Privacy Policy

1. Controller

SimpleAct UG (haftungsbeschränkt)
Tannenstraße 2a, 45661 Recklinghausen, Deutschland
Email: …

2. Data categories and purposes

• Account data (name, email, role) to provide access and user administration.
• Organization and compliance data for contract performance and platform operation.
• Security and system logs (IP, request metadata) for security and troubleshooting.
• Billing and subscription metadata for invoicing and payment processing.

Legal bases: Art. 6(1)(b) GDPR (contract), Art. 6(1)(f) GDPR (security and legitimate interests), and where applicable Art. 6(1)(a) GDPR (consent).

3. Processors / sub-processors

• Hetzner Online GmbH (hosting, including self-managed PostgreSQL)
• Stripe (payment processing)
• Brevo (transactional email)
• Anthropic Ireland, Limited, Dublin, Ireland (Claude API) – only if an organisation has switched on the AI assistant: analysis of the texts submitted for it (e.g. uploaded documents, incident and risk descriptions) to produce suggestions

A data processing agreement (DPA) under Art. 28 GDPR is in place where required.

4. International data transfers

Where services from providers in third countries are used, transfers are based on applicable safeguards, in particular Standard Contractual Clauses (SCCs) and/or adequacy decisions.

When the AI assistant is used, the texts submitted for it are transferred to Anthropic Ireland, Limited (Dublin, Ireland) and also processed by Anthropic in the USA. Transfers to third countries are based on the EU Standard Contractual Clauses (Module 3). SimpleAct creates no additional copies of these texts for the AI assistant. Anthropic deletes API inputs and outputs within 30 days, except in case of violations of Anthropic's usage policies or where a legal retention obligation applies.

If you have consented to the "Marketing" category, Google may transfer data to Google LLC in the USA as part of Google Ads conversion measurement. Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023, Art. 45 GDPR); Google additionally uses Standard Contractual Clauses.

5. Retention

• Contract-related data: for contract term and statutory retention periods.
• System/security logs: typically 30 to 90 days unless longer retention is required.
• Backups: typically 30 days, then automatic deletion.

6. Data subject rights

You have rights under Art. 15-22 GDPR (access, rectification, erasure, restriction, portability, objection) and the right to lodge a complaint with a supervisory authority.

7. Cookies and local storage

On this website (simpleact.de / simpleact.eu) we use first-party cookies and local storage (local/session storage). Ad-network cookies (Google Ads) are only set if you consent to the "Marketing" category. We do not use social media plugins.

• Necessary cookies/storage (technically required, Sec. 25(2) No. 2 TDDDG, Art. 6(1)(f) GDPR): language setting ("NEXT_LOCALE", cookie and local storage, 12 months), your cookie choice ("sa_cookie_consent", local storage, 12 months), dismissing the contact bar ("sales_bar_dismissed", cookie, 12 months) and – only if submitting a rating after onboarding fails – a copy of that rating ("simpleact_onboarding_feedback_pending", local storage).
• Analytics storage (only with consent, Sec. 25(1) TDDDG, Art. 6(1)(a) GDPR): first-party traffic measurement via our own server – pages visited, approximate origin from IP-based country lookup and acquisition channel (referring page, UTM parameters). For this we store a random visitor ID ("sa_landing_visitor_id", local storage) plus a session ID and the acquisition details ("sa_landing_session_id", "sa_landing_attribution", session storage, cleared when the tab is closed). If you withdraw consent, we delete these entries from your browser. Data is never shared with third parties or ad networks.
• Marketing (only with consent, Sec. 25(1) TDDDG, Art. 6(1)(a) GDPR): Google Ads conversion measurement by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. For this processing Google is not a processor but an independent controller and also uses the data for its own purposes; the Google Ads Controller-Controller Data Protection Terms apply. After you consent, your browser loads the Google tag (gtag.js). If you arrive via one of our Google ads, Google stores cookies (e.g. "_gcl_aw", "_gcl_au", up to 90 days) and a local storage entry ("_gcl_ls", up to 90 days) so it can tell whether the visit leads to a trial sign-up. Google processes, among other things, your IP address, browser data, the visited URL and a click ID; data may be transferred to Google LLC in the USA (see section 4). Personalised advertising and remarketing are disabled. If you withdraw consent, we delete these cookies and entries from your browser. We only receive aggregated statistics. More information: https://policies.google.com/privacy

You can withdraw or change your consent at any time via the "Cookie settings" link in the footer or the cookie icon at the bottom left. Your stored choice is valid for 12 months, after which you will be asked again.