Privacy Notice
Datenschutzerklärung

3 · Hosting and access data

Secure operation of the portal

The portal is hosted in Germany by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, as a processor acting on our instructions. Hosting includes webspace, database, email, backups, monitoring and technical server security.

When the portal is accessed, technical data may be processed, including the requested resource, IP address, date and time, transferred data volume, browser information, referrer and the requesting provider. Processing is necessary to deliver the portal, maintain availability and investigate abuse or security incidents.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the secure, reliable and technically correct operation of the partner portal. Technical server logs are generally retained for up to seven days and longer only where necessary to investigate a specific security incident or establish, exercise or defend legal claims.

4 · Partner accounts

Registration and access management

We process the email address, username, display name, partner assignment, role, account status, password hash, verification and onboarding status, account timestamps and last login time. These data are required to create and administer access for authorised business partners.

The legal basis is Article 6(1)(b) GDPR where processing is required for a contract or pre-contractual steps with the user, and otherwise Article 6(1)(f) GDPR. Our legitimate interest is the controlled and efficient provision of partner information within the existing B2B relationship.

Account data are retained while portal access or the underlying partner relationship is required. When an account is deleted, the login data are removed. Limited security records may remain until the retention periods stated below expire or for as long as required by law or for legal claims.

5 · Invitations and email

Welcome and password messages

We use the account email address to send invitations, welcome messages, temporary access credentials and password-reset messages. The portal sends these operational messages through the hosting provider's mail infrastructure. They are not marketing emails.

A temporary password is valid for 48 hours and must be replaced at the first login. Only a cryptographic password hash is stored in the portal database; the readable password is not retained there. Expired or completed invitation records are deleted no later than 30 days after expiry, acceptance or revocation.

The legal basis is Article 6(1)(b) GDPR and Article 6(1)(f) GDPR. Our legitimate interest is secure account provisioning and support.

6 · Security and usage records

Login, audit and download events

To protect the portal and its confidential partner materials, we record security-relevant events. Depending on the event, this may include a user or partner ID, event type, time, a keyed hash of the IP address, a keyed hash of the session identifier, browser user agent, login result, requested file and limited technical metadata. Raw IP addresses and readable passwords are not stored in these application logs.

• Login-attempt records: 7 days
• Download records: 90 days
• Security and administration audit records: 180 days

The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are access control, protection against misuse, traceability of administrative actions and the security of confidential business information.

8 · Recipients and transfers

Who can receive data?

Personal data are accessible only to authorised Collonil personnel and service providers who require them for portal administration, hosting, email delivery, technical support or security. Processors are bound by Article 28 GDPR. Data may also be disclosed where this is required by law, an authority or for legal claims.

Portal account, login and download data are not intentionally transferred outside the European Economic Area. Links in the Newsfeed may lead to third-party websites. Data are transmitted to the respective operator only when you follow such a link; that operator's privacy information then applies.

9 · Your rights

Data-subject rights

Subject to the statutory conditions, you may request access under Article 15 GDPR, rectification under Article 16, erasure under Article 17, restriction under Article 18, data portability under Article 20 and object to processing based on legitimate interests under Article 21 GDPR.

Contact dsb@collonil.de to exercise these rights. You also have the right to lodge a complaint with a data-protection supervisory authority, in particular the Berliner Beauftragte für Datenschutz und Informationsfreiheit.

10 · Further information

No profiling or automated decisions

We do not use portal data for profiling or automated decisions that produce legal or similarly significant effects. Providing the required account and authentication data is necessary for access; without them, the protected portal cannot be used.

We may update this notice when the portal, its processing activities or legal requirements change. The current version is always available from the login page and the portal footer.