This is a convenience translation. In case of doubt, the authoritative German version prevails.
This privacy notice relates exclusively to the processing of registration and license data as well as support reports that you submit from the application by evanto as the controller (Art. 13/14 GDPR). It does not relate to the content that the Customer processes within the Software — such content remains the Customer's responsibility. For the Managed add-on, the Data Processing Agreement (Managed) applies in addition.
As of: 4 October 2026
1. Controller
evanto media GmbH, Brunnstraße 25, 93053 Regensburg, Germany · Email: kontakt@evanto.de · Phone: +49 941 94592-0 · Local Court (Amtsgericht) Regensburg, HRB 18746; VAT ID DE209538293; Managing Directors: Dipl.-Ing. Ralf Manschewski, Dr. Sven von Känel. Data protection contact: datenschutz@evanto.de; Data Protection Officer (appointed internally): Ute Manschewski, reachable at datenschutz@evanto.de.
2. Subject
We process personal data that arises in connection with the registration, activation, license verification and, where applicable, billing of CompanyWizard. Content that you use within the Software (chats, documents, knowledge base) is not processed by us in self-hosted use. Excluded are support reports that you yourself submit from the application (Section 3); these may contain excerpts from the local log.
3. Data Processed, Purposes and Legal Bases
| Purpose | Data categories | Legal basis |
|---|---|---|
| Registration & provision of the Free edition | Email address, company name | Art. 6(1)(b) GDPR (pre-contractual / contract) |
| Double opt-in confirmation | Email address, time of confirmation, proof of consent | Art. 6(1)(a) (consent) and (f) (proof) |
| Activation & license verification | Hashed device fingerprint, IP address, check-in timestamp, license/activation ID | Art. 6(1)(b) and (f) (license enforcement, abuse prevention) |
| Billing of paid editions | Contract/invoice data, contact person | Art. 6(1)(b) and (c) (legal obligations) |
| Communication & support | Contact and case data | Art. 6(1)(b) and (f) |
| Support reports from the application | Report text, type of report, contact email, diagnostic data, log summary, where applicable the full log, license identifier, company name | Art. 6(1)(a) and (b) |
Support reports. When you submit a report in CompanyWizard, we transmit the data listed above to our support service, based on your explicit consent given for each report. For initial triage we use an AI model via Cortecs GmbH (EU/EEA, without storage of the content); the decision is always made by an employee.
Legitimate interest (point (f)): ensuring license-compliant use, protection against multiple use/abuse, operation and security of the license service.
4. Recipients / Processors
- Email dispatch / double opt-in / notifications about support reports: Brevo (EU) — as a processor.
- AI triage of support reports: Cortecs GmbH (EU/EEA) — as a processor.
- Billing: internal; no disclosure to external service providers.
- Monitoring / error tracking: Sentry (EU region) — as a processor, insofar as the license backend is also monitored.
- Hosting of the license and support service: evanto's own infrastructure (R-KOM GmbH data center, Regensburg) within the EU/EEA.
Agreements pursuant to Art. 28 GDPR are in place with processors.
5. Transfers to Third Countries
Processing generally takes place within the EU/EEA. If, in individual cases, a transfer to a third country occurs, this is done only on the basis of Art. 44 et seq. GDPR (adequacy decision or appropriate safeguards).
6. Storage Period
- Registration/license data: for the duration of the license and up to 90 days thereafter (reactivation, abuse protection), then deletion.
- Activation/device objects: deletion no later than 90 days after the license ends.
- Billing/accounting data: statutory retention periods (generally up to 10 years; Sections 147 of the German Fiscal Code (AO) and 257 of the German Commercial Code (HGB)).
- Consent records (DOI): until revocation plus an appropriate proof-retention period.
- Support reports: log attachments are deleted 90 days after the report is closed; contact details and message contents are anonymized 24 months after the last activity.
7. Obligation to Provide Data
Providing the registration and activation data is necessary for using the Software. Without this data, the Software cannot be activated/used.
8. No Automated Decision-Making
There is no solely automated decision-making, including profiling, within the meaning of Art. 22 GDPR.
9. Your Rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and the right to object to processing based on legitimate interests (Art. 21). You may withdraw any consent given at any time with effect for the future (Art. 7(3)). You also have the right to lodge a complaint with a supervisory authority (Art. 77); the competent authority includes the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.
To exercise your rights, contact: evanto media GmbH, Brunnstraße 25, 93053 Regensburg, Germany, email kontakt@evanto.de.