Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

SpuhlerLabs UG (haftungsbeschränkt)

Rambacher Straße 79

65193 Wiesbaden, Germany

Commercial register: Local Court (Amtsgericht) Wiesbaden, HRB 36825

Managing director: Tom Spuhler

E-mail: [email protected]

A data protection officer has not been appointed, as the statutory requirements for such an appointment are not met.

2. Overview: What Copreo Does

Copreo is a personal finance management app. You can connect bank accounts, credit cards and securities accounts; the app shows you balances, transactions and analyses (budgets, categories, recurring payments). Technical access to your accounts is performed via the licensed account information service BANKSapi Technology GmbH (see section 6.1). We do not use any advertising or tracking SDKs and do not display advertising.

This Privacy Policy applies to the Copreo app (sections 3 to 13) and to our website https://copreo.com (section 14). The information on the controller (section 1) and on your rights (section 10) applies to both.

3. Categories of Data Processed

Account and profile data: first name, last name, e-mail address, password (stored only as a hash), optionally profile picture and language setting; when using "Sign in with Apple" or "Sign in with Google", the data transmitted by the respective provider (name, e-mail address, identity token or OAuth token). When signing in via Apple or Google, the app additionally requests first and last name.

Security data: optionally an app lock code (6-digit PIN, stored only as a hash) and a local flag indicating whether biometric unlocking is enabled. Biometric data itself (e.g. face or fingerprint data) remains exclusively on your device and is never processed by us.

Banking and financial data: IBAN, BIC, account holder, bank name, account name, account type, balances and currencies; transaction data (amount, currency, booking/value date, name/IBAN/BIC of the counterparty, payment reference, booking text, mandate reference, end-to-end ID, creditor ID); for connected securities accounts, securities data (name, ISIN, WKN, quantity, price).

Content created by you: budgets (name, icon, colour, limits, categories), manually created or edited recurring payments including free-text notes, feedback messages (free text), search queries in the app.

Device and usage data: if push notifications are enabled, a push token, platform (iOS/Android) and device name; server-side for each login, IP address and user agent (session metadata); when submitting feedback, automatically the app version, platform, operating system version and language.

Contract and payment data: for in-app purchases, the purchase evidence transmitted by the respective store (Apple: transaction ID; Google: purchase token). We do not receive your payment details (e.g. credit card number); payment processing is performed entirely by Apple or Google.

Consent data: a consent record (purpose, version, time of granting and, if applicable, revocation, source) with which we demonstrate the lawfulness of processing (Art. 7 (1) GDPR).

Deletion data: where account deletion has been requested, the time of the request, the scheduled execution time and a cancellation token (as a hash).

4.1 Provision of the app and the user account

(registration, login, profile management, app lock, subscription management): Art. 6 (1) (b) GDPR (performance of a contract).

4.2 Account access and display of your financial data

Your account and transaction data is retrieved via BANKSapi only after your explicit consent, which you actively grant in the app (consent purpose "bank account access"); the legal basis is Art. 6 (1) (a) GDPR.

Insofar as transaction data may in individual cases allow conclusions about special categories of personal data (e.g. payments to trade unions, religious institutions or healthcare providers), we base the processing on your explicit consent pursuant to Art. 9 (2) (a) GDPR.

In addition, you authorise the account access vis-à-vis your bank in accordance with its requirements — as a rule via PSD2 interfaces with strong customer authentication; for individual banks, access is performed via other access channels operated by BANKSapi (e.g. online banking interfaces). The authorisation is limited in time and must be renewed periodically.

4.3 Automatic analysis of your transactions

(categorisation, detection of recurring payments, budget analysis): only after separate consent (purpose "transaction analysis"), Art. 6 (1) (a) GDPR. Without this consent, no automatic categorisation and no automatic detection of recurring payments takes place.

4.4 Merchant enrichment

(assignment of merchant names and logos to your transactions, partly AI-assisted): only after separate consent (purpose "merchant enrichment"), Art. 6 (1) (a) GDPR. Only public merchant names or domains are transmitted to the service providers named in section 6 — not your name, not your IBAN and not the full payment reference.

4.5 Participation in the collaborative categorisation system ("crowd learning")

Only after separate consent (purpose "crowd contribution"), Art. 6 (1) (a) GDPR. Your corrections to merchant assignments then flow into the collaborative categorisation system in aggregated form. Sensitive categories are excluded from collaborative analysis. Without consent, your data is excluded from all collaborative analyses by means of a technical filter.

All four consents under 4.2–4.5 can be revoked individually at any time with effect for the future in the settings under "Security & Privacy" (section 10). None of the consents is pre-selected.

4.6 Notifications and summaries

(push messages, weekly/monthly recaps by e-mail): Push notifications require your permission at operating system level. We send summaries on the basis of Art. 6 (1) (b) GDPR as part of the Service; you can adjust frequency and content in the notification settings or deactivate them entirely.

4.7 Transactional e-mails

(e-mail confirmation, password reset, deletion confirmations and reminders, security notices): Art. 6 (1) (b) GDPR.

4.8 Purchase and subscription management

(verification of in-app purchases with Apple/Google): Art. 6 (1) (b) GDPR and Art. 6 (1) (c) GDPR (commercial and tax law obligations).

4.9 Security and abuse prevention

(session management including IP address and user agent, error logs, access restrictions): Art. 6 (1) (f) GDPR. Our legitimate interest lies in securing the systems, detecting abuse and troubleshooting.

4.10 Feedback feature

Art. 6 (1) (f) GDPR (legitimate interest in improving the Service). Use is voluntary.

4.11 Evidence of consents and deletions

(consent record, pseudonymised event records): Art. 6 (1) (c) GDPR in conjunction with Art. 5 (2), Art. 7 (1) GDPR (accountability).

5. Origin of the Data; the Data Handover Point at BANKSapi

We do not collect your banking and financial data from your bank ourselves. The process is as follows:

1. You initiate the account connection in the app and are redirected to an environment provided by BANKSapi Technology GmbH.

2. There, you enter your online banking credentials and authorise access vis-à-vis your bank. Your online banking credentials are never transmitted to us or stored by us. For this process, BANKSapi is responsible under data protection law as a licensed account information service; BANKSapi's privacy notices additionally apply in this respect.

3. BANKSapi retrieves the account and transaction data from your bank and makes it available to us via a secured interface. The data handover point — the point at which responsibility under data protection law passes from BANKSapi to us — lies at this interface: From receipt of the data at the interface, we are the controller for the further processing in Copreo; BANKSapi is responsible for the collection from the bank and the processing up to the handover.

4. BANKSapi does not verify the data transmitted by the banks for accuracy or completeness; the data is displayed in Copreo exactly as handed over (see also § 5 of our Terms of Service).

6. Recipients of the Data

We transmit personal data only insofar as necessary for the respective purposes and have concluded contracts pursuant to Art. 28 GDPR with processors.

6.1 BANKSapi Technology GmbH (Account Aggregation)

BANKSapi Technology GmbH, Pettenkoferstr. 35, 80336 Munich, Germany. As part of the account connection, BANKSapi receives the data required to connect the account and provides us with your account and transaction data (section 5). For the regulated account access, BANKSapi is an independent controller; insofar as BANKSapi additionally processes data on our behalf, this is done on the basis of a data processing agreement.

Contractually approved sub-processors used by BANKSapi:

noris network AG — Nuremberg, Germany — Data centre operation

Niiio wealth management GmbH (formerly fundsaccess AG) — Görlitz, Germany — Technical administration

Finconomy AG — Munich, Germany — Commercial administration

Hawk AI GmbH — Munich, Germany — Support in investigating suspicious cases under the German Anti-Money Laundering Act

Bios-tec GmbH — Munich, Germany — Client administration (Windows/Microsoft)

SurePay B.V. — Utrecht, Netherlands — Support with payee verification

All of BANKSapi's sub-processors are established in the European Union; the data centre for the operation of BANKSapi's systems is operated by noris network AG in Nuremberg. No third-country transfer takes place on this processing path.

6.2 Further Recipients

Anthropic PBC (Claude API), USA — AI-assisted merchant categorisation. Only public merchant names or domains and category lists are transmitted; no user names, no IBANs, no full payment references. Only where the "merchant enrichment" consent has been granted (section 4.4). For the third-country transfer, see section 7.

Apple Inc. / Apple Distribution International Ltd. — "Sign in with Apple" (name, e-mail, identity token) and verification of in-app purchases (opaque transaction ID). Apple is an independent controller for App Store distribution and payment processing.

Google Ireland Ltd. / Google LLC — "Sign in with Google" (name, e-mail address, OAuth token), verification of in-app purchases via Google Play (purchase token) and receipt of subscription status notifications. Google is an independent controller for Play Store distribution and payment processing.

Netcup GmbH (object storage) — Storage of merchant logo images and of data export archives created in connection with access/portability requests; data centre in Germany. Data export archives are additionally encrypted before storage (AES-256-GCM) and are available only via access-protected retrieval.

650 Industries, Inc. ("Expo"), USA (push service) — Delivery of push notifications (push token, title, message text, linked content where applicable). Push content may contain financial information such as amounts or merchant names; you control this via the notification settings and can deactivate push notifications entirely. For the third-country transfer, see section 7.

logo.dev, Wikimedia Foundation (Wikidata / Wikimedia Commons) and merchant websites — To obtain logos and brand data, we transmit only public merchant names or domains as search terms (logo.dev only where the "merchant enrichment" consent has been granted). No personal data of our users is transmitted to these services; they are therefore not recipients of personal data within the meaning of the GDPR.

Own e-mail server — Dispatch of transactional e-mails via a self-operated mail server infrastructure with server location in Germany; no external e-mail service provider is used.

Hosting — Backend and database are operated at Netcup GmbH, Karlsruhe, in data centres in Germany.

Beyond this, we disclose data only where we are legally obliged to do so (e.g. to financial or law enforcement authorities) or where you have consented.

7. Third-Country Transfers

The processing of your data takes place predominantly in Germany: Our backend, our database and our object storage are operated at Netcup GmbH in German data centres, our e-mail server is located in Germany, and BANKSapi operates its systems in the data centre of noris network AG in Nuremberg. All of BANKSapi's sub-processors are established in the European Union (section 6.1).

In the following cases, personal data is transferred to the USA:

Anthropic PBC, San Francisco, USA (AI-assisted merchant categorisation, section 4.4): The transfer is based on a data processing agreement (Data Processing Addendum) incorporating the standard contractual clauses of the EU Commission pursuant to Art. 46 (2) (c) GDPR. As an additional safeguard within the meaning of EDPB Recommendations 01/2020, we strictly limit the transmitted data to public merchant names or domains and category lists — no names, account data, IBANs or payment references of our users are transmitted, so that identifiability for the recipient is excluded to the greatest extent possible.

Apple Inc., Cupertino, USA ("Sign in with Apple" and verification of in-app purchases): Apple Inc. is certified under the EU-U.S. Data Privacy Framework; the transfer is based on the adequacy decision of the EU Commission pursuant to Art. 45 (3) GDPR. The contracting party for App Store distribution in the EEA is Apple Distribution International Ltd., Ireland.

Google LLC, Mountain View, USA ("Sign in with Google", verification of in-app purchases via Google Play, subscription status notifications): Google LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 (3) GDPR); the contracting party in the EEA is Google Ireland Ltd. In addition, the standard contractual clauses offered by Google apply.

650 Industries, Inc. ("Expo"), USA (delivery of push notifications): Push tokens and notification content are transmitted. Expo has committed to the principles of the EU-U.S. Data Privacy Framework; in addition, the standard contractual clauses from the data processing agreement apply (Art. 46 (2) (c) GDPR). You control the scope of the content in push notifications yourself via the notification settings; without activated push notifications, no transfer to Expo takes place.

Only public merchant names or domains are transmitted to logo.dev, the Wikimedia Foundation and merchant websites (section 6.2); no third-country transfer of personal data takes place in this respect.

You can view the current certification status of recipients under the EU-U.S. Data Privacy Framework at dataprivacyframework.gov. We will provide you with copies of the relevant safeguards (standard contractual clauses) upon request to [email protected].

8. Retention and Deletion

User account: You can request the deletion of your account at any time in the app under "Profile → Settings → Account → Delete account" or via the form at copreo.com/delete-account.

Immediate effect of the request: Upon receipt of the request, access to your account is locked immediately and all existing sessions are ended. The access authorisations (consents) assigned to your account at our account information service BANKSapi Technology GmbH are revoked without undue delay; from that point on, no further financial data is retrieved from your banks.

Grace period: Final deletion takes place seven days after receipt of the request. Your account and the linked data (profile, banking and transaction data, budgets, recurring payments, portfolio data, devices, search history, feedback) are then permanently deleted. During the grace period, the processing of your data is limited to its storage and to handling any cancellation; no analysis or other use takes place. We remind you by e-mail three days and one day before execution.

Purpose of the grace period: It protects against unauthorised deletion of your account, in particular following a takeover of your access, as well as against accidental deletion. It is measured by the period within which a private e-mail inbox is usually checked at least once. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in preventing abusive deletion requests.

Cancellation: You can cancel the deletion at any time before execution via the link in our confirmation e-mail or in the app. After a cancellation, your account can be used unchanged; however, you must grant the access authorisations at your banks again, as these have already been revoked.

Deletion without a grace period: At your express request, we carry out the deletion immediately. This option is available in the app and upon request via our support address.

Evidence records: Certain event records (subscription entitlements, bank connection events, account linkage metadata) are not deleted upon account deletion but pseudonymised — your user identifier is replaced by a random, non-traceable value. These pseudonymised records serve as evidence of proper processing (Art. 5 (2) GDPR) and billing integrity.

Sessions: Login sessions expire after 30 days at the latest; expired sessions are automatically deleted every hour.

Data export archives: Export archives created in connection with access or portability requests are stored in encrypted form and automatically deleted after 14 days.

After subscription end: After a subscription expires, your account remains in read-only mode for 90 days; thereafter, access is locked. Your data remains stored until an account deletion so that you can resume the Service later or export your data.

After trial month/test phase: If a free trial period ends without a subscription being concluded, access to the content is locked. Your data remains stored until an account deletion so that you can resume the Service later with a subscription; account deletion is possible at any time.

Statutory retention obligations: We retain invoice- and accounting-relevant data in accordance with the commercial and tax law retention periods (Section 257 of the German Commercial Code (HGB), Section 147 of the German Fiscal Code (AO): up to 10 years).

Local data on your device: Settings (theme, language, account order, etc.), the session token and the logo image cache are stored locally on your device (section 12) and can be completely removed by uninstalling the app.

9. Security of Processing

We implement technical and organisational measures pursuant to Art. 32 GDPR, in particular:

– transport encryption (TLS) for all connections between app, backend and third-party services;

– additional application-level encryption (AES-256-GCM) for bank account, transaction, portfolio and recurring payment data in the database — this data is not stored there in plain text;

– storage of passwords and app PINs exclusively as cryptographic hashes;

– encrypted storage of OAuth tokens and of data export archives;

– redaction of session and authentication characteristics in system and error logs;

– data minimisation in internal processing queues (e-mail dispatch without storing content or addresses in intermediate stores);

– role-based access controls and logged administrative access;

– local protection of the app via optional lock code and biometrics.

10. Your Rights

You have the following rights; an informal message to [email protected] is sufficient to exercise them:

Access (Art. 15 GDPR) and data portability (Art. 20 GDPR): Upon request, we create a complete export of your data in a structured, commonly used, machine-readable format (JSON and CSV) and provide it to you as a time-limited download. Processing takes place without undue delay, at the latest within one month.

Rectification (Art. 16 GDPR): You can correct profile data (name, e-mail, password) directly in the app. We cannot change the content of financial data transmitted by your bank; please contact your account-holding bank in this respect.

Erasure (Art. 17 GDPR): via self-service in the app (section 8) or via the form at copreo.com/delete-account. Deletion requests you send us by e-mail go through the same procedure under section 8.

Restriction of processing (Art. 18 GDPR): upon request to [email protected].

Objection (Art. 21 GDPR): You may object at any time, on grounds relating to your particular situation, to processing based on Art. 6 (1) (f) GDPR.

Withdrawal of consents (Art. 7 (3) GDPR): You can withdraw each of the consents named in sections 4.2–4.5 individually at any time in the app under Settings → Security & Privacy. The withdrawal takes effect for the future; the lawfulness of processing carried out until then remains unaffected. Withdrawing the "bank account access" purpose results in all bank connections being disconnected, access at BANKSapi being revoked and no new financial data being retrieved.

Complaint (Art. 77 GDPR): You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.

11. Automated Categorisation; No Automated Decision-Making

The app categorises transactions and detects recurring payments automatically (only with consent, sections 4.3–4.4), partly using AI services. These analyses serve solely for your information; no automated decision-making with legal effect or similarly significant impact within the meaning of Art. 22 GDPR takes place. You can manually change any automatic categorisation; your manual assignment always takes precedence.

12. Local Storage on Your Device; No Advertising Cookies, No Tracking

The app does not use any analytics, tracking or advertising services and does not display a cookie banner, because only technically necessary storage operations take place (Section 25 (2) no. 2 of the German TDDDG):

– session token for login (in secure device storage / SecureStore; in the web version as a cookie or in browser storage, duration 30 days);

– settings flags (theme, language, onboarding status, account order, hidden accounts, logo display, biometrics activation, etc.) in local device storage;

– temporary connection state during the bank redirect (web version only, deleted after completion);

– image cache for merchant logos on the device.

This local data does not leave your device (with the exception of the session token used for authentication with our server) and is removed when the app is uninstalled.

13. No Obligation to Provide Data; Necessity

Providing name, e-mail address and password is required for registration; without this information, the user account cannot be created. Connecting bank accounts is required for the core function of the app but is based on your voluntary consent. All other information (profile picture, PIN, feedback, etc.) is voluntary.

14. Visiting Our Website copreo.com

The website https://copreo.com provides information about the app as well as the help page, the bank directory, the legal texts and the account deletion form. There is no user account or login on the website. We do not use any cookies of our own, no analytics, audience measurement, tracking or advertising services and no social media plugins; no usage profiles are created. Only our upstream security and CDN provider Cloudflare may set technically necessary security cookies (sections 14.3 and 14.8).

The controller for processing in connection with visits to the website is likewise SpuhlerLabs UG (haftungsbeschränkt) as named in section 1. The rights described in section 10, the right to lodge a complaint with the supervisory authority and the statement in section 11 that no automated decision-making takes place apply accordingly to the website.

14.1 Hosting of the website

The website is operated as a static site on a server rented by us from Contabo GmbH, Aschauer Straße 32a, 81549 Munich, Germany ("Contabo"). The server is located in a data centre in Germany. When you access the website, Contabo processes on our behalf the technical data transmitted by your browser (section 14.2).

The legal basis is our legitimate interest in the secure and efficient provision of our online offering (Art. 6 (1) (f) GDPR). A data processing agreement pursuant to Art. 28 GDPR is in place with Contabo.

14.2 Server log files

Each time the website is accessed, our server automatically records information transmitted by your browser: the IP address of the requesting device, date and time of access, the page or file accessed, the amount of data transferred and the status of the retrieval, the referrer URL (previously visited page) where transmitted, as well as browser type, browser version and operating system.

This data is processed to enable delivery of the website, to ensure system security and stability and to prevent abuse (e.g. attacks). The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in technically error-free and secure operation).

Log files are generally deleted automatically after 7 days at the latest. Individual data may be retained longer where necessary to investigate or defend against a specific case of abuse or attack (30 days at most). We do not combine this data with other data sources to identify you.

14.3 Content delivery network and DNS (Cloudflare)

For the secure and performant provision of the website, we use services of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA ("Cloudflare"). Cloudflare provides DNS resolution and an upstream reverse proxy or content delivery network (CDN) for us. As a result, traffic between your browser and our server is routed through Cloudflare's infrastructure.

In this context, Cloudflare processes technical connection data, in particular your IP address, in order to deliver content, encrypt the connection via TLS and protect the website against attacks (e.g. DDoS) and abuse. For this purpose, Cloudflare may set technically necessary security cookies on your device (section 14.8). The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in the security, availability and delivery speed of the website.

Cloudflare is established in the USA, so personal data may be transferred to the USA. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework (DPF); the transfer is therefore based on the adequacy decision of the European Commission of 10 July 2023 pursuant to Art. 45 GDPR. In addition, Cloudflare has concluded EU standard contractual clauses as appropriate safeguards within the meaning of Art. 46 GDPR, which remain in place should the DPF certification lapse. A data processing agreement pursuant to Art. 28 GDPR is also in place with Cloudflare. Further information is available at cloudflare.com/privacypolicy.

14.4 Contact form and contact by e-mail

We offer a contact form on the help page. If you use it, we process your name, your e-mail address and the content of your message in order to handle and respond to your enquiry. To prevent spam and abuse, our mail server additionally processes your IP address and the date and time of submission; the form also contains a control field invisible to people, and filling it in automatically marks the message as spam.

Technical process: The form data is not stored in a database on the website but is delivered directly as an e-mail to our support mailbox via our self-operated mail server (Stalwart, hosted at Contabo in Germany). It is not passed on to any other third parties.

The legal basis is our legitimate interest in receiving and responding to your enquiry in your interest (Art. 6 (1) (f) GDPR). If your enquiry is aimed at concluding or performing a contract, Art. 6 (1) (b) GDPR is an additional legal basis. Alternatively, you can contact us directly by e-mail at [email protected]; in that case we process the data transmitted with the e-mail to handle your request.

Retention: We store your enquiry until it has been fully dealt with and no reasons for further retention remain. The data is then deleted unless statutory retention obligations prevent this. You may object at any time, on grounds relating to your particular situation, to processing based on legitimate interests (section 10).

14.5 Account deletion form

At copreo.com/delete-account you can request the deletion of your Copreo account even without the app installed. In doing so, we process the e-mail address you enter, the time of the request and, to prevent automated abuse, an invisible control field, the time taken to complete the form and – for a temporary limit on requests per connection – your IP address.

The request is transmitted to our app backend (Netcup GmbH, data centre in Germany, section 6.2). If an account exists for the address given, we send you an e-mail with a confirmation link valid for 30 minutes; the deletion procedure described in section 8 begins only when that link is opened. The website does not reveal whether an account exists for the address.

The legal basis is Art. 6 (1) (c) GDPR in conjunction with Art. 12 and 17 GDPR (fulfilment of your right to erasure) and, for abuse prevention, Art. 6 (1) (f) GDPR. Unconfirmed requests are not processed further once the confirmation link has expired.

14.6 Requests to our app backend

Some website content is loaded by your browser from our app backend at app.copreo.app when a page is opened: on the home page, the current test phase figures (available places), and in the bank directory, the logos of individual banks. During these requests, our backend server (Netcup GmbH, data centre in Germany) receives the technical data listed in section 14.2, in particular your IP address. No cookies are set and no identifiers are assigned; the requests are not linked to a user account.

The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in displaying up-to-date content without using external service providers). The list of supported banks itself is retrieved when the website is built and delivered statically; no personal data is processed in that process.

14.7 Fonts, icons and links to the app stores

The Fraunces typeface used on the website is served locally from our own server; the remaining text uses your device's system fonts. Icons are embedded directly in the page. No connection is made to third-party servers (in particular not to Google Fonts or external icon services).

The website contains links to the Apple App Store and Google Play. These are plain links without embedded content; data is transmitted to Apple or Google only when you click a link, and they are independent controllers in that respect. On iPhones and iPads, Safari may display a banner pointing to the app in the App Store based on a marker in the page source (Smart App Banner); the banner is rendered by the browser itself and we receive no data in the process.

14.8 Cookies on the website

We do not use any cookies of our own on the website and no analytics, audience measurement, tracking or advertising cookies. No usage profiles are created. The website therefore does not require a cookie banner.

For technical reasons, our upstream provider Cloudflare (section 14.3) may store the following cookies on your device as part of its security functions: "__cf_bm" – detection and prevention of automated traffic (bot management), stored for 30 minutes after the last activity, with no link to a user identifier and no cross-site tracking; "cf_clearance" – records that a security check (e.g. a JavaScript or captcha challenge) has been passed in order to avoid repeated checks, stored for the configured validity period of the security clearance.

These cookies serve solely the security and smooth operation of the website and are strictly necessary for its provision. They are therefore technically necessary within the meaning of Section 25 (2) no. 2 of the German TDDDG, so no consent is required for their storage. The legal basis for the associated processing of personal data is Art. 6 (1) (f) GDPR. You can control the storage of cookies via your browser settings or delete cookies that have already been set; if technically necessary security cookies are disabled, the website may not be reachable or may not be fully reachable.

14.9 Recipients and data security on the website

The following processors within the meaning of Art. 28 GDPR are involved in operating the website: Contabo GmbH, Munich (hosting of the website and the mail server, Germany); Cloudflare, Inc., USA (DNS, reverse proxy/CDN); Netcup GmbH, Karlsruhe (hosting of the app backend that serves the deletion form and the requests listed in section 14.6, Germany). Beyond this, we disclose data collected during visits to the website only where we are legally obliged to do so.

The website is available exclusively via a connection encrypted with TLS (Transport Layer Security), recognisable by the "https://" in your browser's address bar. The connections to our mail server and to our app backend are also TLS-encrypted.

15. Language Versions; Changes to this Privacy Policy

This Privacy Policy is provided in German and English. The German version is authoritative; the English version is provided for information purposes only.

We adapt this Privacy Policy when the processing operations change (e.g. new features or service providers). The current version is available in the app and at https://copreo.com/en/privacy/. Earlier versions are available at https://copreo.com/en/privacy/versions/. We will inform you in the app and by e-mail of material changes.