Privacy Policy

As of: October 2026

This is a translation. In case of doubt, the German version prevails.

Deutsche Fassung

This privacy policy explains which personal data we process when you visit our website protol.io, contact us or use our software protol.io (web application and mobile app).

1. Controller

Lido Apps UG (haftungsbeschränkt)
Steinstraße 13
14482 Potsdam
Germany

Represented by the managing director Kevin Drossard
Email: info@protol.io

We have not appointed a data protection officer, as we are not legally required to do so. If you have any questions about data protection, please contact us at the email address above.

2. Our role: controller or processor

protol.io is software for businesses. We offer it exclusively to business customers.

• Website, contact requests and contractual relationship: Here we are ourselves the controller within the meaning of the GDPR.
• Data within the software: We process the data that our customers and their employees enter in protol.io on behalf of the respective customer in accordance with Art. 28 GDPR. In this case the controller is the company that uses protol.io (usually your employer). This is based on a data processing agreement between us and the customer.

If, as an employee of a customer, you have questions about your data in protol.io or wish to exercise your rights, please contact your employer first. If such a request reaches us directly, we forward it to the customer.

3. Visiting our website

3.1 Server log files

When protol.io is accessed, technically necessary data is processed automatically: IP address, date and time of access, page requested, amount of data transferred, browser and operating system, and the previously visited page (referrer).

• Purpose: delivering the website, stability and security (e.g. defending against attacks)
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and functioning service)
• Retention period: 14 days, then deletion
• Hosting: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located in the European Union.

3.2 Cookies and similar technologies

We do not use any analytics, tracking or marketing tools on the website.

4. Contacting us

If you contact us by email, we process the information you provide (name, email address, company, content of the message) in order to handle your request.

• Legal basis: Art. 6(1)(b) GDPR, where your request is aimed at a contract; otherwise Art. 6(1)(f) GDPR (legitimate interest in responding)
• Retention period: until the request has been fully dealt with; beyond that only where statutory retention obligations apply
• Email provider: Google Workspace (Google Cloud EMEA Limited, Dublin, Ireland). A transfer to the USA cannot be ruled out in this context (see section 8).

5. Customer and contract data

To initiate and perform contracts, we process contact details of contact persons (name, position, business contact details), contract and billing data, and communication with us.

• Legal basis: Art. 6(1)(b) GDPR (contract or pre-contractual measures), Art. 6(1)(c) GDPR (legal obligations), Art. 6(1)(f) GDPR (communication with our customers' contact persons)
• Retention period: for the duration of the business relationship; thereafter where retention obligations under commercial and tax law apply (up to ten years)
• Other recipients: tax advisors and service providers for accounting and payment processing

6. Use of the protol.io software

6.1 Data processed

When the software is used, we process in particular the following categories of personal data:

• Account and master data: e.g. name, business email address, role and permissions, organizational assignment, settings
• Login data: access credentials (passwords stored only in encrypted form) and session information
• Content data: content that users enter, upload or edit in the software, including text, images, audio and video recordings
• Usage and log data: e.g. times and authors of changes, technical access data (IP address, time, device and operating system), error reports
• Device data: e.g. identifiers for delivering notifications

6.2 Purposes

We process this data in order to provide and operate the software, to inform users about relevant events, to ensure the security and stability of the service, to prevent misuse, to fix errors and to bill usage under the customer contract.

6.3 Storage on the device

The software stores information on the device insofar as this is technically necessary for its functions, e.g. the login session, settings and data that is synchronized with our servers.

• Legal basis: Section 25(2) no. 2 TDDDG (strictly necessary for the requested service) in conjunction with the respective legal basis of the processing

6.4 Mobile app permissions

The app only requests access permissions when you use a function that needs them (e.g. camera, microphone, photos, location, notifications). You can revoke permissions you have granted at any time in your device's settings. Individual functions may then not be available.

6.5 Notifications

We send notifications by email and as push notifications to mobile devices. Users can specify in their settings which notifications they receive and through which channel. Push notifications are technically delivered via the notification services of Apple or Google.

6.6 AI-supported functions

Some functions of the software are supported by artificial intelligence. When you use such a function, the content required for it is transmitted to a specialized provider of AI services and processed there solely to generate the respective result.

• Processing takes place within the European Union.
• The providers are contractually obliged not to use the data for training their models and not to store it for longer than necessary for the processing.
• We do not make any automated decisions within the meaning of Art. 22 GDPR using AI.
• AI-supported functions are only active once a responsible person at the organization has consented; consent can be withdrawn at any time.

6.7 Legal bases and retention period

Insofar as we act as a processor, we process the data only on the customer's instructions. The legal basis is determined by the customer as the controller. Insofar as we pursue our own purposes (operation, security, protection against misuse, billing), we rely on Art. 6(1)(b) and (f) GDPR.

Content and account data are stored for as long as the customer contract exists or until the customer deletes them. After the end of the contract, we delete the customer data within 90 days, unless a statutory retention obligation prevents this. We delete technical logs and error reports after 90 days at the latest.

7. Service providers

To operate our website and software, we use carefully selected service providers that we have contractually bound as processors in accordance with Art. 28 GDPR. These include providers of the following categories:

• data center, hosting and database services
• services for sending emails and push notifications
• error analysis services
• providers of AI services
• map services for determining coordinates from addresses (only for addresses of locations, not for data of users)

Our servers and databases are located in the European Union.

We provide our customers with a list of the service providers we use as part of the data processing agreement. Data subjects can obtain the specific recipients of their data on request.

8. Transfers to third countries

Some of our service providers are based outside the EU or the EEA (in particular in the USA) or may transfer data there. In these cases we ensure an adequate level of data protection, either through an adequacy decision of the EU Commission (e.g. for companies certified under the EU-U.S. Data Privacy Framework or for the United Kingdom) or through EU standard contractual clauses pursuant to Art. 46(2)(c) GDPR.

9. App stores

You download the mobile app via the Apple App Store or Google Play. In doing so, Apple or Google process data under their own responsibility (e.g. your store account and download information). We have no influence over this. The privacy notices of the respective provider apply.

10. No disclosure for advertising purposes

We do not sell personal data and do not use it for advertising. Data is disclosed to third parties only to the categories of service providers named in this policy, where required by law (e.g. to authorities) or with your consent.

11. Data security

We take technical and organizational measures in accordance with Art. 32 GDPR to protect your data against loss, manipulation and unauthorized access. These include in particular:

• Encryption: All data is transmitted in encrypted form (TLS). Stored data is kept encrypted in data centers in the European Union.
• Separation of customer data: Each customer's data is kept separate at the database level. Users can only access data of their own organization.
• Roles and permissions: Within an organization, a role and permission concept controls who may view and edit which data.
• Secure login: Passwords are stored exclusively as a cryptographic hash. In the mobile app, login credentials are kept in the operating system's protected storage.
• Protection against misuse: Input is validated on the server, and the number of requests is limited to prevent attacks and overload.
• Traceability: Changes to content are logged with the time and author.
• Data minimization: Error reports are cleaned of personal content before they are sent. Notifications on the lock screen contain no confidential details.

12. Your rights

Under the GDPR you have the right of

• access to your stored data (Art. 15),
• rectification of inaccurate data (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20),
• objection to processing based on our legitimate interest (Art. 21), on grounds relating to your particular situation,
• withdrawal of consent you have given, with effect for the future (Art. 7(3)).

For data that we process on behalf of a customer, please address your request to the customer (see section 2).

Having your account deleted

Your account in protol.io is managed by your organization. To have it deleted, contact an administrator of your organization or write to info@protol.io. We will then forward your request to your organization.

Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg
Stahnsdorfer Damm 77
14532 Kleinmachnow
www.lda.brandenburg.de

You can also contact any other data protection supervisory authority, in particular the one at your place of residence or place of work.

13. Changes to this privacy policy

We adapt this privacy policy when our software, our service providers or the legal situation change. The version published on protol.io at the time applies.