PRIVACY NOTICE

This is a translation for convenience; the German version prevails. It is DATENSCHUTZ.txt in the program folder.

This notice describes which personal data the program Betonrezeptur-Designer processes when you use it on your computer. For our website, the privacy policy at https://rehfeldt-massing.de/datenschutz.html applies.

1 CONTROLLER

Rehfeldt & Massing GbR
represented by its partners Eva Maria Rehfeldt Massing and Ricardo Rehfeldt
Padies 2a, 48683 Ahaus, Germany
Phone +49 2561 4445268
E-mail kontakt@rehfeldt-massing.de

We have not appointed a data protection officer; we are not obliged to do so (Art. 37 GDPR, section 38 BDSG).

For the data that a company processes via synchronisation (section 6), that company itself is the controller; we process it on its behalf.

2 IN BRIEF

The program calculates entirely on your computer. Mix designs, material master data, moisture journal, settings and error log stay there. Only if you sign in for synchronisation are mix designs, own materials and the moisture journal sent to our server (sections 6 and 8). The licence only leaves the computer as a licence block when you download an update (section 4). To check the licence, the program reads characteristics of your computer; of these, only shortened check values are sent to us, when you send us the workstation identifier or download an update (section 5).

The program itself connects only to our server at beton.rehfeldt-massing.de, always encrypted (HTTPS). It contains no advertising, no usage tracking, no crash reports and no third-party components that send data. Without an internet connection it works without restriction; only the notice of new versions and of known calculation errors, the catalogue download, the update and the synchronisation are unavailable.

You may object to the start-up query and to other processing based on our legitimate interests (section 11).

3 QUERY AT START-UP: NEW VERSIONS AND MATERIAL CATALOGUE

When: at every program start. If the program presents the terms of use for acceptance at that start, it asks only afterwards; that window mentions this query and leads to this notice. With an installation by hand, the short version of this notice in the set-up already mentions it. The program also downloads the material catalogue when you choose the catalogue entry in the menu (such as "Download catalogue" or "Update catalogue") or click "Refresh" in the "Material catalogue" window. If you switch "Check online at start-up" back on, it immediately asks about new versions and downloads the catalogue. When you open "About this app" it asks whether the server is reachable. This happens in every licence state, including the trial period, and without signing in.

What is transmitted: the IP address of your internet connection or company network, the time, the address requested (/version, /katalog, /health) and the generic identifier of the runtime ("Dart/<version> (dart:io)"). Not transmitted: licence number, name, e-mail address, workstation identifier, mix design or material data.

Purpose: we inform you about new versions and above all about known calculation errors of the version you are working with. We also provide the curated material catalogue; only what you select yourself is taken over.

Switching off: in the "More options" menu the start-up query can be switched off ("Check online at start-up"); this is also the simplest way to object to it (section 11). The setting applies to your Windows account on this computer. If the program has to set aside a damaged settings file, the setting is switched on again; the program tells you so. While the query is switched off, you will no longer learn of a known calculation error in your version through the program. You can still load the catalogue manually, and when you open "About this app" the program still asks whether the server is reachable. Synchronisation after signing in (section 6) runs independently of this.

Legal basis: Art. 6(1)(f) GDPR. The legitimate interest is that you learn of calculation errors and receive current catalogue data. The IP address is technically necessary to deliver the response. We do not evaluate it to identify you; it appears in the server's logs (section 7). For licensed workstations the query also serves the promised correction of calculation errors.

4 DOWNLOADING AN UPDATE

This path exists only on licensed workstations (also during a grace period) and only when you choose "Download" in the update dialog. It does not exist in the trial period or in read-only mode; there you request a new version by e-mail.

What is transmitted: IP address and time, the requested version, the licence block of this workstation (licence number, licensee, short identifier of the workstation, date of issue and, where applicable, expiry date, the hardware characteristics only as shortened check values, no serial numbers), the program identifier with the running version (such as "beton-desktop/1.9.6") and technical data (time stamp, random value, check signature) by which the server recognises that the request comes from the program.

What the server does with it: it checks the licence and delivers the set-up. It does not store the licence block. With a time stamp it logs the delivery with licence number, set-up version and program identifier, refusals with reason and program identifier (for a blocked licence or a reached download limit also the licence number, for an expired licence its expiry date) and requests for a version that is not offered. It does not log the licensee's name. To limit deliveries to ten per licence within 24 hours, it keeps licence number and delivery times in memory; after 24 hours they are discarded with the next update request that concerns an offered version and passes the licence check, at the latest when the service restarts.

Legal basis: for the delivery Art. 6(1)(b) GDPR where you yourself are the licensee; where the licensee is a company or public body for which you use the program, Art. 6(1)(f) GDPR (our legitimate interest is to perform the licence agreement with it). For the log and the download limit Art. 6(1)(f) GDPR (detecting licences passed on without authorisation).

5 LICENCE REQUEST, ACTIVATION, PURCHASE AND E-MAILS TO US

You send us your workstation identifier yourself: "Prepare e-mail" opens your e-mail program with a message to kontakt@rehfeldt-massing.de, or you copy the block. The program sends nothing in doing so.

The block contains a short identifier, the program version and up to five hardware characteristics, each as a shortened check value and not in plain text: Windows installation identifier (MachineGuid), SMBIOS UUID, mainboard serial number, serial number of the system partition and MAC address of the first network adapter. In addition there is what your e-mail itself contains (sender, name, signature).

The program reads these characteristics at every start, also in the trial period and, where applicable, even before you decide on the terms of use. It forms the check values from them and compares these on your computer with the licence or the licence state (section 8). In this way it binds the licence to the workstation for which it was issued and the trial period to the computer on which it began (terms of use, section 2.5). It does not store the characteristics themselves. The check values leave the computer only when you send us the block or download an update (section 4). Legal basis: with a licence Art. 6(1)(b) GDPR where you yourself are the licensee (contract for a workstation-bound single-user licence); where the licensee is a company or public body, Art. 6(1)(f) GDPR, and our legitimate interest is to perform this contract. In the trial period Art. 6(1)(f) GDPR; our legitimate interest is that the free trial period is used only once per computer.

We keep a licence register with licence number, licensee, time of issue, short identifier, characteristic check values, program version, expiry date where applicable, a note and the number of a replaced or replacing licence, and we keep the licence text issued. Both are held by us, not on the server. For notices concerning the licence, such as the announcement that we are discontinuing the program or a block on update downloads, we use the e-mail address you last gave us and keep it for this purpose as long as the licence exists.

Legal basis: Art. 6(1)(b) GDPR (contract or steps taken at your request prior to entering into a contract) where you yourself are or wish to become the contracting party; if you act for a company or public body, Art. 6(1)(f) GDPR (our legitimate interest is to prepare and perform the contract with it). Retention: for the duration of the licence, because we reissue it after a hardware change or a change of computer. Thereafter we delete the characteristic check values from the licence register and keep only what must be retained under tax law: invoices for eight years (section 14b UStG, section 147 AO), business letters such as the e-mails with request and licence for six years (section 147 AO), each from the end of the calendar year. Where these e-mails contain the check values, they remain there until the period expires and are not used for any other purpose. The legal basis for this is Art. 6(1)(c) GDPR.

Purchase of a licence: for quotation, conclusion of the contract, invoice and receipt of payment we process company name, address, contact person, e-mail address, where applicable the VAT identification number or other proof of your business status (such as a register extract or trade registration), and the payment details. The legal basis is Art. 6(1)(b) GDPR where you yourself are or wish to become the contracting party; if you act for a company or public body, Art. 6(1)(f) GDPR (our legitimate interest is to prepare and perform the contract with it). We retain invoices for eight years and business letters for six years, each from the end of the calendar year (section 14b UStG, section 147 AO; Art. 6(1)(c) GDPR).

Passing on a licence: if you pass on your licence (terms of purchase and licence, section 9.4), you tell us the name and address of the acquirer. We process them to record the transfer in the licence register and to transfer the licence to the acquirer at their request (Art. 6(1)(f) GDPR; our legitimate interest is to keep track of who holds a licence). The retention periods of this section apply to these data.

E-mails to us: if you write to us, for example with a licence request, a request for a new version or an extension of the trial period, a question or an error log, we process sender address, name, signature, content and attachments in order to deal with your request. The legal basis is Art. 6(1)(b) GDPR where you yourself are or wish to become a contracting party, for requests concerning your rights (section 11) Art. 6(1)(c) GDPR, otherwise, in particular where you write on behalf of a company or public body, Art. 6(1)(f) GDPR; our legitimate interest is to answer enquiries, to prepare and perform contracts with your company or public body and to correct errors in the program.

We process an error log that you send us (section 8) as controller solely for troubleshooting, also if your company uses synchronisation, and delete it no later than three months after troubleshooting has been completed. If the e-mail with which it arrived must be retained as a business letter, the log remains in it until that retention ends and is not used for any other purpose. Enquiries that do not lead to a contract are deleted no later than twelve months after the last contact, other e-mails, for example questions about operation, no later than twelve months after your request has been dealt with. We keep requests concerning your rights (section 11) and our reply as evidence until three years after the end of the year in which they were dealt with. All of this applies unless the e-mails must be retained longer as business letters.

6 SIGN-IN AND SYNCHRONISATION (ONLY WITH AN ACCOUNT SET UP BY US)

Synchronising several workstations is optional; we set it up only if a company expressly requests it. We set up the account for it on your company's instruction, and only after your company has concluded a data processing agreement with us; we assign the initial password. You can change it in the program (account symbol → "Change password", at least 12 characters); every older sign-in of this account then ends, also on other workstations. On your company's instruction we set a new one. When signing in, e-mail address and password are transmitted, when changing it the current and the new one. The program then synchronises mix designs, own materials and the moisture journal in both directions: immediately after signing in, at every start, when the network connection returns and on your command, as long as the sign-in is valid (until you sign out, at most seven days), regardless of the licence state. Each of these requests carries the session token of the sign-in, by which the server recognises the account, the program identifier with the running version and the technical data from section 4.

Journal lines carry the time and the workstation name (computer name), those created after signing in also the signed-in e-mail address. All accounts of the same company see its mix designs, materials and journal. For each account the server stores e-mail address, password only as a hash, role, status, company and time of creation and of password change, and for each entry which account wrote it and its creation and modification time. It logs refused requests with method, path and program identifier.

Legal basis: for synchronisation we process the data on behalf of your company (Art. 28 GDPR); the company determines the legal basis. Retention: we deactivate accounts on your company's instruction. An account that is the only one of its company we delete on instruction together with the entries it has written, renaming the company entry that until then carries its e-mail address; in a company with further accounts the entries remain with the company and the account is deactivated. Deleted mix designs and materials are removed permanently after 90 days. The moisture journal is not deleted automatically because it is part of the records of the factory production control; the company decides on its deletion.

7 SERVER OPERATION

The server is located at Hetzner Online GmbH in Germany.

Access log of the upstream web server: for every request to beton.rehfeldt-massing.de, IP address, time, method, host and path of the request, result, amount of data transferred, the runtime identifier, where present the referring page (referer; empty for the program) and technical details of the forwarding (protocol, cache and service status, compression, target service) are logged. In addition, the web server notes IP address, time, method, path and host of every request in its error log as well (as a technical warning). Both logs are rotated daily and deleted after seven days at the latest.

Log of the application service: it contains time, request and result of every request, but not your IP address (the service only sees that of the upstream web server), plus the entries named in sections 4 and 6. Its size is limited (three files of 10 MB each); the oldest entries are overwritten continuously.

Protective measure: a common rate limit applies to all services behind the upstream web server, including beton.rehfeldt-massing.de: per IP address 10 requests per second across these services together; the web server still accepts a short burst of up to 100 further requests and rejects anything beyond. The program does not reach it in ordinary use; a synchronisation, for instance, makes one query and at most one bundled save request per data set. If the limit rejects three requests from the same IP address within ten minutes (rejections at other websites on this server can count too), or if signing in to another service on this server fails three times within ten minutes, the IP address is blocked for one day, and then also for this program; if signing in fails at the remote maintenance access, the one-day block does not apply to this program. A wrong password in the program does not trigger a block. If an IP address is blocked five times within one day (blocks of the server's remote maintenance access count too), it stays blocked for four weeks. You may ask us by e-mail to kontakt@rehfeldt-massing.de to lift a block early.

The blocking log records, each with IP address and time, every rejection counted by the limit and every counted failed sign-in at another service, even if no block follows, as well as every block and its lifting. It is rotated weekly and deleted after five weeks at the latest. The block list keeps a blocked IP address for up to about four days (one-day block) or about twelve weeks (four-week block) from the start of the block.

The server's firewall logs rejected data packets with IP address, destination and time; occasionally these may include late packets of a connection of the program that has already ended. This log is rotated weekly and deleted after five weeks at the latest, its copy in the server's system journal after about five weeks.

Error monitoring: unhandled errors of the service are reported to our own error monitoring on our server, without request data, IP addresses or user data. The reports are deleted after 90 days.

Data backup: the synchronisation database is backed up every night. On the server the backups are deleted after 15, at the latest after 16 days; a copy on a second computer of our own in Germany after 31 days. If, before a change to the service or the server, we additionally make a backup containing synchronisation data or copies of the logs named above, we delete it as soon as the change has been accepted, after 14 days at the latest. In addition, the database records every change in a change log (binary log), for changes and deletions also the previous state; it is rotated every night and deleted after two, at the latest after three days. Backups of the server configuration made before a change may contain blocked IP addresses; we delete them after four weeks at the latest.

Legal basis: for the logs, the protective measure, the error monitoring and the backups of the server configuration Art. 6(1)(f) GDPR (security and availability of the service). Backing up the synchronisation data and its change log is part of the processing on behalf of your company (section 6); the data processing agreement applies to it.

8 WHAT STAYS ON YOUR COMPUTER ONLY

Documents\BetonKalkulation your exports and backups. The moisture journal (with computer names and e-mail addresses) is also contained in the full backups, the safety copies that the program itself makes before restoring a backup and before a material import, the backups made before an update, the synchronisation packages and the journal export (CSV). Apart from the backups made before an update, the program deletes none of these files.

The error log stays on your computer. It consists of at most two files: when the current one reaches 256 KB, the program starts a new one and keeps the full one as its predecessor; an older predecessor is deleted in the process. A file of the error log that has received no entry for 90 days is deleted by the program at start-up; every start itself writes an entry to the current file. Of the backups made before an update the three most recent are kept, of the set-up logs the five most recent, in each case without a time limit. If you give us an error log (section 5), session tokens, long keys and values marked as passwords are masked in it; of e-mail addresses the first letter and the domain remain readable, as do file paths with your Windows user name and the operating system and language setting.

Uninstalling leaves data and licence in place. You remove them completely by deleting the folders named and, in the %TEMP% folder, the files named there. Deleting the licence folder in order to start a new trial period is prohibited by the terms of use (section 2.5).

9 RECIPIENTS

Hetzner Online GmbH, Germany, operates as processor (Art. 28 GDPR) the data centre in which our server is located. Your e-mails to us are received by our e-mail provider STRATO GmbH, also as processor. During synchronisation the other accounts of the same company see its data (section 6). We disclose data to other third parties only where we are legally obliged to do so, for example to the tax authorities. There is no transfer to countries outside the EU.

Note: when checking the code signature of an update, Windows may download missing root certificates from Microsoft. This is a function of the operating system, not of the program.

10 OBLIGATION TO PROVIDE DATA, NO AUTOMATED DECISION-MAKING

You are under no statutory or contractual obligation to provide data to us. For a licence agreement, however, we need the details of your company as licensee (company name, address, e-mail address) and the workstation identifier (section 5). Without them we cannot issue a licence for your workstation; after the trial period the program then switches to read-only mode (terms of use, section 2.3). The program reads the hardware characteristics itself (section 5). Without a connection, version notice and catalogue are unavailable, without a licence block the update, without signing in the synchronisation; you can calculate without a connection, during the trial period and with a licence.

There is no automated decision-making including profiling within the meaning of Art. 22 GDPR. The licence check on your computer and before an update is delivered concerns only the range of functions under the terms of use.

11 YOUR RIGHTS

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Please contact kontakt@rehfeldt-massing.de. For data that your company processes via synchronisation, please contact your company; we support it in doing so.

You may also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority competent for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.