Version dated: 17 August 2026
The controller for the processing of personal data in connection with the creation and use of user accounts on our Insights Platform is:
Datapods GmbH Kölnstraße 179b 53111 Bonn Germany
E-mail: kontakt@datapods.app [blocked] Web: www.datapods.app/de
We process personal data of users of our Platform in particular for the following purposes:
Registration and administration of user accounts
Creation of accounts, management of authorisations, authentication (login), password management. Legal basis: Art. 6(1)(b) GDPR (performance of the user contract with the customer or steps taken prior to entering into a contract) and Art. 6(1)(f) GDPR (legitimate interest in providing and administering user access for our customers' employees).
Provision of the contractually agreed platform services
Provision of dashboards, statistics, reports and other functionalities of our Platform. Legal basis: Art. 6(1)(b) GDPR.
Communication with the user
Support enquiries, technical queries, information on changes or maintenance windows, security-related notices (e.g. password reset, login confirmation). Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR (legitimate interest in efficient customer communication).
Security and stability of the Platform
Logging of logins and relevant actions, detection of misuse and fraud, ensuring IT security, error analysis. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and uninterrupted provision of our Platform).
Compliance with legal obligations
For example, retention obligations under commercial and tax law, disclosure obligations towards public authorities. Legal basis: Art. 6(1)(c) GDPR.
In connection with the creation and use of user accounts, we process in particular the following categories of data:
Master data / identification data
Account and access data
Usage and log data
Communication data
Other categories (e.g. payment data) are processed only insofar as this is separately required within the scope of the contractual relationship with the customer and has been communicated accordingly.
As a rule, we receive the data listed above:
We disclose personal data to third parties only insofar as this is necessary for the purposes stated, legally permitted or legally required. Recipients may include in particular:
Internal recipients
Datapods employees (e.g. support, development, sales) within the scope of their respective responsibilities and in compliance with the need-to-know principle.
External service providers (processors)
We engage external service providers who process personal data exclusively on our instructions and on the basis of agreements pursuant to Art. 28 GDPR. These include in particular:
A current list of the processors we engage, including their countries of establishment and the applicable transfer mechanisms, is documented in the Data Processing Agreement (DPA) that we conclude with our corporate customers. We are happy to provide this list upon request.
Other third parties
Disclosure to other third parties for those third parties' own purposes does not take place in principle, unless expressly stated or provided for by law.
Personal data is transferred to third countries outside the European Union (EU) or the European Economic Area (EEA) only where this is necessary for the performance of our contractual obligations or where there is otherwise a statutory permission, and where the additional requirements of Art. 44 et seq. GDPR are met.
The transfer mechanisms considered are in particular:
A current list of the processors engaged, stating their country of establishment and the applicable transfer mechanism, is documented in the DPA and is available to our corporate customers. Individuals may request this information at kontakt@datapods.app [blocked].
We store personal data only for as long as is necessary for the fulfilment of the purposes stated or as long as we are legally obliged to retain it. In particular, the following applies:
Master data and account data are stored for the duration of the active user account. Following termination of the contractual relationship with the customer or deletion of the user account, the data will in principle be deleted or anonymised within 30 days, unless statutory retention obligations apply.
Log and usage data are generally stored for a period of 2 years in order to enable security, error analysis and the investigation of misuse, and are subsequently deleted or anonymised.
Communication data (support, etc.) are retained for as long as is necessary to process the enquiry and, where applicable, beyond that within the scope of general commercial retention periods (as a rule up to 6 or 10 years, depending on relevance).
When specific retention periods expire, the data concerned is deleted or anonymised in accordance with statutory requirements. The deletion periods applicable upon termination of the contract are governed by the DPA (Section 9 thereof).
Insofar as we process personal data of Authorized Users on behalf of the respective corporate customer (as controller within the meaning of Art. 4(7) GDPR), such processing takes place on the basis of a separately concluded Data Processing Agreement (DPA) pursuant to Art. 28 GDPR. The DPA governs in particular the subject matter, duration and purpose of the processing, the technical and organisational measures, and the rights and obligations of both parties.
The provision of the Insights content on the Platform, which is based on aggregated data of end users of the Datapods app, is carried out by Datapods as an independent controller. In this respect, corporate customers do not become joint controllers within the meaning of Art. 26 GDPR.
In connection with the processing of your personal data, you have in particular the following rights under the GDPR:
Access (Art. 15 GDPR): You have the right to request confirmation as to whether we process personal data concerning you and, if so, which data.
Rectification (Art. 16 GDPR): You may request the rectification of inaccurate data and the completion of incomplete data concerning you.
Erasure (Art. 17 GDPR): Under certain conditions, you may request the erasure of your personal data (e.g. where the data is no longer necessary for the purposes for which it was collected).
Restriction of processing (Art. 18 GDPR): Under certain conditions, you may request the restriction of processing.
Data portability (Art. 20 GDPR): In certain cases, you have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format, or to have it transmitted to another controller.
Objection (Art. 21 GDPR): Insofar as we process data on the basis of Art. 6(1)(f) GDPR (legitimate interest), you have the right to object at any time, on grounds relating to your particular situation, to such processing. We will then no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing or the processing serves the establishment, exercise or defence of legal claims.
Withdrawal of consent (Art. 7(3) GDPR): Insofar as processing is based on your consent, you may withdraw it at any time with effect for the future, without affecting the lawfulness of processing carried out prior to the withdrawal.
Right to lodge a complaint with a supervisory authority (Art. 77 GDPR): You have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes the GDPR. The competent authority is:
Landesbeauftragte für den Datenschutz und die Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia) Postfach 20 04 44, 40102 Düsseldorf, Germany Telephone: +49 211 38424-0 | Fax: +49 211 38424-10 E-mail: poststelle@ldi.nrw.de [blocked]
Please note: Insofar as you use the Platform as an Authorized User on behalf of your employer, your primary point of contact for data protection enquiries may be your employer as controller. We forward enquiries that reach us directly to the responsible corporate customer without undue delay.
To exercise your rights, or if you have questions about the processing of your personal data, you may contact us at any time:
Datapods GmbH Kölnstraße 179b 53111 Bonn, Germany E-mail: kontakt@datapods.app [blocked]
Provision of the personal data listed in Section 3 is generally necessary in order for us to provide you with a user account on our Platform and to render the contractually agreed services to your employer / your organisation. Without this data, you may be unable to use our Platform, or able to use it only to a limited extent. Where certain information is provided voluntarily, we indicate this accordingly.
We continuously develop our Platform and our processes further. It may therefore become necessary to amend this Privacy Notice. We will notify our corporate customers of material changes in text form. The current version of the Privacy Notice is available at: