Privacy Policy

1. Controller

The controller responsible for data processing on this website pursuant to the General Data Protection Regulation (GDPR) is:

Fintom8 GmbH
Christinastraße 17, 50733 Köln, Germany
Commercial Register: Amtsgericht Köln, HRB 122538
Managing Director: Igor Nikolaienko
Email: contact@fintom8.com

2. Overview & Web Hosting

This website provides information on Fintom8 solutions and offers interactive demo utilities. We do not use marketing trackers, profiling tools, or third-party web analytics.

Server Log Files

When you visit our website, the web server automatically registers technical connection data in log files. This data includes:

• IP address of the requesting device
• Date and time of access
• Requested resource / URL
• HTTP status code and volume of data transferred
• Browser type, version, and operating system
• Referrer URL (previously visited page)

• Purpose and legal basis: The processing of this data is technically necessary to display the website, maintain infrastructure stability, resolve faults, and prevent malicious abuse. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in operating a secure and functional website).
• Retention period: Server log files are stored for IT security diagnostics and are automatically deleted after 14 days at the latest, unless longer retention is required to investigate a specific security incident.

3. Demo Tools and Uploaded Documents

When using our web-based demo tools (such as the invoice validator and the PDF-to-ZUGFeRD converter):

• Uploaded files (PDF, XML, JSON, CSV, or images) are transmitted over an encrypted TLS/HTTPS connection to our processing backend solely to execute the requested validation or conversion.
• Transient Memory Processing: Files and generated conversion outputs are processed exclusively in volatile memory (RAM) and are not written to persistent storage. All processed documents are automatically and irrevocably deleted immediately upon completion of the task or session termination.
• No AI Model Training: We do not use customer invoice contents or uploaded documents for machine learning, artificial intelligence model training, or data-mining purposes.
• Legal basis: Art. 6(1)(b) GDPR (performance of the requested demo functionality) and Art. 6(1)(f) GDPR (legitimate interest in showcasing product capabilities).

4. Contact and Support Inquiries

When you submit an inquiry through our contact or support forms or via email, we process the information provided:

• Full name
• Business email address
• Company name
• Content and subject of your message

• Purpose and legal basis: We process your data exclusively to handle, evaluate, and respond to your communication. The legal basis is Art. 6(1)(b) GDPR (steps prior to or in fulfillment of a contract) or Art. 6(1)(f) GDPR (legitimate interest in responding to commercial inquiries).
• Recipients and third-country transfer: Form submissions are routed via our secure server to Google Workspace / Google Chat to notify authorized Fintom8 team members. Google Ireland Limited acts as our data processor under an executed Data Processing Agreement (DPA). Insofar as data may be transferred to Google LLC in the United States, the transfer is safeguarded under the EU-US Data Privacy Framework (DPF) and Standard Contractual Clauses (SCCs). Inquiry data is retained only for the duration required to process your request, subject to statutory retention duties.

5. Embedded Videos (YouTube)

Some pages include demonstration videos hosted by YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland).

To protect your privacy, we utilize a two-click privacy mode:

• No connection is established with YouTube servers, and no YouTube cookies are set when you merely open the page.
• External connections and data processing are triggered only if you actively click "Play the video".
• Once initiated, YouTube may process your IP address, device information, and set tracking cookies. We embed videos using YouTube's privacy-enhanced mode (youtube-nocookie.com).
• Legal basis: Your voluntary consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. Transfers to Google LLC in the US are covered under the EU-US Data Privacy Framework.

6. Cookies and Local Storage

Our website does not use tracking, advertising, or profiling cookies. We only rely on technically necessary session markers or local browser storage where strictly required to execute core website features or active demo sessions. Third-party cookies may only be placed by YouTube if you voluntarily click to watch an embedded video (see Section 5).

7. Your Rights Under GDPR

As an affected data subject, you hold the following rights under statutory conditions:

• Right of Access (Art. 15 GDPR): The right to obtain confirmation and information regarding personal data processed about you.
• Right to Rectification (Art. 16 GDPR): The right to request the prompt correction of inaccurate personal data.
• Right to Erasure (Art. 17 GDPR): The right to request the deletion of your personal data where grounds apply.
• Right to Restriction of Processing (Art. 18 GDPR): The right to restrict data processing under specific conditions.
• Right to Data Portability (Art. 20 GDPR): The right to receive provided data in a structured, machine-readable format.
• Right to Withdraw Consent (Art. 7(3) GDPR): The right to revoke any given consent at any time with future effect.

To exercise any of these rights, please email: contact@fintom8.com.

8. Updates to This Policy

We may revise this Privacy Policy periodically to maintain compliance with updated statutory provisions or technical modifications to our infrastructure. The current version will always remain published on this page.