Privacy notice

1. Controller and contact

RHEINA UG (haftungsbeschränkt), Bahnhofstraße 32, 40764 Langenfeld, Germany, represented by managing director Mehmet Tuncay Tas, is the controller for account, contract, billing, security and operation data processing connected with DPP Direct. DPP Direct is the product brand. Contact: support@dpp.direct.

2. Data processed

Depending on use, we process email addresses, display names, password hashes, verification and session data; workspace, role, invitation and audit information; product fields, published information, versions and uploaded documents; technical connection and security information such as IP addresses, timestamps and access/error logs; and contract, payment, invoice and subscription information where paid functions are enabled and used.

Enterprise enquiries contain company name, work email and requested capacity. Cancellation and withdrawal notices contain the submitted contact and contract details, declaration, receipt and handling records.

Free-publication review uses submitted business/identity evidence, evidence type, findings, reasons and objections. A verified business identity can be compared with existing Free entitlements. Businesses without registry entries have a manual evidence and appeal route. Name, email domain, IP address or device alone is not conclusive business identity; review does not prevent every false statement.

3. Purposes and legal bases

Data are processed to establish and protect accounts, provide software, administer workspaces and permissions, publish expressly released passport information, answer enquiries, handle cancellation/withdrawal, bill, meet legal obligations and prevent abuse. Depending on the processing, the bases are Article 6(1)(b) GDPR for contractual/precontractual steps, Article 6(1)(c) for legal duties and Article 6(1)(f) for legitimate interests, including security, abuse prevention and evidence of proper handling.

Customers placing other people’s information in passports/documents must ensure a lawful basis and required notices.

Free review allocates the free publication entitlement and supports proportionate abuse prevention. Authorised people review decisions and objections may be submitted for reconsideration. Only necessary business evidence should be submitted, not unnecessary identity-document, card or personal tax information.

4. Public passport information

Only fields and versions released by an authorised user are available through public passport pages or QR codes. Anyone with a link or QR can access a public page. Do not publish confidential information or personal information unsuitable for disclosure. Archiving does not disable public access: previously published versions remain accessible with an archive notice at their original URLs and QR codes. Contact support@dpp.direct for accidentally published personal data or data-subject requests; required measures are reviewed separately. Third-party copies and screenshots cannot reliably be recalled.

Where customer product/document content is stored, checked, backed up or served solely on customer instructions, the customer can be controller and RHEINA UG processor. Agreed processing terms apply.

5. Recipients and providers

The application and PostgreSQL run on the operator’s Contabo VPS. Operational email is sent through Resend. Stripe is used for payments and subscriptions when that function is enabled. The configured support address forwards messages through IONOS to a Gmail mailbox. The backup configuration provides for an encrypted external Restic repository; its provider and region must be established from account records. PostgreSQL and ClamAV are self-hosted software, not separate external recipients. No exclusively EEA-based processing is promised.

Transfers outside the EEA must meet GDPR Chapter V requirements, including an applicable adequacy decision or appropriate safeguards where required.

6. Retention

Personal data are kept only as long as needed for their purposes. Account information is generally held during the account/contract relationship. Contract, invoice and tax records are retained as required by applicable law. Security, audit, cancellation and withdrawal evidence is retained as needed for security, handling, legal defence and statutory duties. Data are then deleted or restricted where required. Backup copies can remain until the relevant backup cycle expires.

Requests for data return and deletion are currently reviewed and handled manually through support. Removing a team role does not automatically delete contract, review or version history. Technical session or link expiry does not promise complete deletion of all related records.

7. Cookies and security

A technically necessary session cookie supports sign-in and session management. It has HttpOnly and SameSite attributes and Secure in production. This notice does not represent non-essential analytics/advertising cookies as included features. Appropriate technical and organisational measures protect against loss, unauthorised access and disclosure.

8. Rights

Subject to statutory conditions, you have rights of access, correction, erasure, restriction, portability and objection to processing based on legitimate interests. Consent can be withdrawn for the future. Send requests to support@dpp.direct. Where RHEINA UG acts solely on a customer’s instructions, relevant requests are referred to that controller and assistance follows the agreement.

You may complain to a data protection supervisory authority. For North Rhine-Westphalia this is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW).

9. Required information and changes

Some information is required to create an account, perform a contract or handle an enquiry. Without it the relevant function may not be available. We update the notice when processing or legal requirements materially change.