Privacy Policy

Controller

The controller responsible for data processing on this website is:

General Information

The following information provides an overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to personally identify you.

SSL/TLS Encryption

For security reasons and to protect the transmission of confidential content, this website uses SSL or TLS encryption. You can recognize an encrypted connection by the address bar of the browser changing from "http://" to "https://" and by the lock symbol in your browser bar.

Server Logs & Hosting

Hosting Provider:

Vercel Inc.

440 N Barranca Ave #4133, Covina, CA 91723, USA

Type and Scope of Processing

When visiting this website, technical information is automatically stored in server log files by the hosting provider:

• IP address of the requesting computer
• Date and time of access
• Name and URL of the retrieved file
• Website from which access was made (referrer URL)
• Browser used and, if applicable, the operating system

Purpose of Processing

Processing is carried out to provide the website technically, to ensure system security, and to optimize the internet offering.

Legal Basis

Processing is based on Art. 6(1)(f) GDPR (legitimate interest). Our legitimate interest lies in the proper functioning and security of our website.

Retention Period

The data is deleted as soon as it is no longer necessary for the purpose of its collection. This is usually the case after 7 to 30 days.

Third Country Transfer

Vercel operates servers worldwide, including in the USA. Data transfer to the USA is based on the EU-US Data Privacy Framework, for which the European Commission has issued an adequacy decision (Art. 45 GDPR). A data processing agreement pursuant to Art. 28 GDPR has been concluded with Vercel.

Database & Authentication (Supabase)

We use Supabase for database hosting and authentication.

Data Collected

During registration and use, the following data is processed:

• Email address
• Name
• Password (stored encrypted)
• Workspace memberships and roles
• Challenge participations and progress

Purpose of Processing

Provision of platform functions, authentication, storage of user data and workspace information.

Legal Basis

Art. 6(1)(b) GDPR (performance of a contract).

Hosting Location

Supabase hosts our data in the European Union (Frankfurt). No data is transferred outside the EU for database services.

Payment Processing (Stripe)

We use Stripe for processing subscription payments.

Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland

Data Collected

During payment transactions, the following data is transmitted to Stripe:

• Email address
• Billing address (if provided)
• Payment information (processed directly by Stripe)

We do not store complete credit card information on our servers.

Legal Basis

Art. 6(1)(b) GDPR (performance of a contract).

Third Country Transfer

Stripe is certified under the EU-US Data Privacy Framework. A data processing agreement pursuant to Art. 28 GDPR has been concluded with Stripe.

Web Analytics (Umami)

This website uses Umami, a privacy-friendly, cookie-free open-source web analytics software.

Data Collected

Umami only collects anonymous, aggregated usage data such as page views, time on site, and referrers. Identification of individual visitors is not possible.

Cookies & Tracking

Umami is completely cookie-free and GDPR compliant. No cookies are set and no fingerprinting is performed.

Hosting

Umami is self-hosted by us on servers at Hetzner Online GmbH in the European Union. No data is transmitted to third parties.

Legal Basis

Art. 6(1)(f) GDPR (legitimate interest). Our legitimate interest lies in the analysis and optimization of our website. Since Umami does not collect personal data and does not set cookies, no consent is required.

Contact by Email

If you contact us by email, the data you provide (your email address, possibly your name and other information you provide) will be stored by us to process your inquiry.

Purpose

Processing your inquiry and communicating with you.

Legal Basis

Art. 6(1)(f) GDPR (legitimate interest in responding to your inquiry) or Art. 6(1)(b) GDPR if your inquiry is aimed at concluding a contract.

Retention Period

The data will be deleted as soon as the processing of your inquiry is completed and no statutory retention obligations exist.

Contact Form & Lead Management

If you contact us via a contact form on this website, your data will be processed for lead management and customer support.

Data Collected

Name, email address, phone number (optional), company (optional), message, and timestamp of the inquiry.

Purpose of Processing

Lead management, customer support, processing of inquiries, and, if applicable, contract initiation.

Legal Basis

Art. 6(1)(b) GDPR (contract initiation) or Art. 6(1)(f) GDPR (legitimate interest in processing your inquiry and customer care).

System Used

The transmitted data is stored in our self-hosted Odoo CRM system to process your inquiry and manage customer contact.

Hosting Location

Odoo is hosted on our own servers at Hetzner Online GmbH in Germany. No data is transferred outside the European Union.

Retention Period

Lead data is stored as long as it is necessary for processing your inquiry or for a potential business relationship. After completion of correspondence, the data will be deleted unless statutory retention obligations (e.g., commercial or tax law) exist. These are usually 6 to 10 years.

Support & Live Chat

If you use our live chat or submit a support request through our ticket system, your data will be processed to handle your concern.

Data Collected

Name, email address, subject, message, chat history, timestamp, and, if applicable, ticket number of the inquiry.

Purpose of Processing

Processing your support or chat request, tracking the concern, and communicating with you.

Legal Basis

Art. 6(1)(b) GDPR (performance of a contract) or Art. 6(1)(f) GDPR (legitimate interest in processing your inquiry).

System Used

Zammad – a self-hosted open-source system for support tickets and live chat.

Hosting Location

Zammad is hosted on our own servers at Hetzner Online GmbH in Germany. No data is transferred outside the European Union.

Retention Period

Support tickets are retained for a reasonable period after the matter is resolved to be available for follow-up inquiries. Deletion occurs as soon as no retention obligations exist.

Email Delivery (Brevo)

We use Brevo (formerly Sendinblue) for sending transactional emails such as registration confirmations, password resets, and notifications.

Data Collected

Email address and name are transmitted to Brevo for email delivery.

Legal Basis

Art. 6(1)(b) GDPR (performance of a contract).

Location

Brevo is based in the EU (France) and processes data in accordance with the GDPR. A data processing agreement pursuant to Art. 28 GDPR has been concluded with Brevo.

Your Rights as a Data Subject

You have the following rights with respect to the personal data concerning you:

Competent Supervisory Authority

The data protection supervisory authority responsible for us is:

Data Protection Officer

The appointment of a data protection officer is not legally required for our company. For questions about data protection, please contact: contact@balane.tech

Automated Decision-Making

No automated decision-making including profiling within the meaning of Art. 22 GDPR takes place.

Changes to this Privacy Policy

We reserve the right to adapt this privacy policy to ensure it always complies with current legal requirements or to implement changes to our services in the privacy policy. The new privacy policy will then apply to your next visit.

Language Clause

This privacy policy is written in German. Translations into other languages are provided for information only. In the event of any conflict or discrepancy between the German version and a translation, only the German version shall prevail.