Privacy Policy

1. Privacy at a Glance

General Information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to personally identify you. Detailed information on data protection can be found in our privacy policy below.

Data Collection on This Website

Who is responsible for data collection on this website?
Data processing on this website is carried out by the website operator. You can find their contact details in the legal notice of this website.

How do we collect your data?

You do not have to provide any personal data of your own accord in order to visit this website. The website can be used without registering and without providing personal data.

For technical reasons, however, data is transmitted to our hosting provider (Vercel) and processed there each time you access the website — for example your IP address, browser type and version, and other technical parameters. An IP address constitutes personal data. This data is used solely for the operation and security of the website; we do not combine it with other data sources and do not use it to identify you as a person.

Log data retention period: Server and access logs collected by Vercel (including IP addresses) are stored only for as long as is necessary to ensure the secure and uninterrupted operation of the website, and are deleted thereafter. Processing is based on our legitimate interest in the technical security and functionality of the website (Art. 6(1)(f) GDPR).

What do we use your data for?

The technical data collected by the hosting provider (Vercel) is used to provide and securely operate the website.

What rights do you have regarding your data?

You have the right to receive free information about the origin, recipient, and purpose of your stored personal data at any time. You also have the right to request the correction or deletion of this data. If you have given consent to data processing, you can revoke this consent at any time for the future.

Please note that we do not collect any personal data except through your direct communication with us via email or our contact form.

SSL or TLS Encryption

This site uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content, such as inquiries you send to us as the site operator. You can recognize an encrypted connection by the browser's address bar changing from "http://" to "https://" and by the lock symbol in your browser bar.

When SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

2. Hosting

External Hosting

This website is hosted by an external service provider. Personal data collected on this website (e.g., IP addresses, contact requests, meta and communication data, contract data, contact details, names, website accesses, and other generated data) is processed on the infrastructure of
Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA
The provider's privacy contact is: privacy@vercel.com

This website is delivered via Vercel's global edge network. Your data may therefore also be processed outside the European Union, in particular in the USA.

The use of this service provider is

• to fulfill our contractual obligations to potential and existing customers (Art. 6(1)(b) GDPR) and
• in the interest of secure, fast, and efficient provision of our online offer by professional providers (Art. 6(1)(f) GDPR).

We have concluded a data processing agreement with Vercel Inc. in accordance with Art. 28 GDPR. Vercel processes your data only according to our instructions and takes appropriate technical and organizational measures to protect your data; the provider is certified under ISO 27001 and SOC 2 Type 2, among others.

Third country transfer: Vercel Inc. is a US company. Vercel Inc. is certified under the EU-U.S. Data Privacy Framework (DPF) and has declared to the U.S. Department of Commerce that it adheres to the DPF principles. Data transfer to the USA is therefore based on the adequacy decision of the European Commission pursuant to Art. 45 GDPR. You can view the certification in the official DPF list:

DPF list: https://www.dataprivacyframework.gov/list

The Data Processing Agreement and the provider's privacy policy can be found here:

Data Processing Agreement (DPA): https://vercel.com/legal/dpa
Vercel privacy notice: https://vercel.com/legal/privacy-notice

3. General Information and Mandatory Information

Data Protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy.

If you visit this website for informational purposes only, we process personal data solely to the extent required for the technical provision and security of the website (in particular the server logs described above). We process personal data beyond that only if you actively provide it to us — for example when you contact us via the provided contact options (e.g., by email) — or if you have consented to further processing.

Notice Regarding the Responsible Party

The responsible party for data processing on this website is:

Balane GmbH
Balanstraße 84
81541 Munich, Germany
Managing Director: Jonas David Höttler

Email: contact@balane.tech

The responsible party is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data.

4. Data Collection on This Website

Cookies

We use cookies and similar technologies on this website. On your first visit to our website, you will be asked for your consent via a cookie banner. You can revoke or adjust your consent at any time via the cookie settings.

Categories of Cookies:

• Necessary Cookies: These cookies are required for basic website functions and cannot be disabled.
• Functional Cookies: Enable enhanced functionality and personalization (only with consent).
• Analytics Cookies: Help us understand how visitors interact with our website (only with consent).
• Marketing Cookies: Used to personalize content and for marketing purposes (only with consent).

Cookies in the Support Portal: Our ticket/support system (accessible at support.balane.tech) uses technically necessary session cookies for authentication of logged-in users. These cookies are required for the functionality of the support portal and are automatically deleted at the end of the browser session or upon session expiry. The legal basis for these technically necessary cookies is Art. 6(1)(f) GDPR (legitimate interest in providing a functional support system).

Web Fonts

This website uses the "Inter" font from Google Fonts. The fonts are hosted locally on our servers (self-hosting). There is no connection to Google servers and no transmission of your IP address to Google when visiting this website.

Web Analytics (Umami)

We use Umami, a privacy-friendly, self-hosted open-source web analytics solution to collect anonymous usage statistics.

Privacy-friendly features of Umami:

• No cookies:Umami does not set cookies and does not store any data in your device's browser
• IP address is not stored: For technical reasons your IP address is transmitted to our server. There it is used exclusively to derive an anonymous identifier (hash) and is not stored.
• No user profiles: No user profiles are created and no data is merged with other data sources
• No cross-site tracking: No recognition across sessions or across different websites
• No consent required: Since Umami neither stores nor accesses information on your device, no consent pursuant to § 25 TTDSG/DDG is required

What data is collected?

• Visited pages (URL)
• Referrer (which page you came from)
• Country (derived, not stored)
• Device type (Desktop/Mobile)
• Browser and operating system
• Screen resolution

Legal basis: Processing is based on our legitimate interest in analyzing and optimizing our website pursuant to Art. 6(1)(f) GDPR. Since Umami does not set cookies and neither stores nor accesses information on your device, no consent pursuant to § 25(1) TTDSG/DDG is required. The IP address transmitted for technical reasons when a page is called up is used exclusively to derive an anonymous identifier and is not stored.

Hosting and data processing:

• System: Umami (Open Source Web Analytics)
• Hosting: Self-hosted by Balane GmbH
• Infrastructure provider (sub-processor): Railway Inc., 548 Market St #73394, San Francisco, CA 94104, USA
• Server location: Railway's European region (EU)

Balane GmbH operates the Umami software itself. Railway Inc. merely provides the server infrastructure for this purpose and processes the data as a sub-processor. A data processing agreement pursuant to Art. 28 GDPR exists with Railway Inc.

Third country transfer: Railway Inc. is a US company. Processing of your data in the USA can therefore not be ruled out. The transfer takes place on the basis of the Standard Contractual Clauses adopted by the European Commission pursuant to Art. 46(2)(c) GDPR.

Railway privacy policy: https://railway.com/legal/privacy

Session Replay (OpenReplay)

We use OpenReplay, a self-hosted open-source session replay tool. OpenReplay helps us reproduce bugs, identify usability issues, and improve user journeys by recording a reconstructable representation of your interactions with the website.

Consent required:OpenReplay is only activated after you have given consent via our cookie/consent banner under the category "Statistics & Session Replay". Without your consent, no data is sent to OpenReplay. You can withdraw your consent at any time via the privacy settings — the recording stops immediately.

What data is collected?

• Mouse movements, clicks, scroll behavior, and keyboard interactions (as events, not as a video recording)
• DOM changes of the visited pages (structural reconstruction of the interface)
• Visited URLs and navigation path within our website
• JavaScript errors and console messages (for debugging)
• Technical data: browser, operating system, screen resolution, truncated IP address, referrer, timestamp
• A technical session ID stored exclusively in your browser's local/session storage, which does not contain any personal identifier

Protective measures for masking sensitive data (privacy by design):

• Form inputs (e.g. name, email, phone, message) are masked by default and never captured in plain text (defaultInputMode: obscured).
• Email addresses, numbers, and dates in visible text and input fields are automatically obfuscated.
• Password fields are never recorded.
• The "Do Not Track" browser header is respected (respectDoNotTrack: true) — if DNT is active, OpenReplay does not start even if consent has been given.
• Network payloads (request/response bodies) are not captured — only URLs, timing, and duration of network requests are recorded for debugging purposes.
• No third-party iframes are recorded.
• No merging with personal data from CRM, support, or contact form.

Legal basis: The storage of information on your terminal device and the access to information already stored take place exclusively on the basis of your consent pursuant to § 25(1) sentence 1 TTDSG/DDG (German implementation of the ePrivacy Directive). The subsequent processing of personal data is based on your consent pursuant to Art. 6(1)(a) GDPR.

Hosting & data processing:

• System: OpenReplay (Open Source Session Replay, version 17)
• Hosting: Self-hosted by Balane GmbH at replay.balane.tech
• Infrastructure provider (sub-processor): Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany
• Server location: Hetzner Online GmbH data centre within the EU
• No data is transferred to OpenReplay Inc. All session data remains on our infrastructure.

Balane GmbH operates the OpenReplay software itself. Hetzner Online GmbH merely provides the server infrastructure for this purpose and processes the data as a sub-processor. A data processing agreement pursuant to Art. 28 GDPR exists with Hetzner Online GmbH.

No third country transfer: Hetzner Online GmbH is a German company and operates its data centres in Germany (Nuremberg, Falkenstein) and Finland, i.e. exclusively within the European Union. Your data is not transferred to a third country.

Hetzner privacy policy: https://www.hetzner.com/de/legal/privacy-policy

Retention period: Recorded sessions are automatically deleted after a maximum of 30 days. Aggregated, non-personal analyses may be retained beyond this period.

Withdrawal:You can withdraw your consent at any time with effect for the future by opening the privacy settings (cookie banner) in the footer of our website and disabling the category "Statistics & Session Replay". The lawfulness of processing carried out until withdrawal remains unaffected.

Further information about the product can be found at openreplay.com/legal/privacy.

Inquiries by Email

If you contact us by email, your inquiry and all personal data contained therein (e.g., name, email address) will be stored and processed for the purpose of handling your inquiry. This data will not be shared with third parties unless required by law.

The processing of this data is based on Art. 6(1)(b) GDPR if your inquiry is related to the performance of a contract or is necessary for pre-contractual measures. Otherwise, processing is based on our legitimate interest in effectively handling your inquiry (Art. 6(1)(f) GDPR).

The data you send to us will remain with us until you request deletion or the purpose for data storage no longer applies (e.g., after completion of your inquiry).

Contact Form

If you send us inquiries via our contact form, your information from the inquiry form, including the contact data you provided there, will be stored by us for the purpose of processing the inquiry and for follow-up questions.

What data is collected?

• Name (required)
• Email address (required)
• Phone number (optional)
• Your message (required)
• Technical data: URL of the page from which you submitted the form, user agent (browser information), referrer, timestamp
• Context information: From which page/project/service you opened the form

Transfer to data processors: Data submitted via the contact form is delivered to us by email. For sending this notification we use a transactional email service provider:

• Email delivery: Brevo (Sendinblue SAS, 106 Boulevard Haussmann, 75008 Paris, France)
• Server location: EU
• Security measures: SSL/TLS encryption, access controls

This serves the efficient processing of customer inquiries. Processing is based on Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in efficient customer service).

Retention period: Your data will be deleted after completion of your inquiry unless statutory retention obligations exist. Upon conclusion of a contract, data will be stored in accordance with tax and commercial law retention periods (generally 6-10 years).

You can request deletion of your data at any time unless statutory retention obligations prevent this. We do not share this data without your consent.

Appointment Booking (Cal.eu)

We embed the Cal.eu scheduler on our contact page — the European Union instance of Cal.com. When you open the contact page, a connection to Cal.eu servers is established and your IP address is transmitted.

When you book an appointment, your name, email address, and the selected appointment slot are transmitted to Cal.com.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in efficient appointment scheduling) or Art. 6(1)(b) GDPR where the booking serves pre-contractual measures.

Third country transfer: No third country transfer takes place. Processing happens on servers within the European Union.

Cal.com privacy policy: https://www.cal.eu

Support/Ticket System (Zammad)

For customer support of all Balane Tech products, we operate a self-hosted ticket system based on Zammad, accessible at support.balane.tech.

What data is collected?

• Name and email address (required)
• Phone number (optional)
• Ticket content, messages, and attachments
• Communication history and ticket progress
• Technical data: IP address, user agent (browser information), timestamp

Purpose of processing: Data is used exclusively for processing your support requests, documenting customer service, and quality assurance.

Legal basis: Processing is based on Art. 6(1)(b) GDPR (contract performance or pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in providing effective customer service).

Hosting and data processing:

• System: Zammad (Open Source Helpdesk/Ticket System)
• Hosting: Self-hosted by Balane GmbH
• Infrastructure provider (sub-processor): Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany
• Server location: Hetzner Online GmbH data centre within the EU
• Security measures: SSL/TLS encryption, access controls, regular backups

Balane GmbH operates the Zammad software itself. Hetzner Online GmbH merely provides the server infrastructure for this purpose and processes the data as a sub-processor. A data processing agreement pursuant to Art. 28 GDPR exists with Hetzner Online GmbH.

No third country transfer: Hetzner Online GmbH is a German company and operates its data centres in Germany (Nuremberg, Falkenstein) and Finland, i.e. exclusively within the European Union. Your data is not transferred to a third country.

Hetzner privacy policy: https://www.hetzner.com/de/legal/privacy-policy

Email integration: Incoming support requests via email are automatically converted into tickets. Email communication is stored in the ticket system and assigned to the communication history.

User accounts in the customer portal: To use the customer portal, you can create a user account. Email address and password (stored encrypted) are collected. With a user account, you can view your tickets, track processing status, and access the communication history.

Retention period: Support tickets and related communication are stored for the duration of the business relationship. After termination of the business relationship, data is retained in accordance with statutory retention periods (generally 6-10 years) and then deleted. You can request deletion of your data at any time unless statutory retention obligations prevent this.

Automated Decision-Making

No automated decision-making including profiling within the meaning of Art. 22 GDPR takes place.

Tool Usage & Report Delivery (Maturity, Automation Check, Process Costs, Make-vs-Buy)

This website offers free interactive tools (e.g. Digitalization Maturity Assessment, Automation Check, Process Cost Calculator, Make-vs-Buy Calculator). All calculations run locally in your browser. If at the end of a tool you request the analysis as a report, we collect the following data via a form: name, email address, optionally company and phone number, the parameters you entered in the tool, and your consent checkboxes.

Purpose: Delivery of the report by email, delivery of your inquiry to our mailbox, optionally contact for a 20-minute result review (only if opt-in is set).

Legal basis: Art. 6(1)(a) GDPR (consent) for email delivery and the optional conversation opt-in; Art. 6(1)(f) GDPR (legitimate interest in processing qualified inquiries) for the delivery to our mailbox.

Processors:

• Brevo (Transactional email, formerly Sendinblue): Delivery of the report email and of the notification to our mailbox. Sendinblue SAS, 106 Boulevard Haussmann, 75008 Paris, France. Servers in the EU. More information: brevo.com/legal/privacypolicy.

Retention: Lead data is stored until consent is withdrawn or up to 3 years after last contact, then deleted or anonymized.

Note on results: All analyses and figures produced by the tools are based solely on your own inputs and serve as orientation only. They do not constitute legal or business advice, and we do not warrant the completeness or correctness of individual figures.

Withdrawal: You can withdraw your consent at any time informally by email to contact@balane.tech. The lawfulness of processing carried out until withdrawal remains unaffected.

5. Your Rights as a Data Subject

You have the following rights regarding your personal data:

Right of Access (Art. 15 GDPR)

You have the right to request confirmation as to whether personal data concerning you is being processed. If this is the case, you have the right to access this personal data and to further information (e.g., processing purposes, categories of personal data, recipients).

Right to Rectification (Art. 16 GDPR)

You have the right to request immediate rectification of inaccurate personal data concerning you. Taking into account the purposes of processing, you have the right to request completion of incomplete personal data.

Right to Erasure (Art. 17 GDPR)

You have the right to request that personal data concerning you be erased immediately if one of the legally prescribed reasons applies and the processing is not necessary.

Right to Restriction of Processing (Art. 18 GDPR)

You have the right to request restriction of processing if one of the legal conditions is met (e.g., accuracy of data is contested).

Right to Data Portability (Art. 20 GDPR)

You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format, and you have the right to transmit this data to another controller without hindrance from us.

Withdrawal of Consent (Art. 7(3) GDPR)

If the processing of your personal data is based on consent given, you have the right to withdraw consent at any time. The lawfulness of processing carried out on the basis of consent until withdrawal is not affected.

Right to Lodge a Complaint with a Supervisory Authority (Art. 77 GDPR)

You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data.

The supervisory authority responsible for us is:
Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach, Germany
Phone: +49 981 180093-0
Email: poststelle@lda.bayern.de
Website: https://www.lda.bayern.de

Contact for Data Protection Inquiries

To exercise your rights or for questions about data protection, you can contact us at any time:
Email: contact@balane.tech
Address: Balane GmbH, Balanstraße 84, 81541 Munich, Germany

Last updated: April 2026