Privacy Policy

The controller within the meaning of the General Data Protection Regulation (GDPR) for the processing of personal data at ForkScan Pro is:

WebPX - Graupner & Kozhevnikov GbR Reumtengrüner Str. 32B 08209 Auerbach Germany

Phone: +49 (0) 3744 3515905 Email: info@webpx.de

This privacy policy applies to the ForkScan Pro website, the ForkScan Pro web application (customer and administration area) and the ForkScan Pro mobile apps for iOS and Android.

When you obtain the apps from the Apple App Store or Google Play, the privacy terms of the respective store operator apply in addition. We have no influence on the data processing carried out there.

The website, application and database are operated on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located in Germany. Hetzner processes the data on our behalf (Art. 28 GDPR). We send emails through our own mail server, which is also operated at Hetzner in Germany.

For technical reasons, the following data is processed with every request:

• IP address of the requesting device
• date and time of access
• requested address (URL) and volume of data transferred
• browser type, operating system and language setting
• previously visited page (referrer)

This processing is necessary to deliver the service and to ensure its stability and security. The legal basis is Art. 6 (1) (f) GDPR. We delete the logs of the web server in front of the application after 30 days; the application's own logs rotate for technical reasons even earlier.

A user account is required to use ForkScan Pro. In this context we process:

• name and email address
• password (stored exclusively as a cryptographic hash)
• company name and your confirmation that you act as a business, with the time of the confirmation and the channel it was given through (website, iOS or Android app); required, as the offer is for businesses only. Voluntary: contact person, phone number, address, VAT ID
• times of registration and sign-ins; for each sign-in in a browser also the browser and operating system (e.g. “Chrome, macOS”), so that you can recognise and end your sign-ins in the account settings. We delete this information when you sign out; if a sign-in ends because it expires (after 30 days), at the latest one day later.

The legal basis is Art. 6 (1) (b) GDPR (performance of the user contract and pre-contractual measures).

For a sign-up with email address and password, you confirm your email address via a link that we send you by email. Only then can you use ForkScan Pro; a trial only starts with the confirmation. For this we store only a cryptographic hash of the link, its expiry and the time of confirmation; only the email contains the link itself. A new email replaces the previous link. On request we send the email again, a limited number of times; for this limit we store the internal identifier of your account and a hash of the address, never the address itself, and delete these entries once the period (5 minutes or 24 hours) has expired. If the address is not confirmed within 48 hours of signing up, we delete the registration with the account, sign-in data, profile and the consents stored in the account; invitations that a company has sent to this address remain. Signing in with Google or Apple requires no such confirmation. The legal basis is Art. 6 (1) (b) GDPR and Art. 6 (1) (f) GDPR; our legitimate interest lies in preventing sign-ups with other people's email addresses.

You may optionally sign in using an existing Google or Apple account. If you choose this option, you are redirected to the respective provider and sign in there. We then receive your name, your email address, an identifier of your account with the provider and, if the provider transmits it, the address of your profile picture; we do not receive your password for that account.

• Google: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
• Apple: Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland

If you sign in with Apple in the iOS app, we exchange the one-time authorization code that Apple transmits for a refresh token at Apple and store this token on our server only; we never pass it to the app or to other users. We use it solely to revoke, when your account is deleted, the link between ForkScan Pro and your Apple ID at Apple. Each renewed sign-in with Apple in the app that is accepted, or after which only your company is still missing, replaces the previous token; if the exchange fails, we store no new one. When your account is deleted (section 16), we send the token to Apple for revocation; if this fails, we try again after 5 minutes, 1 hour, 6 hours and 24 hours. We delete the token once Apple has confirmed the revocation, otherwise after the last attempt, and in any case at the latest two days after the account was deleted. After a sign-in with Apple on the website we store no such token; you can remove that link yourself at any time in the settings of your Apple ID under “Sign in with Apple”.

The legal basis is Art. 6 (1) (b) GDPR. Use of this option is voluntary; signing in with email address and password is available at any time. The provider's own privacy terms apply to the data processing carried out by the provider.

When you use the features of ForkScan Pro, we process:

• search queries for error codes, including the selected manufacturer and device type
• fleet data: details of vehicles, inspection dates (e.g. statutory safety inspections), documented errors with their status and photos, documents and notes you add
• solutions (tips, including photos) and ratings you submit in the community area; your tips are visible to all ForkScan Pro customers with your first and last name, not with your company
• your feedback on whether the notes on an error code helped (“helpful” or “not helpful”), linked to your user account
• licence and device data: licence key, device identifier, device name, platform and time of last use of registered mobile devices
• subscription and usage status, e.g. plan, trial period and number of queries

We process search queries, tips and ratings, feedback and the subscription and usage status under our own responsibility; the legal basis is Art. 6 (1) (b) GDPR. We also use device data under our own responsibility for security and abuse detection (section 13). We process fleet data, licence and device data and the roles and invitations in your company's team on behalf of your company; to that extent your company is the controller, also for the lawfulness of personal data of third parties that you store there (e.g. of employees). The data processing agreement pursuant to Art. 28 GDPR, an annex to our terms and conditions, applies to this: https://forkscan.pro/en/avv

To protect against unauthorised disclosure, we add invisible customer-specific markers to the error code texts we deliver to the apps (including the offline pack) and to the descriptions in the search by manufacturer; individual wording may also differ slightly from customer to customer. This makes it possible to determine to which company a text was delivered; we derive no other data from it. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in making unauthorised disclosure of the content of our database more difficult and traceable.

The apps ask for permission to send notifications after a sign-in as long as you have not decided on it yet, and for the other permissions only when you use the respective feature:

• Camera: to capture error codes and for photos of vehicles, documented errors and tips. Text recognition when capturing error codes runs on your device; the image is not transmitted for this. The iOS app uses the operating system's text recognition, the Android app Google's ML Kit; according to Google, ML Kit may send technical usage and diagnostic data without image content to Google.
• Photos: to add existing images to vehicles, documented errors and tips. Images are re-encoded before they are stored; location and camera data (EXIF) are removed in the process.
• Biometrics (Face ID, Touch ID, fingerprint): to unlock the app. The biometric check is performed exclusively by the operating system on your device; we do not receive any biometric data.
• Notifications: see section 8

Credentials and keys are stored in the protected storage of the device. You can revoke permissions at any time in your device settings.

If you allow notifications in the app, we process a push token of your device in order to deliver, for example, reminders of inspection dates. Delivery takes place in the iOS app via the Apple Push Notification service (Apple Inc., USA) and in the Android app via Google's Firebase Cloud Messaging. The respective service receives the push token and the content of the notification for this, for example the name of a vehicle and when its inspection is due.

The legal basis is your consent (Art. 6 (1) (a) GDPR). You can withdraw your consent at any time with effect for the future by disabling notifications in your device settings.

Paid subscriptions are processed via Stripe: Stripe Payments Europe, Limited, The One Building, 1 Grand Canal Street Lower, Dublin 2, Ireland. You enter your payment details directly with Stripe; we do not receive complete card details or account numbers. We store the type of payment method and the last four digits, your Stripe customer identifier, the plan, status and term of the subscription and, for each payment, the amount, currency, invoice number, a link to the invoice and, where applicable, the reason for a failed payment. We also keep the event data that Stripe sends us about orders, subscriptions and invoices; they may contain the customer's name, billing address, email address and VAT ID. For each payment event we delete this event data, the invoice link, the reason for a failed payment as sent by Stripe and all Stripe IDs stored with it (such as those of the customer, subscription, invoice, price and refund) at the end of the tenth calendar year after the year of the event; amount, currency, date and invoice number as well as the kind and status of the event remain for our revenue statistics (section 16). To calculate VAT, Stripe collects your billing address and, where applicable, your VAT ID.

The legal basis is Art. 6 (1) (b) GDPR and, for the retention of billing data, Art. 6 (1) (c) GDPR. Stripe also processes data under its own responsibility, for example for fraud prevention. Further information: https://stripe.com/privacy

We send you emails that are necessary for using the service:

• messages regarding registration, the confirmation of your email address and password reset
• notices regarding trial period, pilot phase, subscription and payments
• reminders of inspection dates you have stored
• security notices, for example after your password has been changed or, to a company's administrators, when a device licence has been blocked automatically
• invitations to a company's team, sent to the address an administrator enters
• notices if no company of your own can be created with your address
• notices of changes to our terms and conditions or the data processing agreement, at least six weeks before they take effect, to a company's administrators and contact address; we keep the proof of sending (address, language and time) with the company's data and delete it with them

The legal basis is Art. 6 (1) (b) GDPR and, for security notices and for the proof that we have notified a change to the terms and conditions or the data processing agreement, Art. 6 (1) (f) GDPR (our legitimate interest lies in being able to prove the notice).

We write these emails in the language you have chosen in your account. For this purpose we store your choice of language in the user account.

Each of these emails names us as the provider with our address and links the legal notice and the privacy policy.

If you write to us via the contact form or by email, we process your details (name, email address, optionally the company, topic and message) in order to answer your enquiry (Art. 6 (1) (b) or (f) GDPR). Messages from the contact form are delivered to us by email and then deleted from the platform's database; if a message could not be delivered, we delete it there after 30 days. To prevent abuse, we limit the number of messages per email address.

If you apply on our website as a pilot company (https://forkscan.pro/en/pilot), we process the details from the form: company, your name and your email address, optionally your phone number, your field, the approximate number of industrial trucks, the manufacturers, optionally your message, and the language and time of the application. We use them to review the application, to contact you and to prepare the pilot phase (Art. 6 (1) (b) or (f) GDPR; our legitimate interest lies in reviewing and answering applications from companies). The application is delivered to us by email and stored in the platform's database, where only our staff see it, together with the state of its handling and their notes on it. We send a confirmation of receipt to the email address given. We delete the application 12 months after the last change of its state of handling; if your company takes part in the pilot programme, 30 days after the start of its pilot phase. At your request we delete it at once. To prevent abuse, we limit the number of applications per email address (section 13).

During the trial we send you information about its start, its upcoming end and its actual end. These emails concern your user account; the legal basis is Art. 6 (1) (b) GDPR.

We only send you information about plans and offers with your consent (Art. 6 (1) (a) GDPR, Section 7 (2) UWG), which you can give when signing up or in your user account. The consent only takes effect once you confirm it via the link in a confirmation email and the button on the page that opens (double opt-in). As proof we store the time of the declaration, its origin (website or app) and the time of confirmation and, where applicable, of withdrawal.

You can withdraw your consent at any time with effect for the future, via the unsubscribe link in each of these emails or in your user account. We keep the proof of your current consent for as long as your user account exists.

To detect and fix technical errors, we use the Sentry service of Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA, in the web application and in the apps. The data is stored in Sentry's EU region (Germany) and deleted after 90 days. In the apps, error reports are only sent if you turn this on under “More”; the setting is off by default.

The following is processed:

• error reports with technical details of the error and the page concerned
• details of device, operating system, browser and app version
• IP address
• performance data (loading times) for a portion of requests (currently about one in five) and session pings without content (start, status, version), in the browser on every page view: in the web application only with your consent to statistics, in the apps only when error reports are switched on. We do not collect performance data on our servers.
• session recordings (Session Replay) in the web application, only with your consent. Even then only a share of sessions is recorded: currently 10% of sessions and sessions in which an error occurs. All text and input is masked and media content is blocked, so that only the sequence of interactions can be followed.

The legal basis for error reports of the web application is Art. 6 (1) (f) GDPR in conjunction with Section 25 (2) no. 2 TDDDG; our legitimate interest lies in the stable and secure operation of the service. Performance data, session pings and session recordings of the web application, as well as error reports, performance data and session pings of the apps, are only collected with your consent; to that extent the legal basis is your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG). You can withdraw it at any time: in the web application via the privacy settings in the footer of the website, in the apps under “More”. A data processing agreement is in place with Sentry. Access from the USA cannot be ruled out; it takes place on the basis of the EU-U.S. Data Privacy Framework or standard contractual clauses of the EU Commission.

Only with your consent to statistics do we compile our own statistics, operated on our servers, on the use of the public pages (home page, sign-in, sign-up, password reset and plan selection). We process the page visited, date and time, the referring website, campaign parameters (UTM) and events such as the completion of a registration, a visit to the plan selection and the start of an order. To distinguish visits, your browser stores a random identifier (section 14) that is derived from nothing about you, your account or your device; on our servers we store only a short value calculated from it. If you are signed in, we only count when your user account also records your consent to statistics, and we attribute events to the internal identifier of your user account and of your company.

No cookies are set for this purpose and no data is passed on to third parties. The legal basis is your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG); you can withdraw it at any time with effect for the future via the privacy settings in the footer of the website. When you withdraw it, the website removes the identifier from your browser. We delete the data of these statistics after 90 days.

Independently of any consent, we count searches for error codes in the customer portal and in the apps: we store the date and time, the code, where applicable the manufacturer, device type and language, whether the code was found, whether the search came from the customer portal or an app, and the internal identifier of your company. We use this count to evaluate how our customers use the service and to improve the database, for example with codes that were searched for but are missing. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in evaluating the use of the service and improving the database. If you object (in the customer portal under “Settings” → “Privacy” or on the “No active plan” page, or by a message to info@webpx.de), we no longer count your company's searches and business events and delete the earlier entries; the search counter for the plan limit and billing are not affected. The objection applies to your whole company, including the business events in the next paragraph. Only an administrator of your company can withdraw it, in the same places or by a message to info@webpx.de; deleted entries are not restored. We delete the entries after 90 days.

Also independently of any consent, we record business events for each company from the contract data: the start of a trial, each paid invoice of a subscription and the end of a subscription, each with the date and time, the company's internal identifier and, where applicable, the plan. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in evaluating the business development of the service. If you object (in the customer portal under “Settings” → “Privacy” or on the “No active plan” page, or by a message to info@webpx.de; it is the same objection as in the previous paragraph), we no longer record your company's business events and delete the earlier entries; billing and the accounting records (section 16) are not affected. We delete these entries after 90 days.

Only with your consent do we additionally measure the reach of our website with the service MIRA FIVE (mirafive.io) of Cloo GmbH, Reumtengrüner Str. 32B, 08209 Auerbach, Germany, whose servers are located in the EU. The following is processed:

• the page visited with its title, date and time, the referring website, campaign parameters (UTM) and click identifiers of advertising networks (such as gclid or fbclid) where they are part of the address
• information on browser, operating system, screen size, language setting and time zone
• a randomly generated pseudonymous visitor identifier in your browser's local storage, which groups visits and sessions
• for signed-in users, the internal user ID of your account, not your email address
• from our backend, events such as registration, start of a trial, payments (with the amount), plan changes (with the plan names) and cancellation with the internal user ID; this too only if you have consented

If you sign up or are signed in, we store your decision on statistics, with its time, in your user account as well. We use it only so that our own statistics count you while signed in only with your consent, and so that events from our backend (registration, start of a trial, payment, plan change, cancellation) are sent to MIRA FIVE only with your consent. Events concerning a company are attributed to the company's first administrator (or, if there is none, its first member) and only sent with that person's consent. If your company has objected to the counting under paragraphs 3 and 4, we do not send its events to MIRA FIVE either. If no decision is on record, for example after signing up in an app, we send no such events. The legal basis for storing it is Art. 6 (1) (c) GDPR in conjunction with Art. 7 (1) GDPR, because we have to be able to prove whether you have consented.

MIRA FIVE does not store the IP address. If your browser sends the “Do Not Track” or “Global Privacy Control” signal, MIRA FIVE collects nothing. The legal basis is your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG); you can withdraw it at any time with effect for the future via the privacy settings in the footer of the website. A data processing agreement (Art. 28 GDPR) is in place with Cloo GmbH. MIRA FIVE stores this data for 12 months.

To protect against attacks and against misuse of licences, we process technical characteristics of requests (browser identifier, language setting and supported encodings; for a signed-in app, its session key), which we store for rate limiting only as a cryptographic hash and only for the respective time window (between one minute and 24 hours), as well as device identifiers and the codes and manufacturers looked up, with the time and frequency of the queries. We also limit sign-in, sign-up, password resets, the contact form and applications as a pilot company per email address; for this we store the address only as a cryptographic hash, for the respective time window and in security events, for example when a request is refused for this reason or a message from the contact form or an email about an application cannot be delivered. Such a hash is a pseudonym: anyone who knows the address can compute it. We do not evaluate IP addresses for this. Conspicuous patterns may lead to requests being limited temporarily or to access being blocked. The queries of a device in the app are assessed automatically, for example a very large number of queries, consecutive codes or queries spread across many manufacturers within one hour. In the case of a highly conspicuous pattern, the device's licence is blocked automatically; the company's administrators (if none of them has an email address, the company's contact address) receive an email about it. The block remains until we release the licence again. If you write to info@webpx.de, a person reviews the block; you can present your point of view.

The legal basis is Art. 6 (1) (f) GDPR, and for the automatic block of a licence also Art. 22 (2) (a) GDPR (section 18). We delete security events after 30 days. We also delete security alerts concerning a device after 30 days; as long as the licence is blocked, we keep them as a record of the reason for the block and delete them 30 days after the release.

We do not use cookies for advertising or tracking purposes. Only the following is stored on your device:

• sign-in information (session tokens) in the browser's local storage, so that you remain signed in
• a cookie containing the selected language
• the language last shown, in the browser's session storage, so that a change of language in the customer portal can be saved in your account, and the internal identifiers of your account and of your sign-in, in the browser's local storage, so that the language of your account is applied only once per sign-in; both are removed when you sign out and, when a sign-in expires or is ended, at the latest at your next visit to the website
• your display settings for tables and which notices in the customer portal you have closed or already used, in the browser's local storage
• an invitation link you opened, until you have signed in or signed up, in the browser's local storage
• your decisions on statistics and session recording in the browser's local storage
• pseudonymous identifiers for reach measurement in the browser's local storage, only with your consent
• a random visitor identifier of our own statistics (section 12) in the browser's local storage, only with your consent; it is removed as soon as you withdraw your consent
• a session identifier of the session recording (Sentry) in the browser's session storage, only with your consent

The identifiers for reach measurement and our own statistics and the session identifier of the session recording are only stored with your consent (Section 25 (1) TDDDG, Art. 6 (1) (a) GDPR). The legal basis for all other items is Section 25 (2) no. 2 TDDDG in conjunction with Art. 6 (1) (b) and (f) GDPR.

Your data is only passed on to the service providers named in this policy and where we are legally obliged to do so. Data is not sold.

In the case of Stripe, Sentry, Google and Apple, processing in the USA or access from there cannot be ruled out. The transfer takes place on the basis of an adequacy decision of the EU Commission (EU-U.S. Data Privacy Framework) or standard contractual clauses (Art. 45, 46 GDPR). MIRA FIVE processes the data exclusively in the EU.

We store personal data only for as long as is necessary for the purposes stated. We store account and usage data for as long as your user account exists. After the end of a trial or a subscription your data remain readable for 12 months; if no plan is running by then, we delete the company's data and the user accounts that belong only to it (details below). We also delete your data when you delete your account or ask us to, unless statutory retention obligations prevent this. You can delete your account yourself: in the customer portal in the account settings or, if the customer portal shows the “No active plan” page or the “Your company” form instead, there, and, once the app has been released, in the app. If an ordered plan is running for your company and you are its last member, the deletion is only possible once the plan has been cancelled and has ended; if you are the only administrator of a company with other members, first make another member an administrator. If you have no access to the customer portal and the app, or if the customer portal shows you none of these ways, an informal message to info@webpx.de is enough. The “Delete account” page sets out the details: https://forkscan.pro/en/account-deletion

We keep billing records because of commercial and tax retention obligations until the end of the tenth calendar year after the year in which they were created. After that, for every company, whether it still exists or not, we delete the personal parts of the payment events: Stripe's event data (for example with name, address, email address and VAT ID), the invoice link, the reason for a failed payment as sent by Stripe and all Stripe IDs (such as those of the customer, subscription, invoice, price and refund). We keep amount, currency, date and invoice number as well as the kind and status of the event for our revenue statistics (Art. 6 (1) (f) GDPR). Backups are deleted automatically about 7 days after they were made, and with them the data they contain, including that of a deleted account.

If you delete your account, we remove your sign-in data and sessions (after a sign-in with Apple in the iOS app also Apple's token, once Apple has confirmed the revocation, at the latest two days after the deletion; section 5), your profile, your tips with photos and your ratings, the invitations sent to your email address and, unless a company still uses the address as its contact address, emails to you that have not yet been delivered. In the internal change log we replace your email address with a placeholder. In records of a company you belonged to that continues to exist (such as vehicles and documented errors), only internal reference numbers remain. If your address was the contact address of such a company, the company receives the address of another member, preferably an administrator; if there is no suitable member, the address remains stored until we have resolved this. If the company is a Stripe customer, we inform Stripe of the new address. If you were the only member of a company, we delete its data such as vehicles, inspection dates, documented errors and licences; in the company's change log we also replace names, phone numbers and notes with a placeholder. If Stripe has sent us payment events for the company, a payment is stored or a subscription has been set up at Stripe, we keep the company's record with its name, where stored its address and VAT ID, and its Stripe IDs (customer and subscription) because of commercial and tax retention obligations until the end of the tenth calendar year after the year of the last payment or payment event (for a subscription without a known date: after the year of the deletion) and then delete the name, address and VAT ID, also in the change log, and the Stripe IDs; paragraph 2 applies to the payment events. Otherwise we also delete the company's name, address and VAT ID, also in the change log; we then keep its Stripe customer ID for 90 days so that we can match and refund a late payment, and delete it on the first day of the following month. If you had not yet confirmed your email address, invitations and emails to this address and the change log remain unchanged, because the address may belong to someone else. If a company has had no running trial and no running plan for 12 months, we delete its data as when its last member deletes their account, and with them the user accounts that belong only to this company; user accounts that also belong to another company only lose the membership. The 12 months start at the end of the trial or, if later, at the end of the plan; they do not start while a payment is outstanding. At least 30 days before the deletion we remind the company's administrators by email (without an administrator, another member or the company's contact address); the deletion takes place no earlier than 30 days after this reminder. If the company orders a plan before then or its plan runs again, the deletion does not take place.

We delete the logs of the web server in front of the application after 30 days (section 3). We delete security events after 30 days. We also delete security alerts concerning a device after 30 days; as long as the licence is blocked, we keep them and delete them 30 days after the release. We delete the codes and manufacturers a device looked up, stored for abuse detection, after about one day. We delete entries for emails whose delivery we retry 30 days after the last attempt. We delete push tokens when you sign out on the device, otherwise at the latest six hours after the last sign-in there has expired. We delete our own usage statistics after 90 days. Error reports, performance data, session pings (with consent) and session recordings at Sentry are deleted after 90 days, the reach measurement data at MIRA FIVE after 12 months. We delete registrations whose email address is not confirmed within 48 hours (section 4). There is currently no fixed deletion period for the internal change log; when an account or a company is deleted, we replace the personal details in it as described in paragraph 3.

Under the GDPR you have the following rights:

• access to the data stored about you (Art. 15)
• rectification of inaccurate data (Art. 16)
• erasure (Art. 17)
• restriction of processing (Art. 18)
• data portability (Art. 20)
• withdrawal of consent with effect for the future (Art. 7 (3))

Right to object: where we process data on the basis of Art. 6 (1) (f) GDPR, you may object to the processing at any time on grounds relating to your particular situation (Art. 21 GDPR). You can also object to the counting of searches and the recording of business events (section 12) for your company yourself in the customer portal, under “Settings” → “Privacy” or on the “No active plan” page; the objection takes effect immediately. We store the objection with the time and the person who declared it or entered it for you, so that it is respected permanently and we can prove it (Art. 6 (1) (c) and (f) GDPR); we delete these details once the objection has been withdrawn and the earlier entries have been deleted, otherwise with the company's data. Setting and withdrawing it are also recorded in the internal change log like other changes (section 16).

To exercise your rights, a message to info@webpx.de is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Sächsische Datenschutz- und Transparenzbeauftragte Maternistraße 17 01067 Dresden Germany https://www.datenschutz.sachsen.de

Name, email address, company name and the confirmation that you act as a business are required for registration; without them you cannot use ForkScan Pro. For a paid subscription, Stripe also collects the billing address. All other details are voluntary.

We make a decision based solely on automated processing within the meaning of Art. 22 GDPR in one case only: in the case of highly conspicuous query patterns we block a device's licence automatically (section 13). We base this on Art. 22 (2) (a) GDPR: the block protects the licensed content and is therefore necessary for the performance of the contracts with our customers. We inform the company's administrators of such a block by email. By writing to info@webpx.de you can have a person review the block, present your point of view and contest the decision. There is no other automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

We take technical and organisational measures to protect your data. These include encrypted transmission (TLS), storage of passwords as hashes, role-based access restrictions and, in the mobile apps, certificate pinning and signed write requests; renewing the sign-in is additionally encrypted.

We update this privacy policy when our service or the legal situation changes. The version published on this page applies.

This English version is a convenience translation. In the event of any discrepancy, the German version prevails.