ALUNATECAPEX
Sign Up

Privacy Policy

Our privacy policy and how we use your data

Privacy policy

*Working translation. The German version prevails.*

1. Controllers

Responsible for the ALUNATEC APEX platform (account, sign-in, calculations, credit account, operation):

ALUNATEC Ingenieurbüro
Owner: Andreas Miemczyk
Deipe Laake 34
33106 Paderborn, Germany
Email: admin@alunatec.de

Responsible for the sale of credits, payment and invoicing (own sales and billing data):

ANKORATEC GmbH
Deipe Laake 34
33106 Paderborn, Germany
Represented by: Maria Bisch
Email: info@ankoratec.de
Phone: +49 5254 9376426

Data exchange between ALUNATEC and ANKORATEC: When the payment form is opened, ALUNATEC transmits the account identifier, the email address or an existing Stripe customer identifier, and the price identifier and quantity of the selected package to ANKORATEC GmbH's Stripe account (purpose: preparation and allocation of the credit purchase; this happens as soon as the payment form is created, even if no payment follows). For enquiries about a purchase or invoice, only the account email address, the order identifier and the content of the enquiry are passed to ANKORATEC. In the other direction, Stripe transmits purchase and refund notifications for ANKORATEC (account allocation, package, Stripe identifiers, email, amount) to the platform so that credits can be added or deducted. Passwords and calculation inputs are not shared.

No data protection officer has been appointed at ALUNATEC or ANKORATEC GmbH. There is no obligation to appoint one: fewer than 20 persons are involved in processing personal data at each company (Section 38 BDSG), and the core activity consists neither of large-scale regular monitoring of persons nor of processing special categories of personal data (Art. 37(1) GDPR).

2. Scope

This policy applies to the ALUNATEC APEX platform at app-alunatec.de. The platform is aimed exclusively at businesses (B2B). ALUNATEC develops and operates the platform. Credits are purchased from ANKORATEC GmbH.

3. Data we process

  • Account data: email address, password (only as an encrypted hash), sign-in sessions, sign-in logs
  • Usage and billing data: balance (credits), credit entries and reversals, orders, Stripe customer number
  • Payment data: name, email, country, amount; card and bank details are processed exclusively by Stripe, not by us
  • Technical data when accessing the platform: IP address, time, requested address, server logs
  • Inputs in the calculation tools: technical parameters. Projects are not stored on our servers. They exist only temporarily in the open browser window and can be saved manually by the user as a JSON file and loaded again. There is currently no automatic project storage.

4. Purposes and legal bases

  • Provision of the platform, account, sign-in, calculations, billing of credits: performance of contract (Art. 6(1)(b) GDPR) where the user is the contracting party. Where the contracting party is the user's company, we base the processing of its employees' data on the legitimate interest of ALUNATEC and the company in providing the agreed use (Art. 6(1)(f) GDPR)
  • Payment processing and refunds via Stripe: purchase contract between the customer and ANKORATEC (Art. 6(1)(b) GDPR); for data of acting employees of a customer company, legitimate interest in performing the contract (Art. 6(1)(f) GDPR)
  • Retention of order and billing data: legal obligations (Art. 6(1)(c) GDPR)
  • Security, prevention of misuse and fraud, operational monitoring, server logs: legitimate interest (Art. 6(1)(f) GDPR)
  • System emails (confirmation of registration, password reset): as for the provision of the platform – performance of contract (Art. 6(1)(b) GDPR) or legitimate interest for employees of a customer company (Art. 6(1)(f) GDPR)

Balancing of interests (Art. 6(1)(f) GDPR): only business contact data, sign-in data, credit entries and technical logs are processed; calculation inputs are not stored permanently; there is no profiling, advertising or web analytics; logs are limited in size or time (section 8). Users use the platform on behalf of their company and can expect this processing; their interests do not prevail. You may object at any time on grounds relating to your particular situation (section 9). We do not send newsletters and do not use our own advertising, analytics or tracking tools. Separately, Stripe uses its own fraud-prevention technology in the payment form (sections 5 and 7); the payment form is only loaded after your consent in the purchase dialog.

5. Recipients and service providers

  • Microsoft Azure (hosting of the application): data centre West Europe (Netherlands)
  • Supabase (database and sign-in; contracting entity Supabase Pte. Ltd., Singapore): project region North EU (Stockholm, Sweden)
  • Microsoft Azure Communication Services (sending system emails): data location Germany
  • Stripe (payment processing and invoicing for ANKORATEC GmbH; contracting entities: Stripe Payments Europe, Limited, and for payment services Stripe Technology Europe, Limited, both Dublin, Ireland)
  • Microsoft Azure Application Insights (availability check): regularly calls public test addresses of the platform and stores the result. Test locations are North Europe and West Europe; results are stored in West Europe. Only availability check results are stored; no usage data of the platform is transmitted to this service.

Data protection agreements with Microsoft and Supabase are part of ALUNATEC's respective contract terms. Stripe acts in different roles depending on the purpose: as a processor on behalf of ANKORATEC GmbH for providing the Stripe services; as an independent controller for its own purposes – in particular fraud detection, prevention of financial loss and compliance with legal obligations (e.g. anti-money-laundering checks) – for which Stripe's privacy policy applies. The basis is Stripe's data processing agreement (as of 28 Sep 2026), which forms part of ANKORATEC GmbH's Stripe contract.

6. Transfers to third countries

Data is processed in data centres within the EU. Supabase's contracting entity is Supabase Pte. Ltd. in Singapore; Supabase and Stripe belong to corporate groups based in the USA. Access from countries outside the EU therefore cannot be excluded. The basis for such transfers is, per provider:

  • Microsoft: EU standard contractual clauses (2021, between Microsoft Ireland Operations Limited and Microsoft Corporation) under Microsoft's data protection addendum (version of 22 May 2026); Microsoft is also certified under the EU-U.S. Data Privacy Framework.
  • Supabase: EU standard contractual clauses (Module 2, controller to processor) under Supabase's data processing addendum (version 1 of 1 August 2026); the data importer is Supabase Pte. Ltd. in Singapore, for which no EU adequacy decision exists.
  • Stripe: transfers to Stripe, LLC (USA) primarily under the EU-U.S. Data Privacy Framework (EU Commission adequacy decision of 10 July 2023), and, should it cease to apply, EU standard contractual clauses under Stripe's Data Transfers Addendum (as of 18 November 2025).

7. Cookies and browser storage

For sign-in and display we use technically necessary storage. The payment form of the payment service provider Stripe and the associated Stripe cookies are only loaded if you have given your consent in the purchase dialog; you can withdraw your consent at any time. Details are given in the cookie notice.

8. Retention

  • Account and credit data: until the account is deleted. You can request deletion by email to admin@alunatec.de; before deletion you are informed of any remaining balance. Upon deletion, account, credit and order data in the platform are deleted and all sign-in sessions end. For refunded purchases, the platform keeps a refund record until account deletion (Stripe payment reference, number of credits, account identifier without further account data) to prevent duplicate reversals; it is deleted together with the account.
  • Invoice and accounting records for purchases: retained by ANKORATEC GmbH as the seller and by Stripe for the statutory retention periods (Section 147 of the German Fiscal Code, Section 257 of the German Commercial Code; up to ten years depending on the record).
  • Sign-in sessions: signing out ends all sessions of the account; without signing out the session persists, and no inactivity timeout is currently configured. Access tokens are valid for one hour each.
  • Logs of the database and sign-in services (Supabase): 7 days.
  • Database backups: 7 days.
  • Server logs of the web application, the calculation service and the access server (including access log with IP address and requested address): at most 3 files of 10 MB each per service; when the limit is reached the oldest file is removed. How long an entry is retained therefore depends on traffic; there is no fixed period in days. The server's system log is kept size-limited with the operating system's default settings.
  • Server snapshots (for recovery after incidents): regularly deleted no later than 30 days after creation; individual snapshots kept longer as a rollback path for a change only with documented justification.
  • Availability check results (Microsoft Azure Application Insights): 90 days.

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). For the platform, contact admin@alunatec.de; for purchase, payment and invoicing, contact info@ankoratec.de.

You can lodge a complaint with a data protection supervisory authority. The competent authority for ALUNATEC and ANKORATEC GmbH (both based in Paderborn) is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

10. Requirement to provide data

An account cannot be created without an email address and password; the tools cannot be used without an account. No automated decision-making within the meaning of Art. 22 GDPR takes place.

11. Artificial intelligence

The platform currently does not use AI services. This policy will be supplemented before any introduction.

Stand: 31.10.2026