Privacy Policy

1. Data Protection at a Glance

General Information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can personally identify you. Detailed information on data protection can be found in our privacy policy listed below this text.

Data Collection on This Website

Who is responsible for data collection on this website?
Data processing on this website is carried out by the website operator. You can find their contact details in the section "Information About the Responsible Party" in this privacy policy.

How do we collect your data?
Your data is collected in one way by you providing it to us. This could be, for example, data you enter in a contact form.

Other data is collected automatically or with your consent when visiting the website by our IT systems. This is primarily technical data (e.g. internet browser, operating system, or time of page access). This data is collected automatically as soon as you enter this website.

2. Hosting

External Hosting

This website is hosted externally. The personal data collected on this website is stored on the servers of the host(s). This may include IP addresses, contact requests, metadata and communication data, contract data, contact details, names, website access, and other data generated via a website.

External hosting is carried out for the purpose of contract fulfillment with our potential and existing customers (Art. 6 Para. 1 lit. b GDPR) and in the interest of secure, fast, and efficient provision of our online offer by a professional provider (Art. 6 Para. 1 lit. f GDPR).

3. General Information and Mandatory Information

Data Protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy.

Information About the Responsible Party

The responsible party for data processing on this website is:

BeeBack UG (haftungsbeschränkt)
xhub.io is a Digital Service by BeeBack UG
Patrick Jerominek
Kreisstrasse 59
61118 Bad Vilbel

Phone: +49 6101 6569235
Email: info@xhub.io

The responsible party is the natural or legal person who alone or jointly with others determines the purposes and means of processing personal data (e.g. names, email addresses, etc.).

Data Protection Contact

For questions regarding the processing of your personal data, to exercise your rights, or to withdraw a given consent, please contact:

Email: datenschutz@xhub.io

Storage Duration

Unless a more specific storage period has been specified in this privacy policy, your personal data will remain with us until the purpose for data processing no longer applies. If you assert a legitimate request for deletion or revoke consent for data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g. tax or commercial retention periods); in the latter case, deletion will occur after these reasons no longer apply.

SSL or TLS Encryption

For security reasons and to protect the transmission of confidential content, such as orders or inquiries you send to us as the site operator, this site uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line.

4. Data Collection on This Website

Cookies

Our website uses so-called "cookies". Cookies are small data packages and do not cause any damage to your device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (permanent cookies). Session cookies are automatically deleted after your visit ends. Permanent cookies remain stored on your device until you delete them yourself or automatic deletion is performed by your web browser.

Cookies that are not required to operate the website, as well as the loading of Google Analytics and Microsoft Clarity, require your consent (Art. 6 Para. 1 lit. a GDPR, § 25 Para. 1 TDDDG). You give that consent via our cookie banner; until you do, the corresponding scripts are not loaded. Using the "Cookie preferences" link in the footer of every page you can review your choice at any time and change it with effect for the future.

Contact Form

If you send us inquiries via the contact form, your details from the inquiry form, including the contact data you provided there, will be stored by us for the purpose of processing the inquiry and in case of follow-up questions. We do not share this data without your consent.

The processing of this data is based on Art. 6 Para. 1 lit. b GDPR if your inquiry is related to the fulfillment of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of inquiries sent to us (Art. 6 Para. 1 lit. f GDPR) or on your consent (Art. 6 Para. 1 lit. a GDPR) if this was requested; consent can be revoked at any time.

Invoice check (document upload)

On the "E-invoicing readiness check" page you can send us sample invoices as PDF or XML files so that we can check them against the rules of the e-invoicing standard. In doing so we process your name, your email address, optionally your company, your information on the producing system and the recipient group, and the content of the uploaded files. Invoices usually also contain personal data of third parties, such as names, addresses and bank details of your customers or contacts. You may redact details that are not relevant to your question before uploading.

The files are not stored on our web servers. Together with your details they are transmitted as an email attachment via the delivery service Resend (see section 6) to our mailbox and processed exclusively there. You receive a confirmation of receipt by email that contains only the file names, not the files.

Legal basis: Art. 6 Para. 1 lit. b GDPR (pre-contractual measures at your request) and your consent under Art. 6 Para. 1 lit. a GDPR, which you give when submitting the form and may withdraw at any time with effect for the future. Insofar as the files contain personal data of third parties, we base the processing on our and your legitimate interest in checking the invoice (Art. 6 Para. 1 lit. f GDPR).

Storage period: Uploaded files are deleted from our mailbox no later than 30 days after the findings have been sent, or immediately at your request. Your contact details and the correspondence remain with us for as long as necessary to process your inquiry and any follow-up questions.

Inquiries by Email, Phone, or Fax

If you contact us by email, phone, or fax, your inquiry including all resulting personal data (name, inquiry) will be stored and processed by us for the purpose of handling your concern. We do not share this data without your consent.

5. Analysis Tools

Google Analytics 4

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics helps us analyse and improve the use of our website.

Google Analytics uses cookies and similar technologies to analyse your use of the website. The information collected (including truncated IP address, browser type, pages accessed, time spent, referrer) is generally transmitted to a Google server in the USA and stored there. The IP address is anonymised before storage.

Legal basis: Use is exclusively based on your consent (Art. 6 Para. 1 lit. a GDPR, § 25 Para. 1 TDDDG). Without your consent via our cookie banner, no Google Analytics cookies will be set and no data will be transmitted to Google. You can withdraw your consent at any time with effect for the future via the cookie banner.

Third-country transfer: Google transfers data to the USA. The data transfer is based on the EU Commission's Standard Contractual Clauses and on Google's certification under the EU-US Data Privacy Framework (Adequacy Decision of the European Commission dated 10 July 2023).

Retention: Data stored at user and event level that is linked to cookies is automatically deleted after 14 months. Further information can be found in Google's privacy policy: https://policies.google.com/privacy.

Microsoft Clarity

This website uses Microsoft Clarity. For users in the European Economic Area the provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland ("Microsoft").

Clarity produces heatmaps and records your session: mouse movement, clicks, scrolling, page views, time spent, and technical details such as browser, operating system, screen resolution, approximate location derived from your IP address and the address of the page you visited. The result is a replayable recording of your visit. The contents of input fields and dropdowns are masked and never reach Microsoft. In addition, we have excluded the contact form, the invoice check form including the list of uploaded file names, the newsletter sign-up and the confirmation message shown after submission from the recording.

Legal basis: Use is exclusively based on your consent (Art. 6 Para. 1 lit. a GDPR, § 25 Para. 1 TDDDG). Without your consent via our cookie banner the Clarity script is not loaded; no cookies are set and no data is transmitted to Microsoft. You can withdraw your consent at any time with effect for the future via the cookie banner.

After a withdrawal: We inform Clarity of the withdrawal immediately and delete the cookies set on our own domain, _clck and _clsk. Cookies that Microsoft sets on its own domains (including MUID, CLID, ANONCHK, MR and SM) cannot be deleted by us — please remove those via your browser settings. Recording of the page already open continues until you leave it; from the next page load the script is no longer loaded. A withdrawal in one browser tab takes effect in other open tabs only on their next page load.

Third-country transfer: The data is stored in the Microsoft Azure cloud. Microsoft Ireland Operations Limited transfers data to Microsoft Corporation in the USA on the basis of the EU Commission's Standard Contractual Clauses. By its own account Microsoft processes the data as its own controller and not on our behalf; this is therefore not processing on behalf of a controller within the meaning of Art. 28 GDPR.

Retention: According to Microsoft, recordings are available to us for up to 30 days from the time of recording. Further information can be found in Microsoft's privacy statement: https://privacy.microsoft.com/en-ie/privacystatement.

Vercel Analytics

This website uses Vercel Analytics, a web analytics service. Provider is Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA.

Vercel Analytics helps us understand how visitors interact with our website. According to the provider, each data point may record: timestamp, the address called up and its route pattern, referrer, filtered query parameters, approximate geographic origin (country, region, city), operating system, browser and device type. Time spent on a page is not measured.

No recognition via cookies: According to the provider, no third-party cookies are used; a visit is instead attributed via a hash derived from the incoming request, which is discarded after 24 hours. Visitors are not recognised across different websites, and according to the provider the recorded data points are not associated with an IP address. Since on this basis no information is stored on or read from your device, we consider the consent requirement under § 25 Para. 1 TDDDG not to apply here — unlike Google Analytics and Microsoft Clarity, which are loaded only after your consent. Vercel Analytics is therefore loaded on every page.

Legal basis: Use is based on our legitimate interest in analysing and optimising our website (Art. 6 Para. 1 lit. f GDPR). You may object to this processing under Art. 21 GDPR; the contact details are given above under "Data Protection Contact".

6. External Services and Communication Tools

Microsoft Teams

We use Microsoft Teams from our own Microsoft 365 tenant for appointments and meetings. The contact section offers links that open Teams with a chat or a call to us; the underlying Teams address is not displayed on the website. Provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland; a data processing agreement under Art. 28 GDPR is in place with Microsoft.

When you contact us via Teams or join a meeting, personal data is processed on Microsoft's servers (including IP address, device information, and the name and email address of participants), partly involving transfer to the USA. Legal basis is Art. 6 Para. 1 lit. b GDPR (pre-contractual measures) or Art. 6 Para. 1 lit. f GDPR (legitimate interest in efficient communication). Further information: https://privacy.microsoft.com/en-us/privacystatement.

Appointment booking via reception.ai (ElevenLabs)

For scheduling appointments we use a booking page with an AI-powered voice assistant provided by the service reception.ai. The provider for users in the European Economic Area is Eleven Labs Poland sp. z o.o., Lipska 27/22, 03-908 Warsaw, Poland; its parent company is Eleven Labs Inc., 169 Madison Ave #2484, New York, NY 10016, USA (together "ElevenLabs").

Only upon active click on a booking link will you be redirected to ElevenLabs' servers; the booking page opens in a new tab and is not embedded in our website. In doing so, IP address and any appointment and contact data you enter are transmitted. After booking, you receive a confirmation email from reception.ai with a confirmation number and a personal link that lets you reschedule or cancel the appointment without logging in. Legal basis is Art. 6 Para. 1 lit. b GDPR (pre-contractual measures) or Art. 6 Para. 1 lit. f GDPR (legitimate interest in efficient scheduling).

Using the voice assistant is optional; you can complete a booking without any voice input. Your microphone is only activated if you explicitly grant permission in your browser. In that case, audio data of your conversation is processed. According to ElevenLabs, voice data may constitute biometric data; it is retained for no longer than three years after your last interaction. The legal basis in this respect is your explicit consent (Art. 6 Para. 1 lit. a and, where applicable, Art. 9 Para. 2 lit. a GDPR), which you give by granting microphone access and can withdraw at any time by ending the conversation or revoking the permission.

ElevenLabs stores personal data in the USA; further processing locations are the Netherlands and Singapore. Eleven Labs Inc. is certified under the EU-US Data Privacy Framework; in addition, EU Standard Contractual Clauses apply on the basis of the ElevenLabs Data Processing Addendum. Further information: https://elevenlabs.io/privacy-policy and https://elevenlabs.io/dpa.

AI assistant on this website (ElevenLabs)

At the bottom right of our pages you will find a "Start chat or call" button. As long as you do not click it, nothing is loaded and no data is transmitted to third parties — the button is purely part of our own website.

Only upon your click do we load the assistant from ElevenLabs (provider as stated in the preceding section) via the content delivery network unpkg.com. In doing so, your IP address is transmitted to unpkg.com (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA) and to ElevenLabs; in addition, fonts are loaded from Google Fonts and a connection (WebSocket) to ElevenLabs is established. The legal basis is your consent (Art. 6 Para. 1 lit. a GDPR, Sec. 25 Para. 1 TDDDG), which you give by clicking. Without that click, none of this processing takes place.

According to our review of the shipped program code, the assistant uses the FingerprintJS library. It collects technical characteristics of your browser and device in order to recognise returning users even without cookies. Your click is the legal basis for this as well; without it, the library is not loaded.

If you wish to speak to the assistant, your browser will separately ask for microphone permission. If you grant it, audio data of your conversation is transmitted to ElevenLabs; the details on retention, processing locations and transfer mechanism stated in the preceding section apply. You can use the assistant via text input without granting microphone access at any time, or end the conversation. Reloading the page resets the assistant.

Resend (email delivery)

To send emails from our forms (contact form, invoice check, confirmations of receipt) we use the service Resend. Provider is Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. Resend transmits the email including attachments to our mailbox and temporarily stores it on its servers for delivery and error analysis.

Legal basis is Art. 6 Para. 1 lit. b GDPR (processing your inquiry) or Art. 6 Para. 1 lit. f GDPR (legitimate interest in reliable email delivery). A data processing agreement under Art. 28 GDPR is in place with Resend; transfers to the USA are based on the EU Commission's Standard Contractual Clauses (Art. 46 Para. 2 lit. c GDPR). Further information: https://resend.com/legal/privacy-policy.

7. Your Rights

You have the following rights:

• Information about your data stored with us (Art. 15 GDPR)
• Correction of incorrect data (Art. 16 GDPR)
• Deletion of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)
• Revocation of given consents (Art. 7 Para. 3 GDPR)

You also have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data by us.