Privacy Policy

1. Controller

The controller for handwerkrechnung.de and app.handwerkrechnung.de is the company identified in the Legal Notice.

Gexiro Global Enterprises Ltd
Eurotowers, 2 Europort Rd
GX11 1AA Gibraltar
E-Mail: [email protected]

2. Hosting and technical platform

The service runs on a dedicated origin server. Application and customer data is processed in PostgreSQL, short-lived rate-limit and state data in Redis, and uploaded documents and files in MinIO. Operations, troubleshooting and recovery include technical logs and backups.

3. Data processed

Depending on use, we process account, contact, business, customer, invoice, payment, document, usage, device and log data, including IP address, time, URL, HTTP headers and user agent. Processing supports contract performance, pre-contract communication, legal obligations and secure operations.

4. Cookies and local storage

The application uses technically required authentication, session and security cookies. Functional data such as offline queues, timers and interface preferences is also stored locally in the browser.

5. Contact form

The contact form processes name, email address, optional company, message, IP address and user agent. The message is delivered through the local mail server and processed in the destination mailbox. The legal bases are Art. 6(1)(b) and (f) GDPR.

6. Analytics

No separate web analytics or advertising tracker was identified in the audited production version. Security, access and error logs are nevertheless processed for operations, abuse prevention and diagnostics.

7. Cloudflare

Cloudflare provides CDN, DNS, WAF and DDoS protection and processes IP addresses, HTTP headers and security signals. The legal basis is Art. 6(1)(f) GDPR. Cloudflare applies its stated transfer mechanisms where data is processed outside the EEA.

8. Cloudflare Turnstile

Cloudflare Turnstile protects contact, login and registration functions against automated abuse. Technical connection, browser and interaction signals are sent to Cloudflare. The legal basis is Art. 6(1)(f) GDPR.

9. Stripe

Payments and subscriptions are handled by Stripe Payments Europe, Ltd. Stripe processes payment and billing data in its own responsibility and as a technical payment provider. We do not store full card details. The legal basis is Art. 6(1)(b) GDPR. The contracting party is the company named in the Legal Notice.

10. Email processing

Outgoing transactional and contact email is sent through the operator’s own SMTP service. The published mailbox is technically forwarded to an external mailbox provider, where sender, recipient, content and delivery data is processed.

11. Retention and backups

There is no blanket automatic seven-day deletion. Personal data is retained according to purpose, contract duration, legal retention duties, security and evidentiary needs. PostgreSQL and file backups and logs have their own backup and rotation cycles, after which data is deleted or overwritten unless further retention is required.

12. Security

We use TLS, access controls, security headers, network filtering, rate limits, backups and other technical and organisational measures under Art. 32 GDPR. Absolute security cannot be guaranteed.

13. Rights

Subject to the GDPR, data subjects have rights including access, rectification, erasure, restriction, portability and objection. Contact: [email protected]. Complaints may be submitted to a competent authority or the Gibraltar Regulatory Authority.