitation function. This data therefore comes from the customer (Art. 14 GDPR). Contact details of third parties, photos, and the other inspection content are entered by the customer’s users.

AI-Powered Processing

Begehung.pro uses Artificial Intelligence (AI) for five functions: checklist import, report import, comment suggestion, action suggestion, and audio transcription. The report itself is created from the captured data without AI. The following processing takes place:

• Checklist and report import: Users upload a document (PDF, DOCX, or XLSX; up to 20 MB for checklist import, up to 50 MB for report import). The complete document is sent to the language model, including any photos embedded in it in the case of report import. The uploaded file is held in Supabase file storage; we remove the import job after 30 days.
• Comment and action suggestion: The user triggers the suggestion themselves. The comment suggestion is available on the comment of a finding, an inspection point, or the whole inspection. The existing comment draft is sent to the language model together with, depending on the level: for a finding, its title, note, comment, actions with deadlines, area, related inspection point, transcripts of the audio recordings, and photos; for an inspection point, its name, hint, and result as well as the title, status, notes, and actions of the related findings; for the inspection, the areas, the failed inspection points, and the title, status, notes, actions, comments, and transcripts of all findings. The action suggestion is available on a finding, with the same details as the comment suggestion for a finding. The result is always a suggestion that the user either accepts or discards.
• Audio transcription: After an audio file has been uploaded, the platform automatically creates a transcript once; for this purpose, the audio file is sent to the language model. The transcript is shown with the recording and can be edited.
• AI telemetry: Each model call creates an entry containing pseudonyms for user and tenant, job type, model and region, token count, cost, queue and run time, outcome, number of images sent, and the size and type of the source file. The prompt, the content of the document, and the model’s response are not recorded. The purpose is cost and operational control, including limiting calls per user; the legal basis is our legitimate interest pursuant to Art. 6(1)(f) GDPR. The entries are evaluated exclusively by the provider and anonymized after 24 months.

The recipient of the AI processing is Google Cloud EMEA Limited (Google Vertex AI, Gemini model). Processing runs in the Frankfurt am Main region, Germany.

No automated decision-making within the meaning of Art. 22 GDPR takes place. All AI-generated content consists of suggestions that must be reviewed and confirmed by the user.

The AI functions process content entered by a customer. The customer is the controller; we act as the customer’s processor under the DPA. The five functions are part of the agreed scope of services.

Error Diagnostics, Session Replay, and Error Reports

For troubleshooting, the platform uses the service Sentry (Functional Software, Inc., USA). Sentry processes events, replays, and attachments in Frankfurt am Main; the provider’s account and organization data at Sentry is located in the USA (see section 11). This website does not embed any error diagnostics service. From the web app, reports travel via a route of the application itself, which forwards them unchanged. The diagnostics SDK does not send default personal data such as the IP address; filters remove cookies, headers, query parameters, and link tokens from events. Four data flows occur:

• Automatic error events (web app, Android, iOS): error message and stack trace, user and tenant ID, application version, the route accessed, and browser or device details. The mobile app additionally sends session data (start, end, crash yes or no, installation ID).
• Session replay (web app only): an event-driven excerpt of the session that is transmitted only when a report is submitted. Visible text is included in plain form, which also covers the names of customers and contacts as well as property addresses. Entries in form fields are masked and images and media are blocked. While the telemetry switch is on, the diagnostics SDK keeps a session ID in session storage (sessionStorage) for this purpose.
• Error report (web app only): an image of the visible area, which the reporter can review and redact before submitting, the console buffer as a file, user and tenant ID, the reporter’s email address, the route accessed, application version, device details, and the description and category of the report.
• Server errors (web app server): If an error occurs on the web app server, an error event with error message, stack trace, route accessed, and, where available, the user ID is sent to Sentry.

For automatic error events and session replay, the legal basis is your consent: for access to your device § 25(1) TDDDG, for further processing Art. 6(1)(a) GDPR. Both are tied to the telemetry switch in the profile, which is off by default; consent is withdrawn via the same switch. The error report is only sent if you submit it yourself; the form shows beforehand which details are included. If an image is attached, you additionally confirm that no data of clients or data subjects is recognizable on it anymore. The legal basis is your consent by submitting (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). An error report is therefore sent even when the telemetry switch is off; a session replay is only attached when it is on. We process server errors on the basis of our legitimate interest in error-free operation (Art. 6(1)(f) GDPR). If events contain content entered by a customer, we process it as that customer’s processor for error diagnostics in accordance with the DPA.

Sentry retains events, replays, and attachments for 30 days.

Signing in with Google

In addition to signing in with an email address and password, the sign-in screens of the web app and the mobile app offer signing in with a Google account. If you use it, your sign-in request goes to Google. Google then transmits the Google account ID, the email address, the display name, and the profile picture where one is set to the platform; the provider does not receive a password. The access tokens issued by Google are kept in the sign-in session on your device (see storage on the device). The legal basis is Art. 6(1)(b) GDPR, as signing in is a prerequisite for using the platform. The choice of this sign-in path is made by the user.

Signing in with Apple

The web app and the mobile app on iPhone and iPad also offer signing in with Apple. In the web app, it is available in every browser, including on Android devices; the mobile app on Android devices does not offer it. If you choose this sign-in path, your sign-in request goes to Apple. Apple then transmits to the platform the identifier that Apple has assigned to your account and your email address. If you have chosen “Hide My Email” at Apple, we receive an email relay address generated by Apple instead of your address, through which our emails reach you. We do not receive a password.

If you sign in via the mobile app on iPhone or iPad, two further items are added. On the first sign-in, Apple transmits your name once, which the app adopts into your profile. In addition, on every sign-in via the app, our server exchanges the code that Apple issues for it for a refresh token and stores it with your account. A refresh token is a longer-lived key that Apple issues for the connection between your Apple account and the platform.

We use the email address, identifier, and name to sign you in and to assign you to your account. The legal basis is Art. 6(1)(b) GDPR, as signing in is a prerequisite for using the platform. We keep the refresh token so that we can revoke the connection between your Apple account and the platform at Apple when your account is deleted. Here, too, the legal basis is Art. 6(1)(b) GDPR: the token serves only to fully disconnect from Apple as well when your account is deleted. Whether you use this sign-in path is your own choice.

The sign-in request is received by Apple Distribution International Limited (Ireland), the Apple company responsible for users in the European Union. Apple processes the sign-in data under its own responsibility and not on our behalf; unlike for push notifications, Apple is not our service provider here. For the transfer to the USA, see section 11. We store the name, email address, and identifier like the other account data (see retention period and deletion), and the refresh token until the end of your account.

Obtaining the Mobile App

The mobile app is in preparation. If it is obtained via Apple’s App Store or Google Play, Apple or Google process the data involved, such as the store account and device identifiers, under their own responsibility; their privacy notices apply.

Storage on the Device

Web app: Your browser’s local storage (localStorage) holds the sign-in session, including the access tokens issued by Google when you sign in with Google, and your settings for appearance, language, telemetry switch, keyboard shortcuts, and visibility and position of the report button. Session storage (sessionStorage) records whether you have closed the beta notice. The web app does not set cookies and does not store any inspection data on your device.

Mobile app: The app works offline. It holds the tenant’s inspection data, i.e. customers and contacts with contact details, projects, inspections with attendees, areas, findings, actions, checklists, notes, comments, and transcripts, and the details of photos, audio files, and signatures, in an encrypted database on your device; the key is kept in the Android Keystore or the iOS Keychain. In addition, the app stores the sign-in session and the telemetry switch in its own storage, which other apps cannot access. Synchronization with the server runs via the PowerSync service (Journey Mobile, Inc.; data center in Dublin, Ireland) and occurs automatically once an internet connection is available. When you sign out, the local database is cleared and the session ends.

This storage is strictly necessary so that you can use the web app and the app as requested (§ 25(2) no. 2 TDDDG). The telemetry switch only stores your choice; the error diagnostics themselves require your consent (see error diagnostics).

Public Link Pages for External Persons

Users can send persons without an account a personal link. There are two such pages today: the task page, on which external persons responsible for actions see their actions, report completion with a remark and a proof photo, and withdraw the report, and the draft page, on which recipients read the draft of a protocol, write posts about it, and sign as attendees. Both pages are generated by the web app server (Google Cloud Run, Belgium); they use self-hosted fonts and do not load any third-party content.

The customer is the controller for the content of the pages and for everything external persons enter there (remark, proof photo with its metadata, posts, signature); we process this data as the customer’s processor. Under our own responsibility, we process the technical data of the request: the server logs (section 7) and a counter that prevents links from being guessed. The counter holds your IP address and the link only as a hash, exclusively in memory, and for no longer than one day. The legal basis is our legitimate interest in protecting the links against misuse (Art. 6(1)(f) GDPR).

In the database, we only store a hash of the link, never the link itself. A link to the task page is valid until 30 days after the latest deadline of the actions, at least 90 days, and can be revoked earlier; a link to the draft page expires when the inspection is sealed. Of each request, only the time of the most recent access is recorded on the link. After expiry or revocation, the hash, creation time, and most recent access remain stored with the tenant as proof of sending and are deleted together with the other customer data. Because the link is part of the requested address, it also appears in the server logs on Google Cloud Run for 30 days (section 7).

Email Delivery of the Platform

We send all emails of the platform via Amazon Web Services (Amazon SES, data center in Frankfurt am Main; contracting party Amazon Web Services EMEA SARL, Luxembourg): sign-in, confirmation, invitation, and password emails, emails for changing the email address, and notifications to users, as well as the emails users send to third parties (protocols and reports with PDF attachment, task emails, emails for coordinating a draft). Amazon reports back to us whether an email was accepted, delivered, bounced, or reported as spam. Addresses to which delivery permanently fails or whose recipients report an email as spam are kept by Amazon SES in a suppression list of the respective customer. Opens and clicks are not tracked. If a customer uses their own sender domain, it is verified via Amazon SES.

We send sign-in, password, and notification emails to users to fulfill the contract (Art. 6(1)(b) GDPR). We send emails to third parties as a processor on behalf of the customer.

The details of sent emails and their delivery events remain stored with the tenant for the duration of the contractual relationship and are deleted together with the other customer data after the contract ends.

Push Notifications of the App

The mobile app can show notifications of the platform as push notifications on your device, for example about feedback from external persons, new posts on a draft, or completed exports. For this purpose, the app registers your device with our server using a device identifier (Firebase Cloud Messaging registration token), the platform (Android or iOS), and the language of the app; your account and the times of registration and last use are stored with it. Each push notification consists of a visible part (title and text) and a data part (type, identifiers, in-app target path, and the values from which the text is built). Depending on the type of notification, it contains names of persons (whoever reports an action as completed, author of a post, signatory), the recipients of an undeliverable or unsent email with the reason, in the case of non-delivery including the email service’s diagnostic text, customer name, property name, action text, an excerpt of a post (up to 200 characters), report details (format, sealing date, version number), and error codes. A push notification does not contain file names, photos, or files.

Push notifications are delivered by Google via Firebase Cloud Messaging (Google LLC, USA), on Android devices as well as on iPhones and iPads. For iPhones and iPads, Google passes them on to the Apple Push Notification service (Apple Inc., USA), which delivers them to the device. We engage Google and Apple as service providers for this; both also process the data in the USA (see section 11). Separate from this is obtaining the app via the app stores, which Apple and Google handle under their own responsibility (see obtaining the mobile app).

Your device also shows the title and text of a push notification on the lock screen, as far as the device settings allow. You switch off push notifications in your device’s system settings.

The legal basis is our legitimate interest in delivering the platform’s notifications to you in the app (Art. 6(1)(f) GDPR). Access to your device to create the device identifier and to display notifications is strictly necessary for this service you requested (§ 25(2) no. 2 TDDDG). If a notification contains content entered by a customer, we process it as that customer’s processor in accordance with the DPA.

We store the device identifier until you sign out of the app, until Firebase Cloud Messaging reports it as invalid, until another user signs in on the device, or until your account is deleted. If you sign out without an internet connection, it is only deleted once Firebase Cloud Messaging reports it as invalid or another user signs in on the device. It is not deleted based on age alone.

Subscription and payment processing

When a customer books a subscription in the web app or we set one up for them, we handle the subscription, payment, invoices and payment reminders via the payment service Stripe (contracting party: Stripe Payments Europe, Limited, Dublin, Ireland). The customer's owners and administrators reach Stripe's customer portal from the profile of the web app; there they change the payment method, billing address and plan, retrieve invoices and cancel. Stripe processes: company name, billing address and, if provided, VAT ID, which the customer enters on Stripe's checkout page; the email address of the person booking; plan, number of seats, invoices and payment transactions. You enter card and bank details only with Stripe; we do not receive them. Stripe does not receive any content that customers put into the platform.

Under its data processing agreement (https://stripe.com/legal/dpa), Stripe processes this data partly as our processor, to provide the subscription, payment and invoices, and partly as an independent controller, for example for fraud prevention, to comply with anti-money-laundering and regulatory obligations, and for cooperation with banks and payment providers. Stripe's privacy policy applies to that processing (https://stripe.com/privacy).

Customers based in Germany additionally receive every invoice and every invoice correction as an e-invoice in ZUGFeRD format. It is created and sent by email by an extension for Stripe provided by Fizard GmbH, St.-Cajetan-Straße 5, 81669 Munich, Germany, which we engage as a processor. For this, Fizard reads the invoice data at Stripe: invoice recipient with address, VAT ID and email address, line items, amounts and payment status. Fizard processes data in data centers in the European Union; access by subcontractors based in the USA is possible (see section 11).

The legal basis is the performance of the contract with the customer (Art. 6(1)(b) GDPR). Where the data concerns the person booking on behalf of the customer, we base the processing on our legitimate interest in performing the contract with the customer (Art. 6(1)(f) GDPR). We issue invoices in the legally required form and retain them (Art. 6(1)(c) GDPR in conjunction with § 14 UStG, § 147 AO and § 257 HGB).

We and Stripe retain invoices and the associated customer data for the statutory periods, up to ten years, including beyond the deletion of the customer data in the platform.

Retention Period and Deletion

Inspection data (photos, audio files, text notes, reports) is stored for the duration of the contractual relationship. After the contract ends, the customer's owners and administrators can reach only the profile of the web app for 90 days, to export the data or book a subscription (retrieval period under § 10 paragraph 1 of the T&C). After that, we block access for all of the customer's users and delete its data no later than seven days after the block, including the user accounts (sign-in data, name), unless statutory retention obligations apply. If you request erasure of your data under § 8 paragraph 7 of the T&C, we delete it upon the end of the contract. If a free trial run ends without a subscription, the 90 days only begin when 30 days have passed since the first sign-in, even if the trial run ends earlier, for example upon sealing of the inspection. If your email address belonged to a user of a company that has already been deleted, there is no trial run and the 90 days begin with the first sign-in. During the contract period, you can delete individual inspections and their data at any time. Exempt from the deletion periods above are the operational records of AI calls: they contain no content, identify user and tenant by a pseudonym, and are anonymized after 24 months.

After deletion, apart from the operational records of AI calls, the following data is retained:

• A fingerprint of your email address: a non-reversible hash of the address, not the address itself. Purpose: anyone who registers again with the address of a user of a deleted company does not receive another free trial run. We store it for as long as we offer a free trial run. The legal basis is our legitimate interest in preventing repeated use of the free trial run (Art. 6(1)(f) GDPR).
• The record of which version of the T&C and of the DPA was accepted and when; after the account is deleted, it is linked to the fingerprint instead of the account. Purpose: proof of the conclusion of the contract and of the data processing agreement. We store it until the end of three years after the end of the year of deletion (regular limitation period, §§ 195, 199 BGB). The legal basis is our legitimate interest in establishing, exercising or defending legal claims (Art. 6(1)(f) GDPR).
• Invoices and the customer data held by Stripe (see Subscription and payment processing). Purpose: statutory retention. We and Stripe retain them for up to ten years (§ 147 AO, § 257 HGB). The legal basis is Art. 6(1)(c) GDPR.

We do not delete copies in backups separately; they expire with the backup period (database seven days, files 30 days from the next successful backup run). Likewise, error events, session recordings and feedback reports at Sentry only expire with its 30-day period.

For each sign-in session, Supabase stores the IP address and browser details until the session ends; on your device, the sign-in session remains stored until you sign out. The daily database backup is kept for seven days. Deleted or replaced files remain retrievable in the daily file backup for 30 days from the next successful backup run and are then permanently deleted. The retention periods for error diagnostics, email details, links for external persons, the device identifier for push notifications, and server logs are stated in the respective sections.

End of your user account in a company

If you leave a company or are removed from it, your user account ends. We then delete your sign-in data and your profile details. What you have recorded in the company, such as inspections, photos and notes, belongs to the company and remains with it. In addition, the following data is retained:

• A fingerprint of your email address: a non-reversible hash of the address, not the address itself. Purpose: if you later register again yourself with this address, no free trial run starts. We store it for as long as we offer a free trial run. The legal basis is our legitimate interest in granting only one free trial run per email address (Art. 6(1)(f) GDPR).
• Your name as it appears in the company's inspections, among the attendees and on signatures. Purpose: it remains visible there who was involved. The name is therefore part of the company's content, for which the company is responsible and which we process on its behalf (see Responsible Party). We delete it together with the company's data.
• The record of which version of the T&C you accepted and when. Purpose: proof of the conclusion of the contract. We store it until the end of three years after the end of the year in which your user account ended (regular limitation period, §§ 195, 199 BGB), and delete it afterwards. The legal basis is our legitimate interest in establishing, exercising or defending legal claims (Art. 6(1)(f) GDPR).
• The record that you accepted the DPA on behalf of the company, provided the company still relies on this acceptance. It then belongs to the company. Purpose: proof of the company's data processing agreement. We store it until the company is deleted, and afterwards, as after the deletion of a company, until the end of three years after the end of the year of deletion. The legal basis is our legitimate interest in establishing, exercising or defending legal claims (Art. 6(1)(f) GDPR).

Even when a user account ends, we do not separately delete copies in backups or error events, session recordings and feedback reports at Sentry. They expire with the same periods as after the deletion of a company: database seven days, files 30 days from the next successful backup run, Sentry 30 days.

6. Your Rights

You have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to object (Art. 21 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to withdraw consent (Art. 7(3) GDPR)

To exercise your rights, please contact: datenschutz@begehung.pro

Right to complain to a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority. The supervisory authority responsible for us is:

7. Server Log Files

When you access this website and the web app, the servers on Google Cloud Run (Belgium) log every request with IP address, browser details (user agent), previously visited page (referrer), requested address, time, status code, and response time. Requests to the platform’s database and server-side functions are logged by Supabase (Frankfurt am Main) with comparable details. This data is not merged with other data sources.

The logs on Google Cloud Run are deleted after 30 days, the logs at Supabase after seven days.

The legal basis is Art. 6(1)(f) GDPR. We have a legitimate interest in providing the website and the platform, finding errors, and fending off attacks.

8. Cookies, Local Storage, and Analytics

This website stores your choice in the consent banner in your browser’s local storage (localStorage) so that the banner does not reappear on every visit. The information remains stored until you change it via the icon at the bottom left or clear your browser storage. The website only sets cookies if you consent to analytics.

Storing your choice is strictly necessary for the service you requested (§ 25(2) no. 2 TDDDG). The information does not leave your browser; we do not receive it.

Google Analytics

This website uses Google Analytics 4, a web analytics service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google Analytics is only loaded once you consent to the “Analytics” category in the banner; before that, the website does not send any data to Google Analytics. After consent, Google Analytics sets cookies (_ga and _ga_ followed by the website’s ID; lifetime up to two years) and records page views, time on page, clicks on appointment booking, device type, operating system, browser, approximate location (country, region, city), and the referring page. Google Analytics 4 does not store IP addresses; the IP address is only used to determine the approximate location and is then discarded. Event-level data is deleted after two months. Advertising cookies and the use of the data for advertising are excluded via Google’s consent settings. The data may be transferred to Google LLC in the USA (see section 11). The legal basis is your consent: for access to your device § 25(1) TDDDG, for further processing Art. 6(1)(a) GDPR. You can withdraw your consent at any time via the icon at the bottom left; the website then deletes the analytics cookies and no longer sends data to Google Analytics.

9. Calendly

For appointment booking, we use the service Calendly (Calendly LLC, USA). The booking window is only loaded when you click an appointment button; before that, no request is sent to Calendly. With the click, your browser loads program code and content from Calendly; Calendly receives your IP address and browser details and may set cookies. If the booking window cannot be loaded, for example because of an ad blocker, the booking page opens directly on Calendly instead. When you book an appointment, you enter your name and email address directly with Calendly; this data is transmitted to Calendly. Details can be found in Calendly’s privacy notice: https://calendly.com/legal/privacy-notice

Loading the booking window after your click is strictly necessary for the service you requested (§ 25(2) no. 2 TDDDG). Your booking details are processed on the basis of Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in efficient appointment scheduling).

Bookings remain in our Calendly account until the matter is concluded. Retention afterwards is determined by commercial and tax law retention periods.

10. Our Social Media Profiles

Begehung.pro has profiles on LinkedIn, YouTube and Instagram. This website links to them in the footer but does not embed anything from these platforms: no scripts, no fonts, no images and no videos. As long as you do not click any of these links, the platforms receive no data through them. Only after your click does the platform open in a new tab, and its operator processes your data under its own terms.

Platform operators and their privacy notices:

• LinkedIn: LinkedIn Ireland Unlimited Company, Dublin, Ireland. Privacy notice: https://www.linkedin.com/legal/privacy-policy
• YouTube: Google Ireland Limited, Dublin, Ireland. Privacy notice: https://policies.google.com/privacy
• Instagram: Meta Platforms Ireland Limited, Dublin, Ireland. Privacy notice: https://privacycenter.instagram.com/policy

When you visit one of our profiles, the operator processes your data, for example your IP address, your usage behavior and, if you are logged in, your account data. Insofar as the operator provides us with statistics on our profile derived from this, we and the operator are joint controllers (Art. 26 GDPR). You can find LinkedIn's joint controller agreement at https://legal.linkedin.com/pages-joint-controller-addendum and Meta's at https://www.facebook.com/legal/terms/page_controller_addendum. You can exercise your rights under the GDPR both with us and with the operator.

We run these profiles to inform people about Begehung.pro and to get in touch with prospective customers. The legal basis is our legitimate interest in public relations (Art. 6(1)(f) GDPR).

The operators also process your data in the USA.

11. International Data Transfers

We and our service providers process data predominantly within the European Union. Transfers to third countries are possible in the following cases; for each provider, we state the safeguard under Art. 44 et seq. GDPR and where you can view it, and for Apple the basis Apple relies on:

• Google Cloud (Cloud Run, Vertex AI, Cloud Storage): The contracting party is Google Cloud EMEA Limited, Ireland; a transfer to Google LLC in the USA is possible. Safeguard: EU-US Data Privacy Framework (adequacy decision pursuant to Art. 45 GDPR; Google LLC is certified, see https://www.dataprivacyframework.gov) and EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR in the Cloud Data Processing Addendum (https://cloud.google.com/terms/data-processing-addendum).
• Google Analytics: The contracting party is Google Ireland Limited; a transfer to Google LLC in the USA is possible. Safeguard: EU-US Data Privacy Framework (Google LLC is certified) and EU Standard Contractual Clauses in the Google Ads Data Processing Terms (https://business.safety.google/adsprocessorterms/).
• Signing in with Google: A transfer to Google LLC in the USA is possible. Safeguard: EU-US Data Privacy Framework (Google LLC is certified, see https://www.dataprivacyframework.gov).
• Signing in with Apple: Apple Distribution International Limited, Ireland, is responsible for users in the European Union. According to Apple, personal data is generally stored by Apple Inc. in the USA. Apple Inc. is not certified under the EU-US Data Privacy Framework. According to its privacy policy (https://www.apple.com/legal/privacy/en-ww/), Apple bases these transfers on EU Standard Contractual Clauses; you can obtain a copy via Apple’s privacy contact form (https://www.apple.com/legal/privacy/contact/).
• Firebase Cloud Messaging (push notifications to the app): The contracting party is Google LLC in the USA; processing takes place on Google’s global infrastructure, including in the USA. Safeguard: EU-US Data Privacy Framework (Google LLC is certified, see https://www.dataprivacyframework.gov) and EU Standard Contractual Clauses in the Firebase Data Processing and Security Terms (https://firebase.google.com/terms/data-processing-terms).
• Apple Push Notification service (push notifications to iPhones and iPads): The contracting party is Apple Inc. in the USA. Apple Inc. is not certified under the EU-US Data Privacy Framework. The service is governed by the terms of the Apple Developer Program License Agreement (https://developer.apple.com/support/terms/apple-developer-program-license-agreement/); Apple does not offer a separate data processing agreement for it. According to its privacy policy, Apple bases transfers from the European Economic Area on EU Standard Contractual Clauses; you can obtain a copy via Apple’s privacy contact form (https://www.apple.com/legal/privacy/contact/).
• Amazon Web Services (email delivery): Contracting party in Luxembourg; a transfer to Amazon.com, Inc. in the USA is possible. Safeguard: EU Standard Contractual Clauses in the AWS Data Processing Addendum (https://d1.awsstatic.com/legal/aws-dpa/aws-dpa.pdf); Amazon.com, Inc. is also certified under the EU-US Data Privacy Framework.
• Supabase (database, sign-in, file storage): Contracting party in Singapore, for which there is no adequacy decision; the data is located in Frankfurt am Main, access from third countries is possible. Safeguard: EU Standard Contractual Clauses in Supabase’s data processing agreement (https://supabase.com/legal/customer-resources/data-processing-addendum).
• PowerSync (synchronization of the mobile app): Contracting party in the USA; the data is located in Dublin (Ireland). Safeguard: EU Standard Contractual Clauses in PowerSync’s data processing agreement (https://www.powersync.com/legal/dpa).
• Sentry (error diagnostics): Contracting party in the USA; events are located in Frankfurt am Main, account and organization data in the USA. Safeguard: EU-US Data Privacy Framework (Functional Software, Inc. is certified) and EU Standard Contractual Clauses in Sentry’s data processing agreement (https://sentry.io/legal/dpa/).
• Stripe (payment processing): Contracting party in Ireland; Stripe transfers the data to Stripe, LLC in the USA. Safeguard: EU-US Data Privacy Framework (Stripe is certified, see https://www.dataprivacyframework.gov) and EU Standard Contractual Clauses in Stripe's Data Transfers Addendum (https://stripe.com/legal/dta).
• Fizard (e-invoicing): Contracting party in Germany, processing in the European Union; subcontractors based in the USA, for example for hosting and error diagnostics, may have access. Safeguard: EU-US Data Privacy Framework and EU Standard Contractual Clauses according to Fizard's data processing agreement (https://fizard.com/datenschutz-vereinbarungen).
• Calendly (appointment booking): Contracting party in the USA. Safeguard: EU-US Data Privacy Framework (Calendly LLC is certified, see https://www.dataprivacyframework.gov).

You can obtain a copy of the Standard Contractual Clauses we have agreed with our service providers on request from our privacy contact: datenschutz@begehung.pro. Apple’s clauses are available from Apple (see above).

12. Data Processing Agreements

For the use of the Begehung.pro platform in a business context, a Data Processing Agreement (DPA) pursuant to Art. 28 GDPR applies. It is particularly relevant when captured inspection data contains personal data of third parties (e.g., photos of occupied rooms, protocols with tenant data). Under its § 1(3), the DPA is concluded before processing begins; it is concluded upon your consent at registration, otherwise or for a new version upon your consent before further use, and can be viewed at Data Processing Agreement. The engaged subprocessors are listed in the subprocessor list.

13. Automated Decision-Making

No automated decision-making including profiling pursuant to Art. 22 GDPR takes place. The AI-powered functions of Begehung.pro (checklist import, report import, comment suggestion, action suggestion, and audio transcription) create suggestions and transcripts that the user reviews, accepts, or changes. No legally binding or similarly significant decisions are made automatically.

14. Provision of Data

The provision of personal data is not required for using the website. Booking an appointment requires your name and email address; you enter these in the Calendly booking window. Using the Begehung.pro platform requires a user account with name and email address. Booking a subscription requires the company name, billing address, email address and a payment method. Capturing inspection data, i.e. photos, audio files, and text, is necessary for the platform’s core functionality.

15. Contact

For questions about data protection, you can contact us at any time:

Email: datenschutz@begehung.pro

Phone: +49 162 1565538