Privacy Policy

1. Data Controller

ISN GmbH
Wegwitz 18
06258 Schkopau
Email: datenschutz@isn-systems.com

2. Overview of Data Processing

Types of data processed

• Master data (e.g. names, addresses)
• Contact data (e.g. email, phone)
• Content data (e.g. form inputs)
• Usage data (e.g. pages visited, access time)
• Meta/communication data (e.g. IP addresses, browser type)
• Contract data (e.g. subject matter, duration)
• Payment data (e.g. bank details, invoices)

3. Legal Bases

• Consent (Art. 6(1)(a) GDPR) — e.g. for cookies and newsletters
• Contract Performance (Art. 6(1)(b) GDPR) — e.g. hosting, SaaS services
• Legal Obligation (Art. 6(1)(c) GDPR) — e.g. retention requirements
• Legitimate Interests (Art. 6(1)(f) GDPR) — e.g. IT security

4. Security Measures

We implement technical and organisational measures pursuant to Art. 32 GDPR:

• Encryption of all data transmissions (TLS/HTTPS)
• Server location: Germany (Hetzner, Falkenstein/Nuremberg)
• Access control and authorisation management
• Regular backups and recovery testing
• Intrusion detection and web application firewall
• Two-factor authentication for all user accounts

5. Hosting and Infrastructure

Our services are operated on dedicated servers at Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany). No data is transferred to third countries.

Data Processing: A data processing agreement (DPA) pursuant to Art. 28 GDPR is in place with Hetzner.

6. Cookies and Consent

We use cookies in accordance with § 25 TDDDG (German Telecommunications Digital Services Data Protection Act):

Technically Necessary Cookies

• x-theme — Stores the selected colour scheme setting (light/dark). localStorage, unlimited.
• xynap-lang — Stores your language selection. localStorage, unlimited.

Analytics Cookies

We currently do not use any analytics or marketing cookies.

7. Server Log Files

The following data is automatically recorded with each access:

• IP address (anonymised after 7 days)
• Date and time, requested URL, referrer
• Browser type and operating system

Legal basis: Art. 6(1)(f) GDPR. Log files are deleted after 30 days.

8. Registration and Customer Accounts

Upon registration, we collect: email address, display name, password (bcrypt-encrypted). Optional: company name, address, phone number.

Legal basis: Art. 6(1)(b) GDPR (contract performance).

9. Contact Requests

Your information is processed to handle the enquiry. Legal basis: Art. 6(1)(b)/(f) GDPR.

10. Your Rights

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction (Art. 18 GDPR)
• Data Portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR)
• Withdrawal of Consent (Art. 7(3) GDPR)

Requests to: datenschutz@isn-systems.com

11. Right to Lodge a Complaint

State Commissioner for Data Protection of Saxony-Anhalt
Leiterstraße 9, 39104 Magdeburg
Phone: +49 391 81803-0
Email: poststelle@lfd.sachsen-anhalt.de