1. Controller
The controller is chemmedia AG, [address], email: datenschutz@knowledgeworker.live. Data protection officer: [name/contact]. Operation and storage take place exclusively in data centres within the European Union.
2. Purposes and legal bases
Registration, login and contract performance (Art. 6(1)(b) GDPR): name, email, hashed password, company/tenant data, billing data.
Provision of platform features on the basis of the usage contract (Art. 6(1)(b) GDPR).
Privacy-friendly, aggregated usage measurement without personal tracking (legitimate interest, Art. 6(1)(f) GDPR); additionally k-anonymised in works-council mode.
3. Recipients and processors
We use carefully selected processors under Art. 28 GDPR: hosting/object storage (EU), payment (Stripe), speech synthesis (incl. ElevenLabs, OpenAI) and optional avatar generation (HeyGen). Where processing takes place outside the EU/EEA, appropriate safeguards apply (EU standard contractual clauses or an adequacy decision). The current sub-processor list is part of the DPA.
4. Retention and your rights
Data is kept only as long as necessary or as required by statutory retention periods. You have the rights to access, rectification, erasure, restriction, portability and objection (Art. 15-21 GDPR) and the right to lodge a complaint with a supervisory authority.
5. Cookies
We use only technically necessary cookies (e.g. session, CSRF). There is no cross-site tracking and no sharing for advertising.