Thank you for your interest in our company. Protecting personal data is a high priority for the management of Tiprax GmbH. In general, you can use our website without providing personal information. However, processing personal data may be necessary if you wish to use particular services through our website. Where processing is necessary and no other legal basis applies, we generally obtain your consent.
We process personal data, such as names, addresses, email addresses and telephone numbers, in accordance with the General Data Protection Regulation (GDPR) and the data protection legislation applicable to Tiprax GmbH. This Privacy Policy explains the nature, scope and purposes of the personal data we collect, use and process, and informs you of your rights.
As controller, Tiprax GmbH has implemented technical and organisational measures to protect personal data processed through this website as comprehensively as possible. Nevertheless, internet-based data transmission may have security vulnerabilities, and absolute protection cannot be guaranteed. You may therefore choose alternative ways of providing personal data to us, for example by telephone.
1. Definitions
This Privacy Policy uses the terminology of the GDPR. The following explanations are intended to make it readily understandable to the public, our customers and our business partners.
a) Personal data
Personal data means any information relating to an identified or identifiable natural person (the “data subject”). A person is identifiable if they can be identified directly or indirectly, particularly by reference to an identifier such as a name, identification number, location data or online identifier, or to factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.
b) Data subject
A data subject is an identified or identifiable natural person whose personal data is processed by the controller.
c) Processing
Processing means any operation or set of operations performed on personal data, whether or not by automated means. This includes collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
d) Restriction of processing
Restriction of processing means marking stored personal data with the aim of limiting its future processing.
e) Profiling
Profiling means any form of automated processing of personal data used to evaluate personal aspects of a natural person, particularly to analyse or predict their performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
f) Pseudonymisation
Pseudonymisation means processing personal data so that it can no longer be attributed to a specific data subject without additional information, provided that this additional information is kept separately and protected by technical and organisational measures preventing attribution to an identified or identifiable natural person.
g) Controller
A controller is a natural or legal person, public authority, agency or other body that, alone or jointly with others, determines the purposes and means of processing personal data. Where these purposes and means are determined by EU or Member State law, that law may specify the controller or the criteria for appointing the controller.
h) Processor
A processor is a natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller.
i) Recipient
A recipient is a natural or legal person, public authority, agency or other body to which personal data is disclosed, whether or not it is a third party. Public authorities that may receive personal data in the context of a particular inquiry under EU or Member State law are not regarded as recipients.
j) Third party
A third party is a natural or legal person, public authority, agency or body other than the data subject, controller, processor or persons authorised to process personal data under the direct authority of the controller or processor.
k) Consent
Consent is a freely given, specific, informed and unambiguous indication of the data subject’s wishes, expressed through a statement or clear affirmative action, signifying agreement to the processing of their personal data.
2. Name and address of the controller
The controller for the purposes of the GDPR and other applicable data protection legislation is:
Tiprax GmbH
Mendelssohn-Bartholdy-Str. 15
14480 Potsdam
Germany
Email: info@digiprax.com
Website: www.digiprax.com
Contact for data protection enquiries
Daniel Kania
Email: Daniel.Kania@digiprax.com
3. Cookies and similar technologies
We only use cookies and comparable storage functions that are necessary to provide the features you request, particularly sign-in functions and storage of your language preference. We do not use tracking services, advertising pixels or newsletter services.
Where storing or accessing information is strictly necessary to provide a feature you explicitly request, the legal basis is section 25(2), no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG). Subsequent processing of personal data is based on Article 6(1)(b) GDPR where necessary for a contract or steps prior to entering into a contract; otherwise, it is based on our legitimate interest in providing a secure, functional website under Article 6(1)(f) GDPR.
The cookie storing your language preference expires after no more than 30 days. Sign-in cookies generally last for the current session. If you explicitly select “Remember me”, they last for no more than 14 days.
You can delete or block cookies in your browser settings. This may restrict some features.
4. Website hosting and server logs
Our website is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. This information concerns the website; the registration system and the DigiPrax application are separate services.
When you access the website, technically necessary connection and access data is processed. This may include your IP address, access time, requested page, browser type and version, operating system and previously visited page. Processing serves to deliver the website, analyse errors and prevent misuse and attacks.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the website. IONOS processes the data required for hosting as a technical service provider.
IONOS retains server logs for a maximum of eight weeks. We do not maintain an additional permanent archive of these logs.
5. Requesting and using a free trial account
When you request a trial account, we process the practice and contact details you provide and the credentials required for your user account. The form transmits this information over an encrypted connection to our registration system at admin.digiprax.com. Your email address serves as your username.
The registration system is operated by Tiprax GmbH and hosted by SysEleven GmbH. As technical hosting provider, SysEleven is involved in processing the data necessary to operate the registration system.
We process this data to handle your request, create and provide your trial account, and communicate with you about its use. Where you are personally the contracting party, the legal basis is Article 6(1)(b) GDPR. For contact persons at a practice or company, processing is based on Article 6(1)(f) GDPR; our legitimate interest is handling the business enquiry and providing account support.
The free trial ends 30 days after activation, after which access is blocked. It does not automatically convert into a paid subscription. Paid use requires a separate, explicit order.
We delete unactivated trial requests after 30 days. If no subsequent contract is concluded, we delete the trial account and associated trial data no later than 30 days after the trial ends. Statutory retention requirements remain unaffected; any data concerned is retained solely for those purposes.
Please use fictitious patient data only during the trial. Do not enter patient data in the registration form.
6. Contacting us
If you contact us by email, we process your contact details and the contents of your message to respond to your enquiry. The legal basis is Article 6(1)(b) GDPR where the enquiry concerns a contract or steps prior to entering into a contract. For other enquiries, the legal basis is Article 6(1)(f) GDPR; our legitimate interest is responding appropriately to your enquiry.
We delete general contact enquiries no later than six months after they have been fully dealt with. Contract-related correspondence and documents subject to statutory retention requirements are handled separately in accordance with the applicable retention obligations.
7. Routine erasure and restriction of personal data
The controller processes and stores personal data only for as long as necessary to fulfil the purpose of storage, or for as long as required by EU legislation or other laws and regulations to which the controller is subject.
When the purpose of storage no longer applies, or a legally prescribed retention period expires, personal data is routinely restricted or erased in accordance with the applicable law.
8. Your rights as a data subject
a) Right to confirmation
You have the right to obtain confirmation from the controller as to whether personal data concerning you is being processed. To exercise this right, you may contact a member of the controller’s team at any time.
b) Right of access
You have the right to obtain, free of charge, information about the personal data stored about you and a copy of that information. This includes information about:
- the purposes of processing;
- the categories of personal data being processed;
- the recipients or categories of recipients to whom personal data has been or will be disclosed, particularly recipients in third countries or international organisations;
- where possible, the intended retention period or, if this cannot be specified, the criteria used to determine it;
- the existence of the right to rectification or erasure, restriction of processing, or objection to processing;
- the right to lodge a complaint with a supervisory authority;
- where the data was not collected from you, any available information about its source;
- the existence of automated decision-making, including profiling, under Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved and the significance and envisaged consequences of that processing for you.
You are also entitled to information about whether personal data has been transferred to a third country or an international organisation and, if so, about the appropriate safeguards relating to that transfer. You may contact a member of the controller’s team at any time to exercise your right of access.
c) Right to rectification
You have the right to have inaccurate personal data concerning you corrected without undue delay. Taking account of the purposes of processing, you also have the right to have incomplete personal data completed, including by providing a supplementary statement. You may contact a member of the controller’s team at any time to exercise this right.
d) Right to erasure (“right to be forgotten”)
You have the right to request erasure of personal data concerning you without undue delay where any of the following grounds applies and processing is not necessary:
- The data is no longer needed for the purposes for which it was collected or otherwise processed.
- You withdraw consent on which processing was based under Article 6(1)(a) or Article 9(2)(a) GDPR, and no other legal basis applies.
- You object under Article 21(1) GDPR and there are no overriding legitimate grounds for processing, or you object under Article 21(2) GDPR.
- The data has been processed unlawfully.
- Erasure is necessary to comply with a legal obligation under EU or Member State law applicable to the controller.
- The data was collected in connection with information society services offered under Article 8(1) GDPR.
If any of these grounds applies and you wish to have data held by Tiprax GmbH erased, you may contact a member of our team at any time. They will arrange for the erasure request to be addressed without undue delay.
If Tiprax GmbH has made personal data public and is required to erase it under Article 17(1) GDPR, we take reasonable steps, including technical measures, taking account of available technology and implementation costs, to inform other controllers processing that data that you have requested erasure of links to, or copies or replications of, that data, insofar as processing is not necessary. Our team will take the steps required in the individual case.
e) Right to restriction of processing
You have the right to request restriction of processing where:
- You contest the accuracy of the data, for a period enabling the controller to verify its accuracy.
- Processing is unlawful, but you oppose erasure and request restriction of use instead.
- The controller no longer needs the data for its processing purposes, but you need it to establish, exercise or defend legal claims.
- You have objected under Article 21(1) GDPR and verification of whether the controller’s legitimate grounds override yours is pending.
If any of these conditions applies, you may contact a member of Tiprax GmbH’s team at any time to request restriction. They will arrange for the processing to be restricted.
f) Right to data portability
You have the right to receive personal data concerning you that you have provided to a controller in a structured, commonly used and machine-readable format. You also have the right to transmit that data to another controller without hindrance where processing is based on consent under Article 6(1)(a) or Article 9(2)(a) GDPR, or on a contract under Article 6(1)(b) GDPR, and is carried out by automated means. This does not apply where processing is necessary for a task carried out in the public interest or in the exercise of official authority vested in the controller.
When exercising this right under Article 20(1) GDPR, you may also have the data transmitted directly from one controller to another where technically feasible and provided this does not adversely affect the rights and freedoms of others. To exercise this right, you may contact a member of Tiprax GmbH’s team at any time.
g) Right to object
You may object at any time, on grounds relating to your particular situation, to processing of your personal data based on Article 6(1)(e) or (f) GDPR, including profiling based on those provisions.
Following an objection, Tiprax GmbH will no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or processing is required to establish, exercise or defend legal claims.
If Tiprax GmbH processes personal data for direct marketing, you may object to that processing at any time, including profiling related to such marketing. Following your objection, we will no longer process your personal data for those purposes.
You may also object, on grounds relating to your particular situation, to processing by Tiprax GmbH for scientific or historical research or statistical purposes under Article 89(1) GDPR, unless processing is necessary for a task carried out for reasons of public interest.
You may contact our team to exercise your right to object. In the context of information society services, and notwithstanding Directive 2002/58/EC, you may also exercise this right by automated means using technical specifications.
h) Automated individual decision-making, including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you. Exceptions apply where the decision is necessary for entering into or performing a contract between you and the controller; is authorised by EU or Member State law applicable to the controller that provides appropriate safeguards for your rights, freedoms and legitimate interests; or is based on your explicit consent.
Where such a decision is necessary for entering into or performing a contract, or is based on explicit consent, Tiprax GmbH implements appropriate safeguards. These include, at a minimum, the right to obtain human intervention by the controller, express your point of view and contest the decision. You may contact a member of the controller’s team at any time to exercise rights relating to automated decisions.
i) Right to withdraw consent
You may withdraw your consent to the processing of personal data at any time. To exercise this right, you may contact a member of the controller’s team at any time.
9. Link to Facebook
Our website contains a link to our Facebook page. It is a link, not an embedded Facebook component. You only leave our website and access Facebook when you follow that link.
10. No tracking or newsletters
We do not use tracking services on this website. In particular, we do not use Google Analytics, Google Ads conversion tracking or the Facebook pixel. We do not offer a newsletter or use newsletter services.
11. Legal bases
The legal bases for individual processing activities are specified in the relevant sections of this Privacy Policy. We process data to handle trial requests and perform contracts, operate our services securely and respond to contact enquiries. Where statutory retention obligations apply, the processing necessary to fulfil them is based on Article 6(1)(c) GDPR.
12. Legitimate interests
Our legitimate interests are the secure and reliable provision of our website, prevention of misuse, handling business enquiries and supporting our customers’ contact persons. The relevant purposes are described in the sections above.
13. Retention, erasure and backups
The periods specified above apply to server logs, trial requests, trial accounts and contact enquiries. We retain other personal data only for as long as required for the relevant processing purpose or by statutory retention obligations.
Backups of databases and files are deleted or overwritten within 30 days at the latest. Data already deleted from active systems may remain in backups until then. Access is restricted to authorised persons. Backups are used solely for restoration. If a backup is restored, deletions made in the meantime are reapplied. Statutory retention obligations for individual documents remain unaffected. The server log retention period in section 4 is separate from this backup cycle.
14. Information required for trial registration
Required fields are marked in the registration form. We use the information to process your request and set up your trial account. We cannot provide a trial account without the information necessary to do so. Optional information is identified as such.
15. Automated decision-making
As a responsible company, we do not use automated decision-making or profiling.
The original version was based on the generator identified below. It was subsequently adapted for DigiPrax. These adaptations have not thereby been reviewed or approved by the providers or individuals named below.
This Privacy Policy was originally generated using the privacy policy generator of DGD Deutsche Gesellschaft für Datenschutz GmbH, which provides external data protection officer services in Dachau, in cooperation with data protection lawyer Christian Solmecke.