Privacy policy

1. Responsible person and data protection contact

The person responsible for its own processing is: AEGIS SECURITAS represented by Udo Neidhart Hansaring 7 63843 Niedernberg Germany Email: [email protected] If corporate customers use AEGIS OS to process personal data of their customers, employees or partners, the respective corporate customer is usually the controller and AEGIS-SECURITAS is the processor. In these cases, affected people generally direct their professional concerns to the respective company.

2. Purposes and legal basis

We process personal data to provide and secure our websites and platform, to initiate and execute contracts, for account management, communication, payment processing, support, abuse and fraud prevention, error analysis and to fulfill legal obligations. The legal bases are, in particular, Art. 6 Para. 1 lit. b GDPR for contracts and contract initiation, Art. 6 Para. 1 lit. c GDPR for legal obligations, Art. 6 Para. 1 lit.

3. Technical Provision, Hosting and Log Data

During use, technically necessary connection and protocol data are processed, in particular IP address, timestamp, resource accessed, device and browser information, authentication and security events and error messages. This serves for delivery, stability, troubleshooting and protection against unauthorized access. AEGIS OS is operated on a self-hosted server and container infrastructure. Contracted technical service providers may additionally be used where required for hosting, network operation, email delivery, payment processing, identity services or explicitly enabled integrations. Exclusively German or exclusively European processing is only promised if this is expressly agreed in the specific contract.

4. Local storage and cookies

The application currently uses technically required local storage mechanisms and session information, such as login, security status, language, appearance, tenant mapping and settings explicitly chosen by the user. Such access is necessary to provide the requested digital service. Unnecessary analysis, marketing or profiling technologies will not be activated without prior effective consent. If this changes, appropriate consent management will be carried out and this declaration will be updated.

5. Contact, inquiries and support

For contact requests, we process in particular name, email address, company, telephone number, topic, message and technical metadata. The processing takes place to process the request, initiate a contract and understandable communication. Support content can be linked to the affected account, tenant, and technical diagnostic information for error analysis.

6. Registration, Accounts and Authentication

For registration and account use, we process identity, contact, company, role, authorization and security data. Passwords are processed via the authentication infrastructure used. If you voluntarily use registration via Google or other identity providers, we receive the account and identity data released by the provider. The identity provider's data protection information also applies to processing.

7. AEGIS OS, client data and order processing

Corporate customers generally determine the purposes and content of their technical data processing in AEGIS OS. This can include customer, employee, appointment, document, project, invoice, communication and process data. AEGIS-SECURITAS processes this data to provide the ordered platform service, for data backup, for support and according to documented instructions. The agreement on order processing can be accessed at /avv and becomes part of the customer contract if there is processing on behalf of the customer. Client separation, roles, audit information and export or deletion functions support the customer in his obligations, but do not replace his own legal basis and data protection organization.

8. File uploads and document processing

Uploaded files can be stored, technically analyzed, structured, extracted or processed for shared platform functions. The uploading user must be authorized for processing and may not upload any content whose storage or distribution is unlawful. Sensitive data should only be processed if necessary, covered by contract and protected by appropriate permissions.

9. AI features

When using AI functions, inputs, shared company data, conversation histories and file content can be transmitted to the AI processing provided via the platform. The processing serves the requested analysis, extraction, summary, recommendation or text creation. Users will be clearly informed when they interact with an AI system. AI outputs may be erroneous and will not be used as the sole basis for making legally or similarly significant decisions. If AEGIS-SECURITAS acts as a processor, use is based on the instructions and configuration of the respective corporate customer.

10. Appointment booking, customer portals and public forms

For public bookings, portals, feedback, recommendation and other forms, the requested contact, appointment, content and evidence data is processed. For client-related forms, the company named in the form is usually responsible for the technical purpose. AEGIS-SECURITAS provides the technical platform on behalf of the company. Mandatory information is limited to what is necessary for the respective process.

11. Payment processing via Stripe

Stripe is used for paid subscriptions and optionally for payments from end customers. Contract, transaction, payment, device and fraud prevention data is transmitted to Stripe. Stripe processes some of the data under its own data protection responsibility. Payment data is not completely stored in AEGIS OS. The legal basis is contract fulfillment, legal obligations and fraud prevention.

12. Transactional emails via Resend

Resend can be used for account, invitation, booking, support and other transactional messages. The recipient address, subject, message content, delivery status and technical shipping data are processed. Shipping takes place to execute the contract, on documented instructions from a corporate customer or due to legitimate communication and security interests.

13. Optional Integrations

Users can voluntarily connect third-party providers such as Google Workspace, Microsoft 365, Slack, HubSpot, Stripe or other services. The access tokens and selected data required for this will only be processed after explicit authorization. The scope and purpose result from the respective integration display. Connections can be revoked; The third party provider may maintain additional data subject to their terms and conditions.

14. Recipients, processors and sub-processors

Data only receives data that needs it for operations, contracts, support, security or legal obligations. This may include hosting and platform providers, email, payment, identity, storage, support and integration service providers, as well as authorized employees. Service providers are selected and contractually obliged in accordance with legal requirements. The current overview of key sub-processors and optional third-party providers is available at /sub-processors.

15. Transfers to third countries

For individual platform, payment, email, identity, integration or AI services, processing outside the European Economic Area cannot be excluded. Unless there is an adequacy decision, we base transfers in particular on suitable safeguards such as EU standard contractual clauses and additional protective measures, where necessary. Information about specific recipients can be requested via the data protection contact.

16. Storage period

Data will only be stored for as long as necessary for the respective purpose, contract, security, record keeping or legal retention. Contact requests are regularly deleted after completion and retention interests no longer apply. Account data generally exists for the duration of the contract. Contract and billing documents can be retained in accordance with legal deadlines. Backup copies are overwritten as part of scheduled cycles.

17. Data Subject Rights

According to the legal requirements, affected persons have the rights to information, correction, deletion, restriction, data portability and objection. Any consent given can be revoked with effect for the future. There is also a right to lodge a complaint with a data protection supervisory authority, in particular the Bavarian State Office for Data Protection Supervision. Data protection requests can be submitted in a structured manner via /data protection request. A process number is immediately generated there. For data that a corporate customer processes as the controller, the request for identity and factual verification can be forwarded to this customer.

18. Automated decisions

As part of the general use of the platform, AEGIS-SECURITAS does not make exclusively automated decisions with legal or similarly significant effects on data subjects. AI and analytics capabilities provide supporting results that must be verified by authorized users.

19. Data Security

We use appropriate technical and organizational measures, including encrypted transmission, authorization and tenancy concepts, logging, recovery and security measures. No system can guarantee absolute security. Customers must also adequately protect their own accounts, devices, permissions and exports.

20. Changes to this Statement

This declaration will be adjusted if functions, service providers or legal situation change. We will inform customers in an appropriate manner about any significant changes to ongoing contractual processing. The published version has an update date.

For the AEGIS-SECURITAS newsletter we process your email address, consent wording and version, and subscription, confirmation and unsubscribe timestamps. Newsletters about AEGIS OS, IT, software and automation are sent only after email confirmation. The confirmation link expires after 48 hours. You can withdraw consent using the unsubscribe link. Your email is then removed from the active newsletter list; a pseudonymous status remains to prevent further sends. We use Resend for email delivery. Existing customer accounts are not subscribed automatically.