Privacy

We have built this website to use as little data as possible. treatio.de does not use cookies to recognise visitors, does not integrate analytics or tracking tools and does not load content from third-party servers simply when you visit. Further data is processed only when you take action yourself, for example by completing a form during onboarding on /start or /en/start, or loading the appointment calendar. The details are explained below.

1. Controller

The controller responsible for processing data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Controller

Amphora IT GbR
Seekampstraße 9
28309 Bremen
Germany

Represented by

Marcel Henning
Salam Rouabhia

Email

hallo@treatio.de

Phone

+49 1511 5820939

We have not appointed a data protection officer because the statutory requirements for doing so do not apply to us. For any questions about privacy, you can contact us directly at the address above.

2. Hosting and server log files

This website is hosted by Vercel. The provider is Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. The website is delivered from the Frankfurt am Main region.

When you access treatio.de, the host processes technically necessary access data in server log files. This includes:

• Your device’s IP address
• Date and time of access
• The page or file accessed
• The volume of data transferred and status code
• Browser type and version
• Operating system
• The previously visited page (referrer), if transmitted

This data is technically necessary to operate the website: without an IP address, a server cannot deliver a page to you. We do not combine log files with other data or analyse them in relation to individuals. They are used to deliver the website, maintain its stability and prevent attacks.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is in the technically correct presentation and security of our website.

We have a data processing agreement with Vercel under Article 28 GDPR. Further information is available in the provider’s privacy policy.

3. No cookies or audience measurement

treatio.de does not store cookies on your device to recognise you and does not use local storage or similar technologies for that purpose. We do not use analytics tools, whether Google Analytics or a comparable service. We do not create usage profiles or integrate advertising networks.

The only exception is the Calendly appointment calendar in the third onboarding step. The calendar loads automatically at that point, and Calendly may set technically necessary cookies. See section 9 for details.

4. Fonts and embedded content

All fonts are delivered with the website and stored on the same server as the website itself. No connection is made to Google Fonts or another external font service. Images, icons and scripts also come exclusively from our own build during a simple visit.

Two exceptions arise only through your own use of onboarding on /start or /en/start: if we find your studio’s logo on your website, the app preview loads that image directly from there, so your browser connects to your own website. When you load the appointment calendar, your browser connects to Calendly (section 9).

5. Contact by email and phone

Most contact buttons open your own email application with our address. No data is sent to us unless you send the message yourself.

If you contact us by email or phone, we process the information you provide, particularly your name, contact details and enquiry. We use this data exclusively to respond to your enquiry and handle related communication. We do not pass it on without your consent.

The legal basis is Article 6(1)(b) GDPR where your enquiry concerns entering into or performing a contract. In all other cases, we rely on our legitimate interest in responding to enquiries under Article 6(1)(f) GDPR.

6. Onboarding on /start and the home page

On /start, /en/start and in the “App preview” section of the home page, you can select your studio, design an app preview and send us an enquiry. We process the data you enter or select:

• Your studio’s name, address, website and phone number, where listed on Google Maps
• Your design: app name, brand colour, typeface and studio logo, taken from your website or uploaded by you
• Your contact details: first name, last name, email address and, if provided, phone number

You provide your contact details in the third step, directly in the appointment calendar: you book an introductory call and enter the information requested by Calendly. We then retrieve that information through Calendly’s API to associate your booking with your app preview (section 9). If you do not want to book an appointment, you can choose “I would rather be contacted” and enter your name, email address and optional phone number directly with us. No data is sent to Calendly for that form.

We use these details to prepare your studio app mock-up, process your enquiry and contact you about it. We create an internal handover file for our team from the information. The legal basis is Article 6(1)(b) GDPR (steps towards a contract at your request).

We only email you news and offers if you expressly allow this by ticking the form’s checkbox (consent under Article 6(1)(a) GDPR). Consent is voluntary, is not required for your enquiry and may be withdrawn at any time with effect for the future, for example by emailing hallo@treatio.de.

7. Studio search through Google Places

We use Google’s Places API for studio searches during onboarding (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, USA). The search runs through our server: your browser sends the search text to treatio.de, our server queries Google and returns the results. Your browser does not connect directly to Google, and we do not pass your IP address to Google. The search text you enter and your selection are transmitted.

The legal basis is Article 6(1)(b) GDPR because the search is part of your enquiry. Further information: Google’s privacy policy.

8. Research about your studio

When you select your studio during onboarding or provide your website, we retrieve publicly available information about your studio to prepare your enquiry, particularly your logo and information from your own website such as treatments and prices. This data is therefore not always obtained directly from you; its sources are your Google Maps listing and your own website (information under Article 14 GDPR). The legal basis is Article 6(1)(b) GDPR, supplemented by our legitimate interest in a well-prepared consultation under Article 6(1)(f) GDPR.

9. Appointment booking through Calendly

We use Calendly to book introductory calls, a service provided by Calendly LLC, 1315 Peachtree St NE, Atlanta, GA 30309, USA. The calendar is the third onboarding step and loads automatically when you reach it. In the second step, you first confirm that you have read this privacy policy. Once you open the calendar, your browser connects to Calendly and Calendly’s privacy information also applies. When booking, Calendly processes the information you provide, particularly your first and last name, email address, any phone number provided and your chosen appointment, together with technical data such as your IP address.

After booking, we retrieve this information through Calendly’s API and store it with your app preview in our enquiry management system to prepare your call. If you do not want to use the calendar, “I would rather be contacted” takes you to our own form; your enquiry then reaches us without Calendly. Without a booking or that form, nothing from your visit is retained by us. The legal basis is Article 6(1)(b) GDPR. Section 13 applies to transfers to the USA. Further information: Calendly’s privacy policy.

10. Enquiry management (ClickUp)

We manage onboarding enquiries in ClickUp, a task management tool provided by ClickUp Corp., 350 Tenth Avenue, San Diego, CA 92101, USA. We store the details from your enquiry, including the internal handover file, to carry out onboarding. ClickUp processes this data on our behalf under a data processing agreement pursuant to Article 28 GDPR. Section 13 applies to transfers to the USA. Further information: ClickUp’s privacy policy.

11. Encrypted transmission

This website is delivered exclusively over a TLS-encrypted connection. You can recognise this by the browser address beginning with https and the padlock symbol. Content you send to us is thereby protected from being read by third parties in transit.

12. Retention periods

Our host automatically deletes server log files after no more than 30 days, unless they are exceptionally needed for longer to investigate a specific security incident.

We retain onboarding, email and phone enquiries for as long as necessary to process them. If no contract is concluded, we delete the data no later than twelve months after the last contact, unless statutory retention obligations prevent this. Commercial and tax retention periods are six or ten years, depending on the document.

13. Transfers to third countries

Our host Vercel Inc. and providers Calendly LLC and ClickUp Corp. are based in the USA; the Places search is ultimately also operated by Google LLC, based in the USA. This website is delivered from the Frankfurt am Main region, but access from the USA during operation and maintenance cannot be completely ruled out.

Transfers in these cases are safeguarded: the providers mentioned are certified under the EU–US Data Privacy Framework, or we have agreed the European Commission’s Standard Contractual Clauses with them under Article 46(2)(c) GDPR. In its adequacy decision of 10 July 2023, the European Commission found that US companies certified under the Framework provide an adequate level of data protection.

14. Your rights

You have the following rights against us regarding your personal data at any time:

• Access to information about whether and what data we process about you (Article 15 GDPR)
• Rectification of inaccurate or incomplete data (Article 16 GDPR)
• Erasure of your data (Article 17 GDPR)
• Restriction of processing (Article 18 GDPR)
• Data portability in a commonly used, machine-readable format (Article 20 GDPR)
• Objection to processing based on a legitimate interest (Article 21 GDPR)
• Withdrawal of consent with effect for the future (Article 7(3) GDPR)

An informal message to hallo@treatio.de is sufficient. There is no charge for exercising these rights.

Right to object under Article 21 GDPR

Where we process data on the basis of legitimate interests under Article 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation. We will then stop processing the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

15. Complaints to the supervisory authority

If you believe we are not processing your data lawfully, you may complain to a data protection supervisory authority (Article 77 GDPR). The authority responsible for us is:

The State Commissioner for Data Protection and Freedom of Information of the Free Hanseatic City of Bremen
Arndtstraße 1
27570 Bremerhaven
Phone: +49 421 361 2010
Email: office@datenschutz.bremen.de
www.datenschutz.bremen.de

You also retain the right to seek a judicial remedy. You may also contact the supervisory authority for your habitual residence or workplace.

16. No automated decision-making

We do not use automated decision-making or profiling under Article 22 GDPR in connection with this website.

17. Privacy in the Treatio platform

This policy applies to the treatio.de website. Separate provisions apply to studios and their clients using the Treatio platform and app. There, we process personal data on behalf of the respective studio under a data processing agreement pursuant to Article 28 GDPR. The studio operating the app is the controller for this data. Details are set out in the respective SaaS contract, our terms and conditions and the associated data processing agreement.

18. Changes to this privacy policy

We update this privacy policy when the law or our processing changes, for example when we introduce a new website feature. The version available here applies.