Privacy Notice
v2.8.0-eigenes-portalAs of: November 3, 2026
Privacy Notice — Supplier Portal
Information per Art. 13 GDPR
§ 1 Controller
(1) The Controller within the meaning of Art. 4(7) GDPR for processing in this portal is Gluth Systemtechnik GmbH, which operates the portal as its own supplier portal. Address and contact appear in the imprint at the foot of this document.
(2) For hosting, operation and maintenance of the software the Controller uses service providers as Processors under Art. 28 GDPR. They process data only on the Controller's instructions.
(3) Please direct privacy requests to the contact address given in the imprint.
§ 2 Purposes and Legal Bases
| Purpose | Legal basis |
|---|---|
| Initiation and performance of business relationship | Art. 6(1)(b) GDPR |
| Audit logging of security-critical changes (in particular IBAN changes) | Art. 6(1)(f) — fraud prevention |
| Platform operation, security logs, authentication | Art. 6(1)(f) — IT security |
| Statutory retention obligations | Art. 6(1)(c) — §§ 257 HGB, 147 AO, ProdHaftG |
| System notifications | Art. 6(1)(b) |
Processing of special categories under Art. 9 does not take place. Technical documents (mill certs, conformity declarations) contain only technical data.
§ 3 Data Categories
- Master data: company name, address, VAT ID, HRB, legal form, GLN, DUNS, EORI;
- Contact data: name, salutation, role, email, phone, mobile;
- Authentication: email, password hash;
- Bank details: IBAN, BIC, holder;
- Contract data: orders, offers, prices, certificates, mill certs;
- Usage data: login times, IP, user agent, audit trail;
- Acceptance records: timestamp, IP, user agent, hash of accepted version.
§ 4 Recipients
(1) Within the Controller: authorised personnel under confidentiality obligation. The Controller sees whether your access is set up (registration stage and date of first sign-in) so it can help you with access problems.
(2) Processors (under Art. 28): service providers for hosting and operation, in particular Vercel and Supabase, EU region. The full list is available from the Controller on request.
(3) Disclosure to public authorities only where legally required.
§ 5 Third-Country Transfers
(1) Processing takes place within the EU (Frankfurt / EU-Central-1).
(2) Subprocessors with US parent (Vercel, Supabase): physical processing in the EU. Any third-country access is governed by the EU Commission's Standard Contractual Clauses (Implementing Decision 2021/914); Vercel is additionally certified under the EU-U.S. Data Privacy Framework. A Transfer Impact Assessment (TIA) exists as a preliminary draft and is available on request.
§ 6 Retention
| Category | Retention |
|---|---|
| Master / contract data | term of contract + 10 years (§ 147 AO, § 257 HGB) |
| Bank details / IBAN audit logs | term of contract + 10 years |
| Mill certs, EMPB, conformity declarations | min. 10 years from market placement (ProdHaftG) |
| Login / security logs | 12 months |
| Acceptance records | 10 years after contract end (§ 199(4) BGB) |
| Notifications, email delivery log, support telemetry, presence data | 30 days |
| Records marked as deleted | as long as the organisation exists or a retention obligation applies; deleted file attachments are removed permanently after 180 days. All other data of the organisation is deleted together with it (Terms of Use). |
§ 7 Your Rights
You have the following rights vis-à-vis the Controller (Art. 12–22 GDPR): access, rectification, erasure, restriction, portability, objection. Exercise via the Controller (see imprint).
§ 8 Right to Lodge a Complaint
You have the right to lodge a complaint with a supervisory authority (Art. 77). Generally the authority at the Controller's seat is competent.
§ 9 Automated Decisions / AI
(1) The platform makes no decisions based solely on automated processing producing legal or similarly significant effects (Art. 22).
(2) Rule-based heuristics in the platform (e.g. document auto-categorisation) are not AI within the meaning of AI Act 2024/1689.
(3) Should AI-based functions with significant impact be introduced, you will be informed separately. The current AI/heuristic inventory is maintained in the platform's internal features overview and provided by the operator on request.
§ 10 Data Security
The platform implements suitable technical and organisational measures per Art. 32, in particular: tenant-level Row Level Security; encryption in transit (TLS 1.3) and at rest (AES-256); end-to-end encryption of confidential content — offer prices, freight costs, line-item comments and message text written by users — with keys derived exclusively client-side, while automatically generated status notices, order data and commercial letters are excluded because they must remain readable for statutory retention (§ 257 HGB, § 147 AO, GoBD); a password policy with a minimum length and required character classes, plus a check of newly set passwords against known breach lists; audit logs for security-critical actions; soft-delete with recovery.
§ 10a Support Telemetry (proactive error observation)
For the purpose of proactive error remediation and session stability, the platform records technical error events from your browser session (error codes, stack-trace heads, affected route, anonymised user-agent) and an anonymised presence heartbeat (last-active timestamp + current path). Before persistence the payload is client-side redacted — UUIDs, email addresses, JWTs, IBAN, phone numbers, and E2EE ciphertext are replaced with placeholders. Cleartext business content never leaves your session in readable form.
- Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in proactive support and security of processing per Art. 32 GDPR).
- Recipients: exclusively the Controller and its processors named in § 1. No third-party disclosure.
- Retention: error events and presence data 30 days, regardless of resolution status. Automated deletion per § 6.
- Transparency (Art. 28 + Art. 15): every platform-support access to your organisation's telemetry is recorded in an audit trail visible to you (Organisation settings → "Platform support access").
- Your rights: you may object to processing pursuant to Art. 21 GDPR. Upon objection, residual session diagnostics remain available, but proactive support is reduced.
§ 11 Amendments
Material amendments are announced at least 30 days in advance. You will be prompted for renewed active confirmation; tacit consent is excluded.
§ 12 Language
In case of conflict with translations, the German version is binding.
Operator (Imprint)
Gluth Systemtechnik GmbH
Steinweg 66
94315 Straubing
DE
Email: info@gluth.eu
SHA-256: 9e58d898ba8efe393a619df23615a3e94a3cd19b162963734312a6148fafa125