🔒 Privacy Policy

🏢 1. Controller

Which company is the controller depends on where you live or are established:

• Switzerland and Liechtenstein: Ouhud Digital GmbH, Zurich — processing under the revFADP.
• Germany, EU/EEA and all other countries: Ouhud GmbH, Düsseldorf — processing under the GDPR and BDSG.

Both companies use the same technical platform and the same processors. You may exercise your rights with either address; we forward your request internally to the competent entity.

🏛️ 1a. Right to lodge a complaint

Germany/EU

You have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). For Ouhud GmbH this is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia, Kavalleriestraße 2–4, 40213 Düsseldorf — www.ldi.nrw.de.

Switzerland

In Switzerland you may contact the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern — www.edoeb.admin.ch.

📋 2. Data Categories

• Registration: name, email, hashed password
• Usage: created QR codes, anonymized scan statistics
• Profile (optional): address, phone and related data
• Payments: transaction and billing data (Stripe)
• Server logs: IP, browser, date/time for security purposes

⚖️ 3. Purposes and Legal Basis

• Contract performance (Art. 6(1)(b) GDPR)
• Legal obligations (Art. 6(1)(c) GDPR)
• Legitimate interests (Art. 6(1)(f) GDPR)
• Consent (Art. 6(1)(a) GDPR)

revFADP

The Swiss revFADP does not require a separate legal basis for processing by private persons. We process your data in good faith and in line with the principles of purpose limitation, proportionality and data accuracy (Art. 6 revFADP). We obtain consent where the law requires it (Art. 6(6) revFADP), in particular for sensitive personal data and high-risk profiling.

🌐 4. Recipients and Transfers

• Payment processor: Stripe Payments Europe Ltd.
• Hosting/IT: providers and processors in the EU and Switzerland
• Within the Ouhud group: exchange between Ouhud GmbH and Ouhud Digital GmbH where necessary to operate and support the platform
• Authorities: only if legally required

International transfers. Switzerland and the European Commission mutually recognise an adequate level of data protection, so transfers between Germany and Switzerland require no additional safeguards. Transfers to other countries take place only where an adequacy decision exists or appropriate safeguards are in place (standard contractual clauses under Art. 46 GDPR or Art. 16 revFADP).

⏳ 5. Retention

• Data is stored only as long as needed for the purpose.
• Accounts can be deleted via settings or support request.
• Billing data may be retained based on statutory retention duties.

🧍 6. Your Rights

• Access, rectification, erasure
• Restriction, portability, objection
• Withdrawal of consent at any time

These rights apply under the GDPR as well as under the revFADP (Art. 25 et seq.). Please use the address given in section 1.

🍪 7. Cookies

We use essential cookies. Optional analytics/marketing cookies are only used with your consent.

💳 8. Payments

Payments are processed by Stripe. We do not store full payment card data on our servers. Stripe Privacy Policy

🔐 9. Security

• SSL/TLS encryption
• Password hashing (BCrypt)
• Access control and regular security checks

📄 10. Updates

This policy is updated when legal or technical changes require it.

📧 11. Contact

Germany/EU: info@ouhud.com
Switzerland: info@ouhud.ch

We have not appointed a data protection officer, as the statutory requirements for doing so are currently not met.