Privacy policy for the Putsch Customer Portal
This policy informs you, in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR), which personal data we process in the customer portal, for which purposes, and which rights you have.
1. Controller
Putsch GmbH & Co. KG
[[Street and number]]
[[Postcode, city]]
Email: [[Email address]]
Phone: [[Phone number]]
2. Data protection officer
[[Name or company and contact of the data protection officer, e.g. datenschutz@putsch.com – or note that none needs to be appointed]]
3. Operation of the portal
The portal and the sign-in service run on servers operated by Putsch GmbH & Co. KG in Germany [[please confirm location/data centre]]. Backups are also stored on our own systems. All connections are encrypted with TLS (HTTPS).
4. Accessing the portal and server logs
With every request our web server processes technically necessary data: IP address, date and time, requested address (access keys of public links are masked), status code, amount of data transferred, referring page and browser identification.
- Purpose: providing and securing the portal, detecting and preventing attacks and misuse
- Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation)
- Retention: [[14 days – please confirm with IT]], then deleted
To prevent guessing of links, we count failed requests for public manuals per IP address for at most ten minutes in memory; this data is not stored permanently.
5. User account in the customer portal
Customer accounts are created by invitation only, usually at the request of your employer as our customer. We process:
- name and email address
- assignment to your company (customer) and account status
- invitation status and time of the last sign-in
- for Putsch employees additionally the internal roles
- Purpose: access to your company's machines, documents and spare parts catalogs, administration of access
- Legal basis: Art. 6(1)(b) GDPR where you are a contracting party yourself; otherwise Art. 6(1)(f) GDPR (legitimate interest of Putsch and your company in providing the documentation within the business relationship); for Putsch employees Section 26 BDSG / Art. 88 GDPR [[please verify]]
- Retention: as long as the account exists. When an account is closed, we remove name and email address and delete the sign-in account; an anonymous record remains so that earlier changes stay traceable.
6. Sign-in, password and two-factor authentication
For sign-in we use the self-hosted sign-in service “authentik” (open-source software running on our servers). It processes your user name or email address, a password hash (never the plain password), the key of your second factor (authenticator app) and sign-in events. Two-factor authentication is mandatory.
- Purpose: secure sign-in and protection of your account
- Legal basis: Art. 6(1)(b) and (f) GDPR and Art. 32 GDPR (security of processing)
7. Emails
We send you emails for the invitation and account setup and for resetting your password. These messages are required to use the portal; we do not send advertising via the portal. Emails are sent via [[email service, e.g. Microsoft 365 of Putsch GmbH & Co. KG – add provider, server location and data processing agreement]].
8. Cookies
We only use technically necessary cookies:
- session cookie of the portal (keeps you signed in; valid until you sign out or the session expires)
- cookies of the sign-in service (sign-in process and session)
These cookies are only set when you sign in. Visitors of public pages or a public operating manual receive no cookies from the portal. These cookies are strictly necessary for the service you requested (Section 25(2) no. 2 TDDDG); no consent is required. We do not use analytics, tracking or advertising cookies. Fonts and program libraries are loaded from our own servers, not from third parties.
9. Spare parts catalog (Neospace)
For individual machines we embed an interactive spare parts catalog from the provider Neospace ([[company, address of the provider]]). The catalog is only loaded when you open the “Spare parts catalog” tab. Your browser then connects to Neospace servers (embed.neospace.io) and transmits technically necessary data such as your IP address and browser information. Neospace's privacy policy applies to its processing [[add link]].
- Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing the spare parts catalog) [[verify relationship with Neospace – processor or independent controller – and any transfer to third countries]]
10. Public operating manuals
Operating manuals that can be opened via a link or QR code without signing in do not process any account data. Only the server logs described in section 4 apply.
11. Administration log
Changes made in the portal administration (e.g. creating or blocking accounts, releasing documents) are logged with time and acting person.
- Purpose: traceability and security
- Legal basis: Art. 6(1)(f) GDPR
- Retention: [[define period]]
12. Recipients
Your data is processed only by the responsible employees of Putsch GmbH & Co. KG. Customer users cannot see data of other customers. Further recipients: [[email service as per section 7]], Neospace as per section 9 and, where applicable, IT service providers acting as processors [[add]]. Data is [[not transferred to countries outside the EU/EEA – please verify]].
13. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on legitimate interests (Art. 21). Please use the contact details above.
You may also lodge a complaint with a data protection supervisory authority, for example the authority responsible for us: [[State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany – please verify competence]].
14. Obligation to provide data, automated decisions
Without name and email address no access can be set up. No automated decision-making, including profiling, takes place.
15. Changes
We update this policy when the portal or the legal situation changes. The version published here applies.