Privacy policy

1. Controller

The controller is Florian Stemmer, ProAuditMap, Huttengrundstraße 22, 36396 Steinau an der Straße, Germany, e-mail: kontakt@proauditmap.com.

We have not appointed a data protection officer because the requirements of Article 37 GDPR and Section 38 of the German Federal Data Protection Act are not met. Please send privacy questions to the e-mail address above.

2. Our role for content in the application

We are the provider of ProAuditMap. The provider is the controller for registration data, contact data for contract and billing, and the first administrator account. The customer organisation is the controller for all further user accounts in its account and for all content; the provider processes these on its behalf. Content includes audit packages with organisational planning, communication drafts, working papers, uploaded evidence, populations and samples, findings and measures, document requests, statements, reports, tasks and reminders, the inventory of audit objects with risk ratings, annual plans with board resolutions, key figures and board reports, and the change log. This also applies to members of executive management or a supervisory body to whom a customer organisation sets up read-only access to key figures and the annual plan. This also applies to persons whom a customer organisation invites to the portal as an audited unit; there is a separate privacy notice for them, which the portal displays on first access and which can be called up there at any time via the link “Privacy notice”. We process the customer organisation’s user accounts and content as a processor under Article 28 GDPR; the basis is our data processing agreement (DPA). Data subjects should first contact the organisation that uses the account with requests about these data.

We also process as controller the data of the website, the enquiry form and our e-mail communication. Sections 3 to 7 and 9 describe this processing.

3. Visiting the website

When you open the website, our web server processes technically necessary information: IP address, time, requested address, status code, amount of data transferred, the previously visited page and the browser identifier, where your browser sends it. We use this information to deliver the website, fix faults and fend off attacks. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is secure and stable operation. You are under no statutory or contractual obligation to provide this information; without it, however, the website cannot be delivered.

Web server logs contain your IP address only in shortened form (for IPv4 without the last byte) and are deleted after 14 days at the latest, unless a specific security incident requires longer retention for investigation. Our server does not log requests to the unsubscribe link; logs of the application contain at most the first eight characters of unsubscribe and confirmation values.

The website sets no cookies and does not store or read information on your device beyond what is technically necessary for the page you request (Section 25(2) no. 2 TDDDG). We embed no content or fonts from other providers and serve all fonts from our own server. proauditmap.de and www.proauditmap.com redirect to proauditmap.com.

Audience measurement: to see which pages are read and how visitors find us, we count page views with the software Umami, which we run ourselves on our server in Germany; no data goes to third parties. A script on our website sends, for each page view, the address of the page and of the previously visited page, each without parameters, and the page title, and on a click on a link into the application or on a download also its path, after the contact form is sent the selected reason, never the content, and when the sample size calculator or audit plan generator is used only the part used, never inputs or results. The script sets no cookies, stores nothing on your device and reads no information there beyond what your browser sends anyway when requesting the page. From your IP address the server determines country, region and city and, together with the browser identifier, forms a hash value that groups page views of the same browser only within the same day; the IP address itself is not stored. Browser, operating system and device type are derived from the browser identifier. If “Do Not Track” or “Global Privacy Control” is switched on in your browser, no measurement takes place. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is improving the website. You may object to this processing at any time (Article 21 GDPR). We delete measurement data after 13 months.

4. Enquiry form and e-mail

Through the enquiry form you send your name, e-mail address and company, optionally the number of auditors and your message. We forward the information as an e-mail to our mailbox and do not store it in a database. Until it is sent it sits in our server outbox; sent entries are deleted there after 30 days. If you e-mail us directly, we process your message in the same way.

The purpose is to answer your enquiry and, where applicable, to prepare a contract. The legal basis is Article 6(1)(b) GDPR, otherwise Article 6(1)(f) GDPR (interest in answering business enquiries). To prevent abuse, the server counts enquiries per IP address in memory for one hour and then discards the counter (Article 6(1)(f) GDPR). Your information is voluntary and not required by law or contract; without name, e-mail address and company, however, we cannot handle your enquiry.

We delete enquiries once they are dealt with, unless a statutory retention duty applies. Business letters that lead to a contract are kept for six years under Section 147 of the German Fiscal Code and, where applicable, Section 257 of the German Commercial Code.

5. Registration, access and user accounts

For registration you provide company, first name, last name, business e-mail address and a short name for your account. We send a confirmation link and check whether an account has already been created for the domain of your e-mail address. Unconfirmed registrations are deleted seven days after the link expires, processed registrations 30 days after processing. We keep the domain until the account is deleted so that each organisation can only have one account; we delete it together with the account.

Sign-in runs through an authentication service we operate ourselves (Keycloak) at auth.proauditmap.com. It stores name, e-mail address, a hash of the password and the secret for the one-time code of your authenticator app. The service logs sign-in events (time, account, IP address) and deletes them after 365 days; they serve security and the investigation of abuse. The service sets cookies that are technically required for sign-in; the application keeps sign-in tokens in your browser session storage, which is cleared when the tab is closed. No consent is required for this (Section 25(2) no. 2 TDDDG).

The legal basis is Article 6(1)(b) GDPR, and Article 6(1)(f) GDPR for abuse checks, securing sign-in and sign-in events. Further user accounts are created by the customer organisation; section 2 applies to them. Without the mandatory information we cannot set up an account.

6. Contract, payment and invoices

For the contract we process company name, billing address, VAT number, name and e-mail address of contact persons, plan, term and payment status. Payments, subscriptions and invoices are handled by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. To pay, the application redirects you to a Stripe payment page; the application itself loads no Stripe scripts and sets no Stripe cookies. You enter payment details directly with Stripe; we do not receive full card or account numbers. Stripe’s own notices, including on cookies, apply to the payment page. Stripe processes some data as an independent controller, for example for fraud prevention and its own legal obligations, and according to Stripe also transfers data to Stripe, Inc. in the USA on the basis of the EU-US Data Privacy Framework and standard contractual clauses. See Stripe’s privacy policy at stripe.com/privacy.

The legal bases are Article 6(1)(b) GDPR (contract) and Article 6(1)(c) GDPR (tax and commercial law duties). The information is required to conclude and bill the contract; without it we cannot activate a plan. We keep invoices and accounting records for eight years and business letters for six years under Section 147 of the German Fiscal Code and, where applicable, Section 257 of the German Commercial Code, counted from the end of the calendar year.

For every booking and every plan change we store, as proof of your agreement to the terms and the data processing agreement (DPA): name, e-mail address and role of the person booking, the account and the company, the time, the version and the checksum (SHA-256) of the terms and the DPA, the wording of the agreement and the key data of the booking (plan, term, price, currency and the booking reference at Stripe). We do not store an IP address for this. The purpose is proof that the contract was concluded and that you agreed; we send you a confirmation of the booking by e-mail with links to the texts of the version you agreed to. The legal bases are Article 6(1)(b) GDPR (contract), Article 6(1)(c) GDPR (retention duties under Section 257 of the German Commercial Code and Section 147 of the German Fiscal Code, where the information forms part of accounting records or business letters) and Article 6(1)(f) GDPR (legitimate interest in proving that the contract was concluded and in defending against legal claims). We keep this information until the end of the calendar year in which the account is deleted and for six further years after that. Where retention goes beyond the statutory periods, we expressly base it on Article 6(1)(f) GDPR (defence against claims); beyond the deletion of the account it rests on Article 17(3)(b) and (e) GDPR.

7. Messages from the application

The application sends messages about registration, invitations, password, end of the period of use, payment, cancellation and upcoming deletion from noreply@proauditmap.com. On behalf of the customer organisations, the application also sends messages to invited audited units: the invitation, notices about newly assigned items, reminders of deadlines and the release of a final report. These messages contain only the name of the customer account, numbers and a link. For sending and for our mailbox kontakt@proauditmap.com we use the e-mail service of Hostinger International Ltd., 61 Lordou Vironos str., 6023 Larnaca, Cyprus. Entries in the application outbox are deleted no later than 30 days after sending; messages with an expired link are emptied earlier. The legal basis is Article 6(1)(b) GDPR.

Users of a customer account also receive, on behalf of the customer organisation, reminders of tasks with a due date, at most one digest e-mail a day per customer account, from 06:00; when e-mail volume is high it may be delayed. The e-mail states, per task, the type, audit number, for your own tasks the line or finding number, due date and a link, but no texts or names of other persons and no titles, unless the customer organisation has switched on the display of titles. Depending on the customer organisation’s setting, the application escalates overdue tasks to the audit lead or the head of audit. If a task is assigned to you or its due date changes, you usually receive a separate e-mail with the same details within 15 minutes (with the due date, if one is set; further assignments within one hour arrive bundled in one e-mail); when e-mail volume is high it may be delayed. It is not sent if you assign the task to yourself, have unsubscribed from the reminders or have never signed in; we delete notices not sent after 30 days. The sender is noreply@proauditmap.com with the display name “ProAuditMap · name of the customer account”. If the customer organisation has stored and confirmed a reply address, replies to these e-mails go directly to the customer organisation; otherwise replies are not read. The customer organisation is responsible for this processing; we act as processor (section 2).

You can unsubscribe from the daily digest e-mail in the application on the “My tasks” page or via the link in the e-mail; your customer organisation cannot prevent this. The unsubscription also applies to the e-mail sent for a new assignment and to e-mails already prepared but not yet sent. You will continue to receive notices of overdue tasks because they are part of organising the audit. For the unsubscription we store the time, the channel and the identifier of the key with which the link was signed, but not your e-mail address. We delete this record after 12 months. Opening the link alone changes nothing; only submitting the form or unsubscribing via your e-mail program takes effect. In addition, the fact that you unsubscribed or re-subscribed is recorded permanently, without your e-mail address, in the customer account’s change log, where only the head of audit can see it.

8. Generation of drafts in the application

ProAuditMap generates audit packages, partial edits and wording suggestions automatically using a language model from Anthropic. Our contracting party is Anthropic Ireland, Limited, Ireland; processing takes place at Anthropic, PBC in the USA. We transmit the inputs from the wizard, for partial edits the affected content of the audit package and, for the wording aid, the text of the field for which it is called up, for example the note or reason in a working paper, a field of a finding or a section of a report, solely to generate the suggestion. Uploaded evidence, populations, samples, statements and documents supplied by audited units are not transmitted. This processing is carried out on behalf of the customer organisation (section 2); Anthropic is our sub-processor. Audit planning, risk rating, key figures and board reports work without a language model; their content is not transmitted to Anthropic.

Please do not enter names of individuals in the wizard; names belong in the package later, in the editor. If a package, a working paper, a finding or a report already contains names or other personal data, they are sent to Anthropic when the relevant section is partially edited or the wording aid is used for the relevant field.

Our data processing agreement with Anthropic contains the European Commission’s standard contractual clauses (Modules 2 and 3) with addenda for Switzerland and the United Kingdom. According to Anthropic, the transfer from Anthropic Ireland, Limited to Anthropic, PBC in the USA is also safeguarded by standard contractual clauses (Article 46(2)(c) GDPR); Anthropic does not mention a certification under the EU-US Data Privacy Framework. Under its terms Anthropic does not use the data to train its models and, according to Anthropic, deletes inputs and outputs within 30 days. Anthropic keeps them longer only if an input is flagged for a possible breach of its usage policies (up to two years) or a legal obligation requires it.

We do not use content you process in ProAuditMap to train models. According to their contractual commitments, our sub-processors do not use it to train models either.

9. Hosting and backups

We run the website, application, database and authentication service on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in Falkenstein (Vogtland), Germany. The database is backed up daily in encrypted form. We additionally store the backups on a Storage Box of Hetzner Online GmbH in a data centre in Helsinki, Finland (EU). We keep the backup versions of the last 29 days there; daily snapshots of the Storage Box retain them for up to ten more days. We store files that customer organisations upload as evidence in the application on the server in Falkenstein and transfer them hourly, encrypted, to the same Storage Box. Before storage, a malware scanner on our server checks every file; no files are transmitted to third parties in the process. Deleted evidence files remain, encrypted, in the snapshots of the Storage Box for up to ten days as a rule. Deleted data are therefore also removed from the backups no later than 40 days after deletion.

The legal basis is Article 6(1)(b) GDPR where hosting and backup serve the performance of our contracts, otherwise Article 6(1)(f) GDPR; our legitimate interest is secure, stable and recoverable operation. We host and back up the customer organisations’ user accounts and content on their behalf (section 2).

10. Recipients at a glance

Only the following service providers receive personal data, each to the extent described:

• Hetzner Online GmbH (Germany): hosting in Germany and encrypted backups in Finland, processor
• Hostinger International Ltd. (Cyprus): e-mail sending and mailbox, processor
• Stripe Payments Europe, Limited (Ireland): payments, subscriptions and invoices, partly independent controller
• Anthropic Ireland, Limited (Ireland) with Anthropic, PBC (USA): generation of drafts, sub-processor on behalf of the customer organisation

Beyond this we only disclose data where we are legally obliged to, for example to tax authorities. We do not sell data and do not use it for third-party advertising.

11. Retention of customer data

If the period of use without a plan (7 days) expires without a plan having been booked, the account remains readable for 30 days and is then deleted with all content. After the end of a contract, the account remains read-only for 90 days and is then deleted unless an archive plan has been booked. If a payment remains outstanding after dunning, the account becomes read-only and is deleted no more than 90 days later unless the arrears are settled by then. During the read-only period, customer organisations that have paid at least once can export their data themselves.

Every customer organisation may, until deletion, also during the trial and without any prior payment, request a complete export of its data in text form. The provider delivers it free of charge within 30 days and postpones deletion until then. On the customer organisation’s instruction in text form, we also delete the data before these periods expire.

The audit planning of a customer organisation (inventory of audit objects, risk ratings, annual plans, board reports) belongs to no individual audit. It remains stored until the account is deleted and is not subject to the retention periods of audits. We delete rows that were read when a spreadsheet was imported 30 days after the decision on the import. On the customer organisation’s instruction, we replace individual texts of the planning that name a person with a deletion note.

During a contract, the retention periods set by the customer organisation apply (default 10 years). We keep a deletion log without the deleted content.

12. Your rights

You have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). An e-mail to kontakt@proauditmap.com is sufficient for your request.

You may lodge a complaint with a data protection supervisory authority (Article 77 GDPR). The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.

There is no automated decision-making, including profiling, under Article 22 GDPR. There is no processing based on consent.

14. Information for people in Switzerland

This policy also serves as information under Article 19 of the Swiss Federal Act on Data Protection (FADP). You can exercise your rights under the FADP via the address above; complaints go to the Federal Data Protection and Information Commissioner (FDPIC). Data are transferred to EU member states and to the USA; for the USA the safeguards named in sections 6 and 8, which Switzerland recognises, apply.

15. Changes

We update this policy when our processing or the law changes. The version published here applies.