Privacy Policy

1. Controller

The controller responsible for data processing on this website and on the PSA Verify platform within the meaning of the EU General Data Protection Regulation (GDPR) is:

scMED UG (haftungsbeschränkt) Klingholzstraße 7 65189 Wiesbaden, Germany Represented by the Managing Director: Sven Christian Phone: +49 (0) 611 95012846 E-mail: info@scmed.de

2. General Information

We process personal data only to the extent necessary to provide a functional website and to deliver our content and services. The legal bases are set out in Art. 6 (1) GDPR, in particular point (a) (consent), point (b) (performance of a contract and pre-contractual measures) and point (f) (legitimate interests). Our servers are located in Germany; all processing is carried out in accordance with the GDPR. This privacy policy applies only to our own processing; for external websites to which we link, only the privacy notices of the respective providers apply.

3. Hosting and Server Log Files

This website and the platform are hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany; the servers are located in a data center in Germany. Uploaded files (for example inspection photos and attachments) are stored in the object storage of IONOS SE in Berlin. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider.

To protect against data loss, we back up the database and the uploaded files every day. The backups are encrypted on our own server before they are stored in a separate, write-protected object storage of IONOS SE in Berlin; IONOS only ever receives encrypted data, and the key stays with us. Backups are deleted after 30 days.

Each time the website is accessed, our system automatically collects the following data: the IP address of the requesting device, date and time of access, the page/file accessed, the volume of data transferred, a success message, browser type and version, operating system, and the referring page (referrer).

This data is used to deliver the website, to ensure system security and stability, and for error analysis (legal basis: Art. 6 (1) (f) GDPR). It is not combined with other data. Log files are deleted or anonymized after 28 days.

4. Demo Request / Contact Form

If you request a demo or contact us via the form, we process the data you provide (name, phone number, business e-mail address, organization, message) in order to handle your request, arrange appointments, and deal with related follow-up questions. In addition, when you submit the form, we store the IP address and browser identifier (user agent) of your device in order to detect misuse – such as automated spam submissions – and to ensure the security of our systems. To protect the form against spam, we also use Google reCAPTCHA (Section 6). You will receive our reply to your request by e-mail.

The legal bases are Art. 6 (1) (b) GDPR (pre-contractual measures) and Art. 6 (1) (f) GDPR (our legitimate interest in responding to inquiries and preventing misuse). Contact requests, including the IP address and browser identifier collected in the process, are deleted no later than six months after the request has been dealt with, unless statutory retention obligations apply; if a contract is concluded, the retention periods set out therein apply.

5. Newsletter

You can subscribe to our newsletter on our website. It informs you about new features of PSA Verify and gives practical tips on managing and inspecting radiation protection PPE. To subscribe, we only need your e-mail address; we also store the language you chose and the page on which you signed up.

We use the double opt-in procedure: after signing up, you receive an e-mail with a confirmation link that is valid for seven days. Only once you open this link do we add your address to the mailing list. To be able to prove the subscription, we store the times of sign-up and confirmation as well as the IP address used in each case.

The legal basis for the newsletter is your consent (Art. 6 (1) (a) GDPR); logging the subscription is based on our legitimate interest in being able to prove consent (Art. 6 (1) (f) in conjunction with Art. 7 (1) GDPR). You can withdraw your consent at any time with effect for the future, via the unsubscribe link in every newsletter or by e-mail to info@scmed.de.

Unconfirmed sign-ups are deleted automatically after 30 days. After you unsubscribe, we keep your e-mail address together with the times of sign-up, confirmation and unsubscription for three more years in order to be able to prove the former consent (Art. 6 (1) (f) GDPR); it is then deleted automatically. We send the confirmation e-mail via Resend (Sections 10 and 11).

Sending via Brevo: We send the newsletter itself via the Brevo service of Brevo GmbH (formerly Sendinblue GmbH), Köpenicker Straße 126, 10179 Berlin, Germany, which acts as our processor (Art. 28 GDPR). After you confirm, we transfer your e-mail address and the language you chose to Brevo; Brevo processes this data in data centres within the European Union. When you unsubscribe, we remove your address from our mailing lists at Brevo; Brevo may keep it on a block list so that you do not receive any further newsletters. We delete the contact itself at Brevo at the latest after the three years stated above.

Measuring success: Our newsletters contain a so-called tracking pixel, and the links in them are redirected via Brevo. This tells us whether and when a newsletter was opened and which links were clicked; Brevo also processes technical information such as the IP address, the time and the type of device and e-mail program. We use this evaluation to improve our newsletter and only look at the results in aggregated form in PSA Verify. The legal basis is the consent you give when subscribing (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG). Unsubscribing also withdraws this consent.

6. Spam Protection with Google reCAPTCHA

To protect our forms (demo request/contact and newsletter sign-up) against automated submissions, we use the reCAPTCHA service (version 2, "I'm not a robot"). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

reCAPTCHA is only loaded when you click "Load security check" in the form; merely visiting our website or filling in a form does not establish any connection to Google. After the click, reCAPTCHA checks whether the input comes from a person or from an automated program, possibly with a short task. For this purpose, in particular your IP address, information about your browser, operating system and device, language settings, the page you are on and your interactions with the check are transmitted to Google; reCAPTCHA may use cookies or similar technologies in the process. We only receive the result of the check from Google; without a passed check, we do not accept the submission.

The legal basis is your consent, which you give by clicking "Load security check" (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG); our interest is protecting our forms against misuse and spam. You can withdraw your consent at any time with effect for the future by reloading the page and not starting the check again. Without the security check, you can reach us at any time by e-mail at info@scmed.de. Google may transfer data to Google LLC in the USA (Section 11). Further information can be found in Google's privacy policy at policies.google.com/privacy and in its terms of service at policies.google.com/terms.

7. User Accounts, Contract Data and Use of the Platform

Customers receive user accounts for the use of the PSA Verify platform. In this context, we process master and access data of the designated users (name, business e-mail address, organization, role, login timestamps) for the performance of the contract and to ensure the security of the system (Art. 6 (1) (b) and (f) GDPR).

Important: Data that our customers enter within the platform (in particular PPE inventories, inspection data, inspection photos and reports, data exports, and the optional assignment of equipment to employees) is processed by us exclusively on behalf of the respective customer as a processor pursuant to Art. 28 GDPR. The controller for this content is the respective customer (e.g., the hospital or institution). Processing is based on the data processing agreement concluded with the customer; data subjects should contact their employer or the responsible institution to exercise their rights in this respect. We support our customers in doing so to the extent agreed in the contract.

In the course of support measures, it may be necessary to access the customer's data records; such access is limited to the respective support measure and is logged. In addition, for the initiation, performance and billing of the contract, we process contract and billing data (e.g., billing address, contract and payment data) on the basis of Art. 6 (1) (b) GDPR; the retention periods under commercial and tax law apply to this data (Section 12).

Support requests: If you submit a support request within the platform (via "Help & Support" or the help chat), we process your name, e-mail address, organization, the content of the request including attached files, and technical information for troubleshooting (the page you were on, the app version). We inform you about replies and status changes by e-mail. Where necessary to resolve the request, we pass it on to our technical service provider Pelephant GmbH (Section 10). The legal basis is Art. 6 (1) (b) GDPR or our legitimate interest in providing working support (Art. 6 (1) (f) GDPR).

8. E-mail Communication

When you contact us by e-mail, we process the data transmitted in order to handle your request (Art. 6 (1) (b) or (f) GDPR). We use the service Resend to send system and notification e-mails (e.g., confirmations, access credentials, inspection reminders, replies to support and contact requests) – see Sections 10 and 11. Please do not send us sensitive data by unencrypted e-mail.

9. Cookies and Local Storage Technologies

We use only technically necessary cookies and storage technologies as well as those that save settings you have chosen yourself. We do not use any analytics, tracking, or marketing technologies. Content, scripts and fonts are served from our own servers; the only exception is Google reCAPTCHA, which is loaded only after you click "Load security check" in a form and may use its own cookies or similar technologies in the process (Section 6). Consent is not required for these storage technologies (Section 25 (2) No. 2 of the German TDDDG); for reCAPTCHA we ask for it directly in the form. We do not use a consent banner.

Cookies in use:

Other local storage technologies: For offline functionality, the platform stores application data in your browser's local database (IndexedDB) and uses service worker caches so that inspections can be carried out without an internet connection and synchronized later; this data remains on your device until you sign out or manually reset the application. In addition, we use local storage for display settings (e.g., page size and sort order of lists) and technical operating flags (e.g., version detection), and session storage for form drafts until the browser tab is closed.

The legal bases are Section 25 (2) TDDDG and Art. 6 (1) (b) and (f) GDPR; the storage is necessary to provide the service you have explicitly requested (in particular the offline functionality) or serves to save settings you have chosen yourself.

10. Recipients of Data

Within our company, only those units that need your data to fulfil their tasks are given access to it. In addition, we use service providers bound by our instructions as processors, in particular:

• IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany (server operation, file storage and encrypted backups, Section 3)
• Pelephant GmbH, Josefstrasse 224, 8005 Zurich, Switzerland (software development, maintenance, and technical support)
• Plus Five Five, Inc. ("Resend"), San Francisco, USA (sending of system and transactional e-mails)
• Brevo GmbH ("Brevo"), Köpenicker Straße 126, 10179 Berlin, Germany (sending of the newsletter and measuring its success, Section 5)

Data processing agreements pursuant to Art. 28 GDPR are in place with all processors. After you click "Load security check", Google also receives data for spam protection (Section 6). Data is transferred to other third parties only where this is permitted or required by law.

11. Data Transfers to Third Countries

Processing generally takes place in Germany. Insofar as access from Switzerland occurs in the course of maintenance and support, this is permissible under data protection law, as the European Commission has issued an adequacy decision for Switzerland pursuant to Art. 45 GDPR.

For the sending of system and transactional e-mails, data (e-mail address, message content, metadata) is transferred to Plus Five Five, Inc. ("Resend") in the USA. Resend is certified under the EU-U.S. Data Privacy Framework (DPF); for companies certified in this way, an adequacy decision of the European Commission pursuant to Art. 45 GDPR applies. In addition, the data processing agreement concluded with Resend incorporates the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR).

In connection with Google reCAPTCHA (Section 6), data may be transferred to Google LLC in the USA. Google LLC is also certified under the EU-U.S. Data Privacy Framework, so the adequacy decision of the European Commission applies here as well (Art. 45 GDPR). No transfers to other third countries take place.

12. Retention Periods

We store personal data only for as long as is necessary for the purposes stated above or as required by statutory retention obligations (in particular under commercial and tax law, generally 6 or 10 years). Thereafter, the data is deleted or anonymized.

13. Your Rights

With regard to the personal data concerning you, you have the following rights vis-à-vis us:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to withdraw consent with effect for the future (Art. 7 (3) GDPR)

Right to object (Art. 21 GDPR): Insofar as we process data on the basis of Art. 6 (1) (f) GDPR, you have the right to object to the processing at any time on grounds relating to your particular situation. Where personal data is processed for direct marketing purposes, you may object to processing for this purpose at any time; we will then no longer process the data for direct marketing.

To exercise your rights, an informal message to info@scmed.de is sufficient. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The supervisory authority responsible for us is: The Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.

14. Data Security

Data transmitted via this website is encrypted using TLS/SSL. Passwords are stored exclusively as cryptographically secured hashes; login sessions expire automatically after 24 hours, and write operations on the platform are logged for traceability. We implement technical and organizational measures appropriate to the risk in order to protect your data against loss, misuse, and unauthorized access, and we continuously adapt these measures to the state of the art.

15. No Automated Decision-Making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

16. Changes to this Privacy Policy

We will update this privacy policy whenever the legal situation, the website, or our data processing changes. The version published here at any given time applies.