Privacy policy

Controller

Mehmet Bilgin, Zanyar Systems, Berliner Straße 114-116, 63065 Offenbach am Main, Germany, email: service@facturexa.com – see legal notice.

Processing when you visit the website

When you visit this website, the hosting provider automatically processes technical access data (e.g. IP address, date and time of access, page requested, browser used), as is technically necessary to operate any website. This data is not merged with other data sources.

Error log

If an error or anomaly occurs while the website is running, the application writes an entry to an error log on the server. Ordinary, error-free page requests are not recorded there. An entry contains:

• time, page requested and an internal request identifier;
• technical description of the error;
• email address – if an email to you (sign-in code, license) could not be delivered or too many sign-in codes were requested;
• IP address – only if too many sign-in codes were requested.

Uploaded invoices, license keys and sign-in codes are not written to the log. The log serves to detect and fix malfunctions and to investigate misuse; the legal basis is Art. 6(1)(f) GDPR (our legitimate interest in secure and fault-free operation). Entries are deleted automatically after 30 days and are not passed on to third parties.

Visitor statistics

To see which content is used and how visitors find this website, the application keeps its own visitor statistics – without cookies, without third-party tracking services and without passing data on to third parties. For every page request and every use of an online demo we store:

• time, page requested and language; for the online demos also whether processing succeeded (not the content of the file);
• country the request comes from. It is determined on our server from your IP address using the “IP to Country Lite” database by DB-IP (licensed under CC BY 4.0). The IP address itself is neither stored nor sent to DB-IP;
• referring page, if you follow a link from another website – only its address without parameters (e.g. https://github.com/…/issues/12);
• campaign tags from the address of the page requested, only utm_source, utm_medium, utm_campaign and ref;
• browser, operating system and device type (e.g. “Chrome, Windows, desktop”) and the full browser identifier (user agent). The full identifier is deleted after 30 days; it is only used to check the detection of automated requests.

The entries contain no identifier that would allow requests to be attributed to a person or tracked across visits. Automated requests (search engines, bots) and browser prefetching are not counted. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in designing our offering according to demand and measuring its reach). Entries are deleted automatically after 13 months.

Invoice validation in the live demo

The invoice PDF uploaded on the "Validator" page is processed exclusively in the server’s memory in order to display the validation result. The file is not stored permanently and is not passed on to third parties. Once the validation is complete, or at the latest when the request ends, the content is released from memory. As uploaded invoices may contain personal data (e.g. names, addresses), please use anonymised or sample documents for testing wherever possible.

To prevent misuse of the free online demos (Validator, Creator, Reader), we count requests per IP address for a 10-minute window in the server’s memory. The IP address is not written to any file or database for this purpose; the counters expire with the window. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in stable operation free of misuse).

Customer account and sign-in via email code

You can use a customer account to view your licenses and create a free trial license. There is no password: after you enter your email address, we send you a six-digit sign-in code that is valid for 10 minutes and can be used only once. The account is created the first time you sign in with this code. In doing so, we process:

• email address – for signing in, sending sign-in codes and matching license purchases made with the same address;
• name or company – only if you create a trial license; this name is written into the license key;
• time the account was created and of the last sign-in;
• language of your last sign-in (German, English or French) – so that we send you emails in this language;
• your licenses (product, license key, term);
• details of requested sign-in codes: email address, IP address, time, number of entry attempts and the code in encrypted form. IP address, time and entry attempts are used to prevent mass requests and the guessing of codes. These details are no longer needed once the code expires and are deleted regularly, at the earliest after 24 hours.

The legal basis is Art. 6(1)(b) GDPR (providing the customer account or trial license you requested); for limiting link requests based on the IP address, Art. 6(1)(f) GDPR (our legitimate interest in preventing misuse and unwanted emails to third parties).

The emails are delivered via the email service provider [placeholder: name, registered office of the provider], with whom a data processing agreement is in place.

We store the account data until you request deletion of your account; an informal message to the address given in the legal notice is sufficient. Beyond that, we retain data on purchased licenses where statutory retention obligations apply (in particular under commercial and tax law).

Purchase and invoice

When you buy a license, we process the details from the order form in order to perform the contract and issue the invoice:

• name or company and email address – the name is written into the license key, and we send the order confirmation, invoice and key to the email address;
• billing address (street, postcode, city, country) and, if provided, your purchase order number – they appear on the invoice;
• VAT ID – if provided; it appears on the invoice. We check it when you order via the VAT Information Exchange System (VIES) of the European Commission and store the time and result of the check as evidence;
• time of your confirmation that you are ordering as a business – as evidence that no consumer contract exists;
• version of the terms and time of your acceptance – as evidence of which conditions were agreed;
• language of the order – we create the license email and invoice in this language.

The legal basis is Art. 6(1)(b) GDPR (performance of the contract) and, for the invoice and its retention, Art. 6(1)(c) GDPR (legal obligations under VAT, commercial and tax law). We send you the invoice by email; you can also download it in your customer account. We retain invoices and the associated purchase data for the statutory period of eight years from the end of the calendar year; even if you request deletion, they are only deleted after that. Upon deletion, the purchase also disappears from your customer account – your license key remains valid, so please keep it yourself. Where required by law, we pass invoices on to our tax advisor and the tax authorities.

Payment

You pay by bank transfer to our business account. Through our bank, we receive the details of your transfer: name and IBAN of the account holder, amount, date and payment reference. We use them to match the payment to your order and then release the license key. The legal basis is Art. 6(1)(b) GDPR (performance of the contract). Bank statements are accounting records; we keep them for the statutory periods (Art. 6(1)(c) GDPR in conjunction with Section 147 of the German Fiscal Code). Your bank and our bank are each responsible for executing the transfer.

Cookies & tracking

This website does not use analytics or marketing cookies and does not embed any third-party tracking services; our own visitor statistics (see above) work without cookies. Only cookies required for the functions you use are set:

The legal basis for setting these cookies is § 25(2) no. 2 TDDDG, as they are strictly necessary to provide the functions you expressly requested (sign-in, forms); further processing is based on Art. 6(1)(b) or (f) GDPR.

Your rights

Under the GDPR you have the right of access, rectification, erasure, restriction of processing, data portability and objection to the processing of your personal data. To exercise these rights, please contact the controller named in the legal notice.