1. Data Controller

BelegX GmbH is the data controller for personal data processed through our services.

2. Data We Collect

We collect and process the following categories of data:

• Account information (name, email, password hash)
• Company information (legal name, address, VAT ID)
• Invoice data (files, metadata, email content)
• Usage data (logs, analytics)

3. Purpose of Processing

We process your data to:

• Provide and maintain our services
• Process and forward invoices
• Send service-related communications
• Comply with legal obligations

4. Legal Basis

We process your data based on contract performance, legitimate interests, and legal obligations under GDPR.

5. Data Retention

We retain your data for as long as your account is active or as needed to provide services. Invoice data is retained according to legal requirements (typically 10 years in Germany).

6. Subprocessors

We use the following subprocessors:

• Hetzner Online GmbH (hosting)
• Stripe, Inc. (payment processing)
• Postmark (email delivery)

7. Your Rights

Under GDPR, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Request deletion of your data
• Data portability
• Object to processing

8. Contact

For privacy-related inquiries, contact our Data Protection Officer at privacy@belegx.de.