Privacy Policy

Controller

The controller for the processing of personal data on this website within the meaning of Art. 4(7) GDPR is:

BridgeWise Consulting UG (haftungsbeschränkt) Alfred-Kästner-Straße 1
04275 Leipzig, Germany
Represented by the Managing Director: Markus Hickmann
Commercial register: Leipzig Local Court, HRB 44193 info@yostro.com

Yostro is a trade name and online platform of BridgeWise Consulting UG (haftungsbeschraenkt) and is not a separate legal entity.

We have not appointed a data protection officer; the conditions of Art. 37 GDPR and Section 38 BDSG are not met. For any questions about data protection and to exercise your rights, please contact us directly using the details above.

Overview

The following notes provide an overview of what happens to your personal data when you visit this website, use our tools or create a customer account. Personal data means any data by which you can be personally identified.

Your data reaches us in two ways. First, you provide it yourself — for example when you join the waiting list, write to us or create an account. Second, our systems automatically record certain information when you access the website, essentially technical data such as browser type, operating system and time of access.

Our offering is aimed at businesses. We therefore process mainly business contact data and no special categories of data within the meaning of Art. 9 GDPR.

Recipients of Your Data

Within our company, only those people have access to your data who need it to fulfil the respective purpose. In addition, we use carefully selected service providers. Where they process data on our behalf and on our instructions, data processing agreements pursuant to Art. 28 GDPR are in place. The payment service provider additionally processes payment data under its own responsibility.

No disclosure takes place for purposes other than those stated in this notice. To meet statutory obligations, data may be transmitted to public authorities, to our tax adviser and to our bank.

Transfers to Third Countries

Some of the service providers named above have parent companies in the United States. Where personal data is transferred to a country outside the European Union, this only takes place on one of the following bases:

• on the basis of an adequacy decision of the European Commission, in particular the EU-U.S. Data Privacy Framework, where the recipient is certified under that framework,
• on the basis of the European Commission Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR, supplemented by additional safeguards, or
• on the basis of your explicit consent.

Please note that the United States does not provide a level of protection fully equivalent to European law and that, in particular, access to the data by government authorities cannot be ruled out in every case.

Retention Periods at a Glance

We store personal data only for as long as is necessary for the respective purpose or as required by statutory retention obligations. In detail:

Where data is exempt from deletion because of a statutory retention obligation, we restrict its processing: it is kept solely for that purpose for the duration of the period and deleted thereafter.

Whether You Must Provide Data

Providing personal data is neither required by law nor by contract, and you are under no obligation to do so. Without certain details, however, we cannot provide individual services: without a business email address, first and last name, company and a password, no user account can be created; without the data collected during payment, no paid subscription can be billed.

All other details are voluntary. Country, your role in the company and the intended use case are not collected during registration but asked once later in the customer account; you can skip the question without any effect on your use of the service or on the contract.

No Automated Decision-Making

Automated decision-making, including profiling, within the meaning of Art. 22 GDPR does not take place. The results of our design tools are technical calculations based on the data entered; they concern components, not people, and have no legal effect on you.

Hosting and Server Log Files

This website is hosted by ALL-INKL.COM - Neue Medien Muennich; the servers are located in Germany. When the website is accessed, the host automatically collects information transmitted by your browser and stores it in what are known as server log files:

• Browser type and browser version
• operating system used
• referrer URL, that is, the previously visited page
• Hostname of the accessing computer
• Time of the server request
• IP address

This data is not merged with other data sources and serves solely the secure and trouble-free operation of the site. The legal basis is Art. 6(1)(f) GDPR - our legitimate interest in the security and functionality of the website. The log files are deleted after seven days.

Cookies and Consent Management

This website uses cookies and comparable technologies. Some of them are technically necessary for the site to work - these include storing your language choice and storing your decision about the cookie notice itself. Under Section 25(2)(2) TDDDG this storage does not require consent because it is strictly necessary for operation. The legal basis for the associated processing is Art. 6(1)(f) GDPR.

All other cookies - in particular those used for audience measurement - are only set after you have given consent via our cookie notice (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change or withdraw your consent at any time with effect for the future via the cookie settings.

Which cookies are set in detail, with what lifetime and for what purpose, can be found in our Cookie Policy.

Audience Measurement with Google Analytics

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics helps us to evaluate the use of our website statistically and thereby improve it.

It is used solely on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time with effect for the future via the cookie settings.

We use Google Analytics in what is known as consent mode. Before you give consent, no cookies are set and no identifiers are stored, and no analysis of your usage behaviour takes place. In this state Google receives only a request without any recognition feature, in the course of which your IP address is transmitted for technical reasons. Usage data is collected and evaluated only after you have given consent.

In Google Analytics 4, IP truncation is enabled by default. A data processing agreement pursuant to Art. 28 GDPR is in place with Google. For transfers to Google LLC in the United States, the section on transfers to third countries applies. Further information can be found in Google's privacy policy: https://policies.google.com/privacy

Google reCAPTCHA

To protect individual forms against automated entries and spam, we use the reCAPTCHA service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

reCAPTCHA uses various pieces of information - including IP address, time spent on the page and user behaviour - to assess whether an entry comes from a human or from an automated program. Data may be transmitted to Google and processed there. For transfers to the United States, the section on transfers to third countries applies.

The legal basis is Art. 6(1)(f) GDPR - our legitimate interest in preventing spam and misuse of our forms. Further information can be found in Google's privacy policy: https://policies.google.com/privacy

Protection of Our Forms

Our own forms - for example the waiting list sign-up - are protected against automated entries without involving any third party. We evaluate whether an additional field invisible to humans has been filled in and how much time has passed between opening and submitting the form, and we limit the number of submissions per IP address per hour.

These checks run exclusively on our own servers. The IP address is processed only transiently for this purpose and is not stored permanently. The legal basis is Art. 6(1)(f) GDPR - our legitimate interest in preventing spam and misuse.

Usage counting of our online calculators

Our freely accessible calculators - in particular the Conveyor Belt Calculator and the Sidewall Belt Designer - count on the server side how often a calculation is performed. This count serves our internal evaluation of usage and protection against automated misuse. Only a daily figure per metric is stored, with no reference to any person.

To estimate returning users, your IP address is processed exclusively in pseudonymised form: it is combined with a secret key into a non-reversible hash value, under which only the most recent day of activity is stored. The IP address in plain text is not stored. This pseudonymous value is kept for a maximum of 30 days and then deleted automatically.

Your inputs and the calculated results are not stored. There is no merging with other data sources, no cross-site tracking and no profiling. The legal basis is Art. 6(1)(f) GDPR - our legitimate interest in measuring usage and preventing misuse.

Contacting us

If you contact us by email, we process the details you provide - name, email address and the content of your message - in order to deal with your request and in case of follow-up questions.

The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to the performance of a contract or is necessary for pre-contractual measures; otherwise Art. 6(1)(f) GDPR - our legitimate interest in answering enquiries.

We delete this data six months after the matter has been concluded, unless a statutory retention obligation prevents this or you ask us to delete it sooner.

Waiting List and Newsletter

For sending our newsletter and maintaining the waiting list we use Brevo, a service of Sendinblue GmbH, Koepenicker Strasse 126, 10179 Berlin, Germany.

When you sign up we process your email address together with the time of sign-up, the language selected and the information about which page and on what occasion you signed up.

Your sign-up only takes effect after you confirm it. After you submit the form we send you an email containing a confirmation link; only when you open that link do we add your address to the mailing list. If you do not confirm, the address is not transmitted.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw it at any time - via the unsubscribe link in every email or informally to info@yostro.com. After withdrawal we remove your address from the mailing list. We keep the record of the consent given in order to meet our accountability obligation (Art. 5(2), Art. 7(1) GDPR) for a further three years after the end of the year in which the withdrawal took effect.

A data processing agreement pursuant to Art. 28 GDPR is in place with Brevo; processing takes place on servers within the European Union.

Downloading the Design Checklist

If you request our checklist for designing sidewall conveyor belts, we process the email address you provide in order to send you the download link. The link is tied to your address and valid for 14 days. The legal basis is Art. 6(1)(b) GDPR - carrying out pre-contractual measures at your request.

If you have additionally consented to the newsletter, the preceding section applies to its delivery; without that consent we use your address solely to send you the checklist.

User Account and Trial (Sidewall Belt Designer Pro)

To use the Sidewall Belt Designer Pro you create a user account. In doing so we process:

• Mandatory details: business email address, first and last name, company and a password. We store the password exclusively as a cryptographic hash value; we cannot read it in plain text.
• Voluntary details: the interface language setting and - asked once in the customer account and skippable - country, your role in the company and the intended use case.
• Records of your declarations: the time you accepted the General Terms and Conditions, the version of this privacy notice in force at that time, and the time and content of any consent given to the newsletter.

Purposes and legal bases: establishing and performing the user relationship including the trial - Art. 6(1)(b) GDPR. Demonstrating the declarations you have made - Art. 6(1)(c) in conjunction with Art. 7(1) GDPR. We use the voluntary details to align the product with actual use cases - Art. 6(1)(f) GDPR.

Confirming your sign-up: registration only takes effect once you confirm a link that we send to the address provided. The link is valid for 48 hours. If you do not confirm, we delete the account created in full no later than 14 days after registration.

End of the trial: if no paid contract is concluded within 90 days after the trial expires, we delete the account and the associated data. You can delete your account yourself at any time in the customer account, both during and after the trial.

Your rights within the account: you can request a copy of the data stored for your account in the customer account; after confirmation via a link sent to your address we provide it in a common, machine-readable format.

Log of Account Events

For every user account we keep a running log of important events: registration and confirmation, start and end of the trial, changes to the subscription, system messages sent, changes to your newsletter consent and the number of designs performed.

For a calculation event that you do not expressly save, we record only that and when it took place - not your inputs and not the results. In such a case they are never stored permanently. If you deliberately save a calculation to your account, the section on saved calculations below applies.

Where your IP address is involved in an event - this is the case for registration, confirmation and resending the confirmation - we truncate it before storing: for IPv4 by the last byte, for IPv6 by the second half of the address. We do not store the full address. After 30 days we also remove the truncated value.

Purposes and legal bases: demonstrating consent given (Art. 7(1) GDPR), accounting for the trial allowance and performing the contract (Art. 6(1)(b) GDPR), preventing abusive use and keeping account events traceable (Art. 6(1)(f) GDPR).

We delete log entries for calculation events after 90 days. The remaining entries are deleted together with the account.

Saved Calculations

If you are logged in, you can save a calculation to your account under a name of your own choosing. What we store are the values you entered and the name you assigned. This happens only when you expressly initiate it - without that action no calculation is stored.

The sole purpose is to let you retrieve, compare and continue working with a design later on. The legal basis is Art. 6(1)(b) GDPR (performance of the user relationship via your account).

We keep a saved calculation until you delete it. Every entry can be removed individually in your customer account at any time; if you delete your account, we delete the calculations stored with it. There is no retention beyond that.

Block List for the One-Time Trial

The free trial is available once per email address. So that it cannot be claimed repeatedly by deleting and recreating an account, for every address whose trial has been used up we store a check value generated with a secret key together with the date of the entry. We do not store the email address itself; it cannot be derived from the check value. The value only allows us to check whether an address entered later has already used a trial.

This entry remains in place if you delete your account - otherwise the block would lose its purpose. It does not prevent you from registering again or taking out a paid subscription; it only withdraws the second free trial.

The legal basis is Art. 6(1)(f) GDPR - our legitimate interest in preventing repeated use of a free service. To that extent the retention is exempt from deletion (Art. 17(3)(e) GDPR). We delete the entry after 24 months. On request we will consider on a case-by-case basis whether to remove it sooner; please contact info@yostro.com.

Payment Processing

We process paid subscriptions via Stripe. The provider for customers in the European Economic Area is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.

When you move to the payment process we transmit your email address to Stripe to pre-fill the form, together with an internal reference to your user account. You enter your payment details - in particular card or account details - exclusively at Stripe; they never reach our systems. From Stripe we receive back: a customer identifier, the status of your subscription, the plan chosen and the start and end of the term. We store this information with your account in order to enable access and to bill the contract.

The purpose is the performance of the contract; the legal basis is Art. 6(1)(b) GDPR. Stripe is independently responsible for processing the payment data itself; Stripe's privacy policy applies. For transfers to Stripe, Inc. in the United States, the section on transfers to third countries applies. https://stripe.com/de/privacy

System and Transactional Messages

Emails arising from the operation of the platform - confirmation of registration, welcome message, notices about the upcoming end of the trial, messages about your subscription - are sent via Brevo's mail delivery service. In doing so, your email address, your name and the content of the respective message are processed.

The legal basis is Art. 6(1)(b) GDPR where the message serves the performance of the contract, otherwise Art. 6(1)(f) GDPR - our legitimate interest in reliable operation. A data processing agreement pursuant to Art. 28 GDPR is in place for this as well.

Statutory Retention Obligations

Some of your data is subject to retention obligations under commercial and tax law. We therefore keep invoices, accounting records and the associated contract data for ten years (Section 147(3) AO, Section 257(4) HGB), and commercial letters for six years. The periods begin at the end of the calendar year in which the record was created.

For the duration of these periods, deletion is excluded (Art. 17(3)(b) GDPR). Instead, we restrict the processing of this data: it is kept solely to meet the retention obligation and is deleted once the period expires.

Your rights

You have the following rights against us with regard to the personal data concerning you:

• Access: as to whether and which data we process about you (Art. 15 GDPR)
• Rectification: of inaccurate data and completion of incomplete data (Art. 16 GDPR)
• Erasure: of your data, unless an exception applies (Art. 17 GDPR)
• Restriction of processing: under the conditions of Art. 18 GDPR
• Data portability: in a common, machine-readable format (Art. 20 GDPR)
• Objection: to certain processing operations (Art. 21 GDPR - see the following section)

To exercise them, an informal message to info@yostro.com. If you have a customer account, you can also request access and erasure directly there.

Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of your personal data infringes the General Data Protection Regulation (Art. 77 GDPR). You may contact the supervisory authority of your habitual residence, your place of work or the place of the alleged infringement.

The supervisory authority responsible for us is:

The Saxon Commissioner for Data Protection and Transparency Devrientstraße 5, 01067 Dresden
Phone: 0351 85471-101
Email: post@sdtb.sachsen.de

Withdrawal and Objection

Withdrawing Your Consent

You can end processing based on your consent at any time with effect for the future. The lawfulness of processing carried out up to the withdrawal remains unaffected (Art. 7(3) GDPR). For cookies use the cookie settings, for the newsletter the unsubscribe link in every email; informally, a message to info@yostro.com is sufficient.

Objection to Processing Based on Legitimate Interests

Where your data is processed on the basis of Art. 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). We will then no longer process the data concerned unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

Where we process your data for direct marketing, you may object at any time and without giving reasons (Art. 21(2) GDPR); thereafter we will no longer use your data for that purpose.

Security of Transmission and Storage

This website uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the browser address bar begins with https:// and shows a padlock symbol.

In addition, we take appropriate technical and organisational measures pursuant to Art. 32 GDPR to protect your data against loss, destruction and unauthorised access. These include storing passwords exclusively in encrypted form, truncating IP addresses before storage, limiting failed login attempts and running automated deletion jobs for expired data.

Changes to This Privacy Notice

We adapt this notice when the procedures we use or the legal requirements change. The version published on this page applies in each case.

If you have a customer account, we record which version you agreed to at registration. We will provide earlier versions on request.