Privacy policy (Datenschutzerklärung)

1. Controller

Postuvio UG (haftungsbeschränkt), Am Tiergarten 10-12, 22926 Ahrensburg, Germany, represented by the managing director (Geschäftsführer) Tom Gladrow. Contact, including for data protection questions: support@portodoc.de.

2. Our role

• Private customers: we are the controller (Verantwortlicher) within the meaning of the GDPR (DSGVO) for the processing of your data, including the content of your letters.
• Business customers: we process the content of letters on behalf of the company under the data processing agreement (Vertrag zur Auftragsverarbeitung, Art. 28 GDPR) that companies conclude at registration. The company is the controller for this data. We are a controller in our own right only for the account, contract and billing data of the company and of the persons acting for it, and for the records of the authorisation and the conclusion of the contract.
• Senders and persons named in letters: we process letters to our customers in order to make them available to the recipient, in the role described above.

3. What data we process and why

• Account and contract data: name, e-mail address, address, language, plan, payment interval, notification choice; for companies additionally company name, country, contact person, VAT identification number or registration number and industry — to perform the contract (Art. 6(1)(b) GDPR).
• Records of authorisation and conclusion of contract: confirmed version, time, name, IP address and browser identifier — as evidence (Art. 6(1)(f) GDPR).
• Letter mail: envelope and content of the letters, scan, recognised text, AI summary, detected deadlines, date of receipt and assignment to the account — to provide the service (Art. 6(1)(b) GDPR).
• Billing data: invoices, payment status, tax details — for billing and to fulfil tax obligations (Art. 6(1)(b) and (c) GDPR).
• Server logs: IP address, time, address accessed — for security and to prevent misuse (Art. 6(1)(f) GDPR).

4. Special categories of data in letters; obligation to provide data

Letters may contain special categories of personal data, for example health data in a letter from a health insurer. We process them only insofar as this is necessary for receiving, digitising and providing the letters, and do not evaluate them for our own purposes.

Without account and contract data and without the authorisation to receive (Empfangsvollmacht) we cannot provide the service. We do not make automated decisions within the meaning of Art. 22 GDPR.

5. Use of artificial intelligence

For summaries, deadline detection and translation, an AI model processes the recognised text of your letters. The model runs on a computer in Germany operated for us by a shareholder of Postuvio UG; it is connected via an encrypted private network. Letter content is not used to train AI models. If we use a different AI provider in future, we will update this policy beforehand.

AI results are labelled (Art. 50 EU AI Act). They are non-binding assistance and do not replace legal or tax advice.

6. Notification by e-mail

You choose how we inform you about new mail:

• Notice only: an e-mail that new mail has arrived, without details of its content.
• Summary: sender, type of letter, a short summary and detected deadlines in the e-mail.
• Summary with PDF: additionally the scan as an attachment.
• We send the summary and scan by unencrypted e-mail only if you have chosen this yourself. Such e-mails can be read by third parties in transit. Without your own choice you receive only the notice. We store your choice with the time; you can change it at any time in the customer account.

7. Protection of letter content and emergency access

Once a letter has been assigned to your account, nobody at our company sees its content any more – only in exceptional cases, with a reason, and you immediately receive an e-mail.

Before assignment, our staff see the scan and recognised text insofar as this is necessary to assign the letter to the correct account.

Emergency access: if a member of staff exceptionally needs to see the content of an assigned letter, for example to fix an error, they state a reason. Access applies only to this one letter and for 15 minutes, it is logged, and you immediately receive an e-mail.

We keep the paper originals locked away for 90 days and then destroy them in compliance with data protection requirements using a document shredder, unless you order forwarding.

8. Referral programme

If you sign up via a referral link, we store which code was used and whether your first invoice has been paid. We need this to credit the referrer with their reward (Art. 6(1)(b) and (f) GDPR). Referring customers do not learn your name: they only see the number of their referrals, and their credit carries a neutral booking text.

9. Notifications to our team

For each new paying sign-up and each incoming payment, our team receives an internal e-mail with name or company, customer number, plan, country and amount, never with letter content (Art. 6(1)(f) GDPR).

10. Recipients

• Hetzner Online GmbH (Gunzenhausen): hosting of the application, database and scans in a data centre in Helsinki, Finland (EU), and an encrypted backup copy in the EU.
• AI processing: a computer in Germany operated for us by a shareholder of Postuvio UG (section 5); an encrypted backup copy is also stored there.
• E-mail delivery: an e-mail delivery service provider based in the EU or bound by standard contractual clauses; it receives name, e-mail address and the content of the notification.
• Payment processing: Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland); Stripe receives name, e-mail address, billing details and payment data.
• Verification of the VAT identification number: for companies from the EU, we query the VAT identification number in the VAT Information Exchange System (VIES) of the European Commission; the country code and number are transmitted.
• Postal service providers: if you order the forwarding of originals.
• E-mail mailbox support@portodoc.de: Hostinger International Ltd. (Larnaca, Cyprus) stores, sends and receives our e-mails as a processor (Art. 28 GDPR), including those to companies and the replies to them (section 17); the mailboxes are located in data centres in France and Germany.
• Deutsche Post: it carries our letters to companies (section 17) and receives the address on the envelope for this purpose.
• Meta and LinkedIn: when you visit our pages on Facebook, Instagram or LinkedIn (sections 18 and 19).
• Authorities: insofar as we are legally obliged to do so.

11. Transfers to countries outside the EU

A transfer to countries outside the EU takes place only insofar as a recipient named above provides for this, and only under the conditions of Art. 44 et seq. GDPR (adequacy decision or standard contractual clauses).

Meta and LinkedIn may transfer data to the USA. The basis is the European Commission’s adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR); Meta Platforms, Inc. and LinkedIn Corporation are certified under it (sections 18 and 19).

E-mails to companies outside the EU (section 17) go to the company itself and contain only its own company details and our offer.

12. Storage period

• Digitised letters (scan, recognised text, summary): until the end of the contract and 30 days thereafter so that you can export them; we then delete them.
• Original letters: 90 days after digitisation; thereafter destruction in compliance with data protection requirements using a document shredder or, at your request, forwarding.
• Invoices and accounting records: 8 years.
• Records of authorisation and conclusion of contract: 6 years after the end of the contract.
• Documents identifying business customers, insofar as we are obliged to keep them under the German Money Laundering Act (Geldwäschegesetz): 5 years after the end of the business relationship.
• Account data: until the end of the contract; thereafter only insofar as they are contained in invoices and records.
• Server logs: 30 days.
• Visitor count (section 16): 13 months; the origin noted on the account like the account data.
• Contacting companies (section 17): contact list up to 24 months after the last contact; block list for as long as we write to companies; replies for as long as the conversation continues, and as business letters for 6 years (section 257 of the German Commercial Code, § 257 HGB).
• Messages and comments on Facebook, Instagram and LinkedIn (sections 18 and 19): on the platform until we or you delete them.

13. Your rights

You have the following rights. For business customers, requests concerning the content of letters are to be addressed to the company; requests that reach us are forwarded there.

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Revocation of the authorisation to receive at any time in the customer account or in text form

14. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Independent Centre for Data Protection Schleswig-Holstein (Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein, ULD), Holstenstraße 98, 24103 Kiel.

15. Security of processing

All data is stored on servers in the EU (Hetzner, Helsinki). Transmissions are TLS-encrypted (HSTS). In the database, each customer’s data is separated from that of other customers.

16. Cookies and visitor count

This website uses only technically necessary session cookies (section 25(2) of the German Telecommunications Digital Services Data Protection Act, § 25 Abs. 2 TDDDG). On this website we use no cookies, no Google Analytics and no third-party services for advertising or statistics; a cookie banner is therefore not required. Our pages on Facebook, Instagram and LinkedIn are services of those platforms (sections 18 and 19).

Visitor count: so that we know how visitors find us, we count page views ourselves, on our own server in the EU (Hetzner, Helsinki), without cookies and without storing anything in your browser. For each view we store the page visited, the language, the domain of the page you came from (for example google.de, not the full address), campaign tags from the link (utm_source, utm_medium, utm_campaign, utm_content) and a partner or promotion code if the link contains one.

Campaign tags appear only in links that we distribute ourselves, for example in posts on LinkedIn, Facebook or Instagram, in e-mails or as a QR code in letters. utm_source and utm_medium name the channel, utm_campaign the campaign, utm_content the individual post, e-mail or letter. In letters and e-mails to companies (section 17), utm_content is a code for the company we wrote to, never the name of a person. We then see that a visit came from the message to that company, but not who made it.

We do not store your IP address or your browser identifier for this. From them and a random value that is newly generated every day, held only in the server’s memory and deleted at the end of the day, we form a daily identifier. This lets us group the views of one day, but not recognise you across several days. Views that are recognisably made by search engines or other automated programs are not counted.

If you sign up or book a plan, we note on your account where your visit came from that day (for example Google, YouTube, a partner code or the campaign tags from the link). The legal basis is our legitimate interest in learning how our service is found and which advertising works (Art. 6(1)(f) GDPR); you can object (section 13). We delete the count after 13 months.

17. Contacting companies by letter and e-mail

We introduce PortoDoc to companies whose customers or members might need PortoDoc, for example VAT service providers, law and tax firms, chambers and associations, logistics and marketplace service providers, and invite them to become partners. We write to businesses, not to consumers. If the business is a sole proprietorship or its company name contains a person’s name, the details are personal data; this section then also applies to that person.

Data and source: we process the company name, legal form, business address, country, website and line of business, for e-mails a general company address (for example info@ or hello@) together with the page on which it appears, and the date and outcome of each contact. The details come from publicly accessible sources: the company’s website and imprint, public registers (for example the commercial register or Companies House) and public trade and membership directories. We do not take over the names of employees; we write to the company, at most with a function such as “management”.

Purpose and legal basis: we want to win partners for PortoDoc. The legal basis is our legitimate interest in direct marketing (Art. 6(1)(f) GDPR, recital 47).

Channels: we write to companies in Germany and in the EU by letter only. We also write by e-mail to companies outside the EU, for example in the United Kingdom, the USA, Canada or Australia, only to a general address that the company has published itself, and only where the law of the recipient’s country allows this without consent. Each company receives no more than three messages, for example a letter, an e-mail following the letter and a second letter. Each message is marked as advertising. Our e-mails contain no tracking pixels; the link in them carries campaign tags (section 16).

Sending: we print letters ourselves and send them with Deutsche Post. We send and receive e-mails through our mailbox support@portodoc.de at Hostinger (section 10).

Objection: anyone can object to being contacted at any time, informally by replying to our e-mail (for example with “unsubscribe”), by e-mail to support@portodoc.de or by letter to our address (Art. 21(2) GDPR). We then enter the company in our block list, with company name, address or e-mail address or domain, date and channel of the objection, and no longer contact it by any channel (Art. 21(3) GDPR). We need the block list to respect the objection permanently.

Storage period: we keep the details in the contact list while we are in contact and for at most 24 months afterwards, so that we do not write to the same company again. If the company becomes a partner, we keep its details for the partnership. We keep the block list for as long as we write to companies. We keep replies for as long as the conversation continues; if they concern the conclusion of a contract, as business letters for 6 years (section 257 of the German Commercial Code, § 257 HGB).

18. Our pages on Facebook and Instagram

Under the name “PortoDoc” we operate a Facebook page and an Instagram account. For users in the EU, the provider of both platforms is Meta Platforms Ireland Limited, Dublin, Ireland (“Meta”).

Processing by Meta: when you visit our pages, interact with them or write to us there, Meta processes personal data under its own rules: Facebook’s privacy policy https://www.facebook.com/privacy/policy, Instagram’s https://privacycenter.instagram.com/policy. If Meta stores or reads information on your device for this, Meta obtains the necessary consent itself (section 25(1) TDDDG, Art. 6(1)(a) GDPR).

Page statistics of the Facebook page (Insights): Meta compiles aggregated statistics on the use of our Facebook page for us. We are jointly responsible with Meta for this processing (Art. 26 GDPR). The agreement on this is the Page Insights Controller Addendum (https://www.facebook.com/legal/terms/page_controller_addendum); its essence is set out at https://www.facebook.com/legal/terms/information_about_page_insights_data. Under it, Meta bears primary responsibility, in particular for informing data subjects (Art. 12 and 13 GDPR), their rights (Art. 15 to 21 GDPR) and the security of the data (Art. 32 to 34 GDPR).

Statistics of the Instagram account: Meta also compiles statistics for our Instagram account. Meta has not published a separate agreement under Art. 26 GDPR for this; we treat these statistics like those of the Facebook page. On both platforms we only see aggregated figures, no data on individual persons, and we do not build audiences from visitors.

Purpose and legal basis: we use the pages to inform about PortoDoc and to stay in contact with interested parties and partners. The legal basis is our legitimate interest in this public relations work (Art. 6(1)(f) GDPR).

Messages and comments: if you write to us there, we process your profile name and the content in order to reply (Art. 6(1)(b) GDPR if it concerns a contract, otherwise point (f)). We only transfer these data to other systems if this is necessary for the reply.

Transfer to the USA: Meta may transfer data to the USA; see section 11.

Your rights: you can exercise your rights (section 13) with us and with Meta. It is quickest with Meta, because only Meta has access to the data; we forward requests to us concerning the statistics to Meta within seven days. You can object at any time to processing based on legitimate interests (Art. 21 GDPR).

19. Our company page on LinkedIn

Under the name “PortoDoc” we operate a company page on LinkedIn. For users in the EU, the provider is LinkedIn Ireland Unlimited Company, Dublin, Ireland (“LinkedIn”). LinkedIn processes visitors’ data under its own rules: https://www.linkedin.com/legal/privacy-policy.

Page statistics (Page Insights): LinkedIn compiles aggregated statistics on the visitors and followers of our page for us. We are jointly responsible with LinkedIn for this (Art. 26 GDPR). The agreement on this is the Page Insights Joint Controller Addendum (https://www.linkedin.com/legal/l/page-joint-controller-addendum). Under it, LinkedIn fulfils the obligations under the GDPR for this processing, in particular on informing data subjects and on their rights (Art. 12 to 22 GDPR) and on the security of the data (Art. 32 to 34 GDPR). We only see aggregated figures, no data on individual persons.

Purpose and legal basis, messages and comments: as in section 18. LinkedIn may transfer data to the USA; see section 11.

Your rights: you can exercise your rights (section 13) with us and with LinkedIn. We forward requests to us concerning the page statistics to LinkedIn within three working days. You can object at any time to processing based on legitimate interests (Art. 21 GDPR).