Privacy policy

1. Controller

The controller for personal data processed on this website and in jumoca FLOW is jumoca, Julian Caspary, Am Waldangelbach 67, 69168 Wiesloch, Germany. You can reach us at info@jumoca.de.

2. Hosting

The website and the service run on a dedicated server we rent from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server is located in Hetzner’s data centre in Helsinki, Finland. We have a data processing agreement with Hetzner under Art. 28 GDPR.

3. Visiting this website

When you open a page, the server uses your IP address and the technical details your browser sends in order to deliver it. This is based on our legitimate interest in running the website (Art. 6 (1) (f) GDPR).

If you switch languages, a cookie remembers your choice for one year. It is strictly necessary and therefore needs no consent (§ 25 (2) no. 2 TDDDG).

4. Contact form

We use what you enter in the contact form to answer your enquiry. The legal basis is Art. 6 (1) (b) GDPR where your enquiry concerns a contract, and otherwise our legitimate interest in replying (Art. 6 (1) (f) GDPR). Messages reach us through Microsoft 365, with Microsoft acting as our processor. Once your enquiry is settled, we delete your details unless we are required to keep them.

5. Signing in and your account

You sign in to jumoca FLOW with your Microsoft work or school account. We store your name, your username (usually your work email address), the IDs Microsoft uses for you and your organisation, your permissions and seat, and how you use jumoca FLOW. Sign-in itself is governed by your organisation’s agreement with Microsoft.

We need this data to provide jumoca FLOW and to fulfil our contract with your organisation. The legal basis is Art. 6 (1) (b) GDPR if you are our customer yourself, and otherwise our legitimate interest in fulfilling that contract (Art. 6 (1) (f) GDPR). Signing in is required to use jumoca FLOW. We delete your account data when you are removed from your organisation, and all other data 90 days after your organisation closes its account.

6. Documents, maps and the change journal

We process documents, maps and the change journal on behalf of your organisation, under a data processing agreement (Art. 28 GDPR). Your organisation is the controller for this data.

7. Payment

Subscriptions are handled by Stripe (Stripe Payments Europe, Limited, Dublin, Ireland), which also processes your payment details partly under its own responsibility (stripe.com/privacy). This may involve a transfer to the USA, which is safeguarded by the EU-U.S. Data Privacy Framework. The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR). We keep invoices as required by tax law (Art. 6 (1) (c) GDPR) and delete all other data 90 days after your organisation closes its account.

8. Operation and security

To keep jumoca FLOW secure, we log access to the service with user and organisation IDs. Logs and backups are deleted after 14 days. This is based on our legitimate interest in secure operation (Art. 6 (1) (f) GDPR).

9. Recipients and transfers

The recipients of personal data are Hetzner, Microsoft and Stripe. Microsoft may also process data in the USA. This transfer is safeguarded by the EU-U.S. Data Privacy Framework (Art. 45 GDPR).

10. Your rights

You can ask for access to your data, have it corrected or erased, have its processing restricted, and receive it in a common format (Art. 15 to 20 GDPR). You can also lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg.

11. Right to object

Where we rely on legitimate interests (Art. 6 (1) (f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). An email to info@jumoca.de is enough.