Controller

CashWise UG (haftungsbeschränkt)

Heimstättenweg 140

64295 Darmstadt, Germany

Email: privacy@cashwise-app.de

Legal Basis & Purposes (Art. 6 GDPR)

• ‍‍Contract / Account / Billing (Art. 6 (1) lit. b GDPR)
• Operation / Security of the Web App (legitimate interest, Art. 6 (1) lit. f GDPR)
• Payments via Stripe (Art. 6 (1) lit. b GDPR)
• Email delivery via Twilio SendGrid (Art. 6 (1) lit. b / f GDPR)
• Legal obligations (tax / commercial law, Art. 6 (1) lit. c GDPR)
• Analytics / marketing only with consent (Art. 6 (1) lit. a GDPR)

🔗 EUR-Lex: GDPR

Data Collection When Contacting Us

We process emails and form submissions for handling requests and follow-up inquiries (Art. 6 (1) lit. f GDPR).

Categories of Data Processed

• Master data (name, company)
• Contact data (email, address)
• Contract / usage data (log files, IP, activity)
• Payment data
• Invoice and customer data (e.g., content)

Hosting & Data Transfers

CashWise runs on EU-based infrastructure:

• ‍Frontend: Bubble.io‍
• Backend: Xano.com

Both providers operate under EU Standard Contractual Clauses (SCCs) for GDPR-compliant data transfers. All data is stored on EU servers.

Recipients / Data Processors (Art. 28 GDPR)

Webflow processes technical data (IP address, browser info, form interactions) for site display and security.

 🔗 Webflow Privacy

Third-Country Transfers

Data transfers outside the EU (e.g. to the USA) are conducted exclusively on the basis of EU Standard Contractual Clauses in accordance with Art. 46 GDPR.

Retention Periods

• Contract / invoice data: duration of contract + 10 years (per AO § 147 / HGB § 257)
• Support logs: approx. 90 days (unless longer required by law)
• Marketing data: until consent is withdrawn

🔗 AO & HGB - German Commercial Law

Cookies & Tracking (TTDSG)

Non-essential cookies and trackers are only set with prior consent.  

• On first visit, a banner will appear offering: “Accept Allˮ | “Only Necessary Cookiesˮ | “Customize Settingsˮ
• Consent can be withdrawn anytime via “Change Cookie Settingsˮ in the footer  
• Consent is stored for up to 12 months

Your Rights (Art. 15–21 GDPR)

You have the right to:

• Access your data
• Rectification
• Deletion
• Restriction of processing
• Data portability
• Object to processing
• Withdraw consent at any time

Complaints can be submitted to the competent authority in Hessen (HBDI):

🔗 Datenschutzkonferenz

Automated Decisions / Profiling

No automated decision-making with legal effects takes place.

Data Protection Officer

Currently not appointed. One will be named if legally required and this notice will be updated accordingly.

Last Updated

20.07.2023