Privacy Policy
Version: August 2026
1. Controller
Martin Kühn – LinaFora
Burkersdorfer Weg 27
01189 Dresden
Germany
Phone: +49 151 7000 7507
Email: kontakt@linafora.de
2. Purpose of this privacy policy
This privacy policy provides information about the processing of personal data when visiting linafora.de, when making contact and – where activated – when using LinaFora customer accounts and software services. Which data is processed in an app configured by a specific customer depends on that customer's particular use.
3. Hosting and server log data
The website is hosted by ALL-INKL.COM – Neue Medien Münnich. When the website is accessed, technically necessary data such as the IP address, time of access, resource requested, referrer, browser and operating system information may be processed. The processing serves the secure and stable provision of the website on the basis of Art. 6(1)(f) GDPR.
Log data is retained only for as long as is necessary for operation, error analysis and the investigation of misuse and security incidents; longer storage occurs only in the event of a specific security incident or on account of statutory obligations.
Anonymous page statistics. To find out which pages are visited and how often, LinaFora counts page views in its own database (Supabase). Only visitors who are not signed in are counted. Only the page visited, the language of the page, the country (derived from the connection or, failing that, from the browser’s time zone), the device type (based solely on window width), the host name of the referring page and the time are stored. The IP address is not stored for this purpose (it is only briefly compared with a list of the operator’s own devices whose page views are not counted; only those addresses and device names are stored); no cookies and no identifiers are set, and the data is not linked to any other data. Visitors who have switched on “Do Not Track” or Global Privacy Control are not counted. The legal basis is Art. 6(1)(f) GDPR (interest in a secure and improved service). The data is deleted after 400 days at the latest.
4. Contact by email and telephone
When contact is made, LinaFora processes the contact and content data provided in order to handle the enquiry. The contact and quotation forms of the current website open the user's email program; the message is not stored beforehand on a dedicated website form server.
The legal basis is Art. 6(1)(b) GDPR insofar as the enquiry serves the initiation or performance of a contract, otherwise Art. 6(1)(f) GDPR. Data is erased once processing has been completed and no statutory retention or documentation obligations preclude this.
5. Technically necessary browser storage
The website currently uses no analytics or advertising cookies. Technically or functionally necessary information may be stored in the browser's local storage, in particular the selected language and the fact that the cookie/privacy notice has already been shown. This storage serves exclusively the website function requested by the user.
6. Customer accounts and contract administration
When a customer account is activated, LinaFora processes in particular the name or company reference, email address, access information, plan/contract data and technical account information, insofar as this is necessary for registration, authentication, performance of the contract, support and security. The legal basis is Art. 6(1)(b) GDPR; security logs may additionally be based on Art. 6(1)(f) GDPR.
7. Processing within the LinaFora applications
Depending on use, the applications may in particular process form and report data, order data, contact details, vehicle and case data, photos, signatures, location details, documents, invoicing information and other fields defined by the customer. For customer data that LinaFora processes exclusively for the respective business customer, LinaFora generally acts as a processor on that customer's instructions. Where required, a DPA pursuant to Art. 28 GDPR is agreed for this purpose.
As controller, the respective customer decides on the purpose and admissibility of its data collection. Special categories of personal data pursuant to Art. 9 GDPR should only be processed where this has been expressly agreed and is legally permissible.
8. Firebase / Google Cloud
Services of the Firebase/Google Cloud platform may be used for parts of the customer and application functions, in particular authentication and Cloud Firestore for sign-in as well as storage and synchronisation of application data. For these services, Google generally processes customer data on the basis of the data processing terms applicable to the respective Firebase/Google Cloud service.
Depending on the service and configuration, processing outside the European Economic Area cannot be entirely ruled out. Where necessary, the data protection safeguards provided by Google are used for this, in particular applicable adequacy decisions and/or standard contractual clauses.
9. Google Maps
Functions of the trip management may use the Google Maps JavaScript API, for example for map, address or route functions. When these functions are loaded or used, in particular the IP address, technical device data and the search or location information passed to the map function by the user may be transmitted to Google. For map functions actively used by the user, the legal basis is the provision of the requested function under the contract; where consent is required by law, the function is used only on that basis.
Location recording in the LinaFora app
This website does not collect location data. In the LinaFora applications the respective company (the controller for its own data) can switch on a location recording per app. It is off by default. When it is on, recording only starts once a field of the report chosen by the company is filled in, and ends with a second chosen field – usually the signature on delivery. Without both fields LinaFora records nothing.
Depending on the setting, either only the positions at the signatures plus start and end are recorded, or the route travelled as well. For each point the time, coordinates, accuracy and – where the device supplies it – the speed are stored. The data is held with the report it belongs to, inside the company’s account.
The person concerned sees an unmissable notice in the app throughout the recording and can view their own recordings in their account at any time. Whether the recording appears in the issued report is a separate decision of the company. If a map excerpt is produced for that purpose, the coordinates involved are transmitted to Google (see the Google Maps section); without a stored Google key no map excerpt is created and nothing is transmitted to Google.
The controller for this processing is the company that switches the recording on. It has to determine a legal basis, inform the people concerned and observe any co-determination rights. LinaFora provides the function and processes the data as a processor.
10. External technical libraries
Individual test or web applications may obtain technical JavaScript libraries via content delivery networks such as cdnjs/Cloudflare or jsDelivr. When such files are retrieved, the respective provider technically receives at least the IP address of the retrieving device. For regular productive operation, LinaFora aims to provide such libraries as sparingly or locally as possible.
11. Recipients and processors
Personal data is only received by bodies that require it for the stated purposes. These may in particular include hosting and email service providers and – when the relevant functions are used – Google/Firebase. Where a service provider acts as a processor, the processing takes place on the basis of a contract pursuant to Art. 28 GDPR.
12. Storage period
Contract and billing data is stored for the duration of the contract and thereafter within the scope of statutory commercial and tax retention obligations. Application data is generally processed for the term of the contract or on the customer's instructions and, after the contract ends, erased or returned in accordance with the DPA, unless there is a statutory obligation to continue storing it.
13. Rights of data subjects
Subject to the statutory requirements, data subjects have in particular the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Consent once given may be withdrawn at any time with effect for the future.
For data that LinaFora processes exclusively on behalf of a customer, the data subject should primarily contact that customer as controller; LinaFora supports the customer within the scope of the DPA.
14. Right to lodge a complaint
There is a right to lodge a complaint with a data protection supervisory authority. For LinaFora, the competent authority is in particular the Saxon Commissioner for Data Protection and Transparency, Maternistraße 17, 01067 Dresden, Germany.
15. Security
LinaFora uses appropriate technical and organisational measures to protect personal data against loss, unauthorised access and impermissible alteration. These include in particular encrypted transmission via HTTPS, access and authorisation concepts and technical updates. However, no internet-based service can guarantee absolute security.
Customer account, trial access and checkout
When a trial or customer account is registered, data such as name, company, email address, authentication information and technical account data is processed to create and manage the account, provide the 14-day trial and perform a later contract. The legal basis is Art. 6(1)(b) GDPR.
When a paid plan is purchased, billing/contract data and, where applicable, a voucher code are also processed. Payment data is processed by the payment provider named during checkout. Full card or bank details are not intended to be stored on the LinaFora web server. The specific payment provider will be named in this policy before production checkout is activated.
16. Changes to this privacy policy
This privacy policy is adapted when functions, service providers used or legal requirements change. The current version is available on this website.
This privacy policy is also provided in other languages. The translations serve comprehension only; the German version is authoritative.
