casaGeo (en)

Privacy Policy

Version: November 2025

We appreciate your interest in our company and in visiting our website www.casageo.de.
We take the protection of personal data seriously and process personal information strictly in accordance with the EU General Data Protection Regulation (GDPR) and applicable national laws.

This Privacy Policy explains how we process personal data when you visit our website, contact us, purchase digital products or licenses, or use our technical services such as the customer portal or license activation servers.

1. Controller

casaGeo Data + Services GmbH
Fraunhoferstraße 3
25524 Itzehoe
Germany
Email: info@casageo.de

2. Data Processing When Visiting Our Website

When you access our website, your browser automatically sends information to our server, which is temporarily stored in server log files.

Processed data includes:

  • IP address of the requesting device

  • Device identifiers and device type

  • Date and time of access

  • Accessed pages and files

  • Amount of data transferred

  • Referrer URL

  • Browser type and operating system

  • Name of the access provider

  • General technical usage information

Purpose:

  • Ensuring a functioning website

  • System security and stability

  • Technical administration

  • Troubleshooting

Legal basis: Art. 6(1)(f) GDPR (legitimate interest).

Server log data is stored exclusively on servers located in Germany and automatically deleted when no longer required.

3. Use of Cookies and the Contao Consent Manager

We use the built-in Contao Consent Manager to obtain and document cookie consent in compliance with GDPR and the EU ePrivacy Directive.

3.1 Categories of cookies

  • Essential cookies
    Required for website functionality and set without consent.
    Legal basis: Art. 6(1)(f) GDPR.

  • Analytics cookies (e.g., Google Analytics — optional, future use)
    Set only after you provide consent.
    Legal basis: Art. 6(1)(a) GDPR.

  • Marketing / External media cookies (e.g., YouTube)
    Set only after you provide consent.
    Legal basis: Art. 6(1)(a) GDPR.

3.2 Withdrawing consent

You may withdraw cookie consent at any time through the Contao Consent Manager (cookie banner).

4. Contacting Us (Contact Form or Email)

When you contact us via form or email, we process your data (name, company, email address, and optional details) solely for handling your inquiry.

Legal basis:
Art. 6(1)(b) GDPR (pre-contractual measures) or
Art. 6(1)(a) GDPR (consent).

We delete your inquiry once it is completed, unless legal retention periods apply.

5. Contract Processing, Orders & Digital Products

When you purchase licenses, digital content, or services, we process:

  • Company name and address

  • Name and contact details of the contact person

  • Billing and communication data

  • Payment information (depending on payment method)

  • Technical usage data (e.g., login times, IP logs where required)

  • License activation data (see Section 8)

Legal basis: Art. 6(1)(b) GDPR (contract performance)
and Art. 6(1)(c) GDPR (legal obligations).

5.1 Zoho Billing (Integrated Checkout Widgets)

We offer the option to purchase products through Zoho Billing.
Zoho processes customer, billing, and payment data as required for order handling.

Zoho may transfer data outside the EU.
Transfers rely on appropriate safeguards such as EU Standard Contractual Clauses.

5.2 Stripe (Payment Processing)

We use Stripe Payments Europe Ltd. for credit card processing.

Processed data:

  • Name, email address, billing address

  • Payment method and credit card data

  • Technical metadata, IP address

  • Transaction IDs

Possible data transfer to the US or other countries is based on EU Standard Contractual Clauses.

5.3 PayPal

If you choose PayPal, you are redirected to PayPal.
PayPal is solely responsible for data processing within its service.

6. YouTube

We embed videos from YouTube (Google Ireland Ltd.).
YouTube is loaded only after consent via the Contao Consent Manager.

Processed data:

  • IP address

  • Browser and device information

  • Pages visited

  • YouTube account data (if logged in)

  • Usage statistics

Data may be transferred to the United States.

Legal basis: Art. 6(1)(a) GDPR (consent).

7. Google Analytics

We reserve the right to use Google Analytics 4.
The service will only be activated after explicit consent.

Processed data includes:

  • IP address (anonymized)

  • Browser, device, and language settings

  • Page interactions and session data

  • Referrer URLs

Transfers to the USA are based on EU Standard Contractual Clauses.

Consent may be withdrawn at any time.

8. License Server and Software License Management

For the administration, activation, and validation of software licenses (especially casaGeoTools), we use:

  • our own license server based on Django, and

  • the service Devolens (formerly Cryptolens).

During license activation and license usage checks, we process the following personal data:

  • Name of the user

  • Email address of the user

  • Company name

  • License keys and product keys

  • Customer or account identifiers

  • Device-related technical data (e.g., hardware ID, system identifiers)

  • IP address at the time of activation or validation

  • Timestamps of activation, validation, or deactivation events

Purposes of processing:

  • Assigning licenses to specific customers and authorized users

  • Verifying the legitimacy of license use

  • Preventing license misuse

  • Providing technical support

  • Maintaining system security and compliance

Legal basis:
Art. 6(1)(b) GDPR (performance of the license contract)
and Art. 6(1)(f) GDPR (legitimate interest in ensuring license integrity and system security).

When Devolens is used, data is processed under a Data Processing Agreement (DPA) pursuant to Art. 28 GDPR.
Data may be transferred outside the EU based on EU Standard Contractual Clauses.

We store license data as long as necessary for license administration and as required for audit, compliance, and documentation obligations.

9. Hosting and Technical Infrastructure

Our website and associated systems are hosted exclusively on servers located in Germany.
The hosting provider processes technical data (e.g., server logs) on our behalf within a Data Processing Agreement compliant with Art. 28 GDPR.

No hosting-related data transfers occur outside the EU.

10. Disclosure of Personal Data

We only transfer personal data to third parties under the following conditions:

  • With your explicit consent (Art. 6(1)(a) GDPR)

  • For contract performance (Art. 6(1)(b) GDPR), e.g., payment processors, billing providers

  • Due to legal obligations (Art. 6(1)(c) GDPR)

  • When necessary for asserting, exercising, or defending legal claims and no overriding legitimate interests of the data subject exist (Art. 6(1)(f) GDPR)

Typical recipients include:

  • Payment processors (Stripe, PayPal)

  • Billing and subscription services (Zoho Billing)

  • Technical service providers and IT contractors

  • License management service providers (Devolens)

  • Hosting providers

  • Legal advisors or authorities (in rare cases)

We do not sell personal data under any circumstances.

11. International Data Transfers

Where data is transferred to countries outside the EU/EEA (e.g., to Stripe, Zoho, Google, or YouTube), such transfers occur only:

  • with your consent (Art. 6(1)(a) GDPR),

  • based on contractual necessity (Art. 6(1)(b) GDPR), or

  • on the basis of EU Standard Contractual Clauses (SCCs) in accordance with Art. 46 GDPR.

We ensure that adequate protection is in place for all international transfers.

12. Rights of Data Subjects

You have the following rights under GDPR:

  • Right of access (Art. 15 GDPR)
    Information on whether we process your data, for what purpose, and what categories of data are involved

  • Right to rectification (Art. 16 GDPR)
    Correction of inaccurate or incomplete data

  • Right to erasure (Art. 17 GDPR)
    Deletion of data where legally permissible (“right to be forgotten”)

  • Right to restriction of processing (Art. 18 GDPR)

  • Right to data portability (Art. 20 GDPR)
    Receipt of your data in a structured, machine-readable format

  • Right to object (Art. 21 GDPR)
    Especially against processing based on legitimate interests

  • Right to withdraw consent at any time (Art. 7 GDPR)

To exercise any rights, you can contact us at:
info@casageo.de

You also have the right to lodge a complaint with a supervisory authority.

13. Data Retention

We store personal data only for as long as necessary to achieve the purpose for which it was collected, or as required by:

  • statutory retention obligations (e.g., tax and commercial law),

  • contractual obligations,

  • legitimate interests (e.g., license verification, fraud prevention),

  • documentation requirements.

Typical retention periods:

  • Contract and billing data: 6–10 years

  • Server log files: a few days to several weeks

  • Contact form messages: until the inquiry is fully resolved

  • License activation data: as long as the license remains active and for required documentation periods afterward

When the retention period expires, data is routinely deleted in accordance with legal requirements.

14. Data Security

We implement extensive technical and organizational security measures (TOMs) to protect personal data against:

  • unauthorized access

  • loss or destruction

  • manipulation

  • misuse

  • unauthorized disclosure

Our systems, including the license server, customer portals, and hosted services, are maintained using current security standards (e.g., encryption, access controls, firewalls, backups).

Please note that data transmission via email may involve security risks. For highly confidential information, we recommend using encrypted channels or postal mail.

15. Updates to This Privacy Policy

We may update this Privacy Policy to reflect:

  • legal requirements,

  • technical developments, or

  • changes to our services.

The latest version is always available at:
https://casageo.de/de/datenschutz.html

If significant changes occur, we will notify customers through appropriate channels.

16. Right to Lodge a Complaint

You have the right to file a complaint with a data protection supervisory authority, in particular:

Independent Centre for Privacy Protection Schleswig-Holstein (ULD)
Holstenstraße 98
24103 Kiel, Germany
Website: https://www.datenschutzzentrum.de/

Alternatively, you may contact any other EU supervisory authority.

17. Legal Validity Notice

This English translation of our Privacy Policy is provided for convenience only.
In the event of any discrepancies or inconsistencies between the English and German texts,
the German version shall prevail and is legally binding.