Privacy policy

This notice distinguishes the public website and platform accounts from data organizations process in their workspaces.

For the public website, registration, sign-in, platform profiles, account security and support, the operator determines the purposes and means of processing.

Show Live Concept GmbH is intended to be the first business user. The operator also works for Show Live Concept GmbH. A restricted test phase with real business data is planned but has not started. Data protection responsibilities for workspace data and any required arrangements must be determined before such data is imported. This notice does not represent a GDPR Article 28 data processing agreement as already concluded.

Workspace data is distinct from public website and platform account data. People with questions about workspace data may first contact their organization. The operator can also be reached at the address below.

Depending on use, the application may process:

• Account and profile data: email address, name, profile image, authentication identifier and account preferences.
• Access and organization data: workspace memberships, roles, active status, access requests and related organization.
• Business data entered by users: CRM organizations and contacts, contact and address details, activities, projects, tasks and assignments.
• Tourmanagement data: tours, events, participants, bookings, venues, ticketing and hotel details, and contract or operational documents that identify people.
• Files and content uploaded in designated areas, such as profile images, CRM files or operational documents.
• Technical data: IP address and connection metadata, browser and device information, requested pages, timestamps, and error or diagnostic information generated during operation.
• Support and error report data: reporting account name and email, organization/workspace, title, description, page, reference identifier, time, browser identifier and submitted error details.

Processing supports account provision and administration, sign-in and account security, organization membership, enabled modules, storage of user-entered content, troubleshooting, and communications about accounts and operation.

Depending on the specific operation, potential legal bases include GDPR Article 6(1)(b) (steps before entering into or performance of a service relationship, where one exists), Article 6(1)(f) (legitimate interests in secure, functional operation and support), and Article 6(1)(c) (compliance with an applicable legal obligation). The applicable basis for each operation must be confirmed against the actual operating and contractual arrangements.

Data protection roles for workspace content have not yet been determined. They must be settled before the planned test phase with real data begins; this notice does not present unresolved roles as a permanent basis for processing.

AufwindPRO uses Supabase Auth for email address and password sign-in, registration and confirmation, recovery, and session management. Account, identification and sign-in data are processed for these purposes.

Google sign-in is optional; email address and password sign-in remain available. Supabase Auth mediates sign-in through Google. AufwindPRO receives the account and authentication information Google makes available for sign-in, such as an email address, name or provider identifier, where provided. Google processes information for its own sign-in service and purposes under its own privacy information and acts independently for those purposes. The information Google processes and provides depends on its service and applicable settings.

Memberships link an account to an organization and include details such as role and active status. Registration alone does not automatically grant workspace access; access requests and approvals may be stored.

Depending on the modules enabled for an organization, workspace members may process data in CRM, Projects, Tasks and Tourmanagement. This can include information about businesses and people, relationships and activities, project and task content, assignments, and tour, event, booking, ticketing, hotel and document information.

This content may include personal data about employees, business contacts, artists, service providers and other contacts. Show Live Concept GmbH is intended to be the first business user; no real employee, CRM or business data has been imported so far. A restricted test phase with such data is planned. AufwindPRO does not use workspace content for its own advertising. Data protection responsibilities and any required arrangements must be settled before the planned import.

During restricted development, do not enter special categories of personal data under GDPR Article 9 or other particularly confidential data.

The application uses technically necessary cookies for authentication and sessions. Preferences such as language and appearance (light/dark/system) may be stored in cookies or local browser storage. Other local preferences can include density, start page or list sorting.

These storage mechanisms support sign-in, page display and usability. The current implementation does not include analytics or advertising cookies. Browsers can delete or restrict cookies and local storage in their settings; sign-in or saved preferences may then stop working.

Personal data may be sent to technical providers where needed for provision, sign-in, storage, delivery or operation:

• Hetzner: hosts the application server in Germany and processes server access logs and related operating data.
• Supabase: authentication, database and file storage; account, workspace and application data are processed there. The configured production region is Frankfurt, Germany.
• Google: optional sign-in provider when a user chooses Google sign-in. Google processes authentication and account information for its own service and under its own privacy information.
• Resend: sends authentication emails and operates the info@aufwindpro.com inbox. Data may include email addresses, metadata, message contents and attachments.
• IONOS: domain registration and DNS management. Its DNS API is used for automatic SSL certificate renewal. IONOS does not host the application or email inboxes.

For troubleshooting and operation, the application creates technical diagnostic events with bounded context, such as operation, area, route, organization, error class and time. The application logger filters unreviewed secrets and unapproved context fields. Hosting, network or provider logs may also be generated under the relevant system settings.

Users can submit error reports. These may contain account and contact details, workspace association, description, affected page, browser identifier and optional diagnostic details. Reports are intended for platform administrators to review. Do not include passwords, access tokens or unnecessary sensitive data in reports.

The application server is hosted by Hetzner in Germany. The configured Supabase production region is Frankfurt, Germany.

Google is an optional sign-in provider. Resend sends authentication emails and operates the contact inbox. IONOS manages the domain and DNS. No other processing or access countries, or specific transfer mechanisms, are stated here for these services.

The stated server and database locations do not establish whether provider personnel or subprocessors access or process data from other countries. This notice does not claim that an adequacy decision, Standard Contractual Clauses or another transfer safeguard applies to these services.

Data is deleted when it is no longer needed for its purpose and no statutory obligation requires retention. Specific periods may vary for account, workspace, file, communication and log data and by provider.

A daily cleanup job is configured for 03:00 UTC. It schedules deletion of error reports older than 90 days.

For information about workspace content and its deletion, people concerned may contact the relevant organization. Statutory retention duties or necessary evidence may limit deletion.

Subject to applicable law, you may request access to your personal data, rectification, erasure, restriction of processing and data portability. You may object, on grounds relating to your particular situation, to processing based on GDPR Article 6(1)(f).

Where processing is based on consent, you may withdraw it at any time with effect for the future. Withdrawal does not affect the lawfulness of processing before withdrawal. To exercise your rights, contact the privacy address above. Additional information may be needed to verify your identity.

You may lodge a complaint with a data protection supervisory authority, in particular in your habitual residence, place of work or the place of the alleged infringement. The authority responsible for the operator in Schleswig-Holstein is the Independent State Centre for Data Protection Schleswig-Holstein (ULD).