Bilendo

Your cookie settings

We use cookies to run the site and, with your consent, for embedded content, analytics and marketing. More in our cookie policy and privacy policy.

Legal

Business Partners

This is a translation for convenience. The binding version is in German: Business Partners.

I. Name and address of the controller

The controller within the meaning of the relevant data protection regulations is:

Bilendo GmbH
Florian Kappert
Fürstenfelder Str. 9
80331 Munich
Phone: +49 (0)89 24413210-0
Email: datenschutz@bilendo.de

The controller's data protection officer is:

RA Wolfgang Steger
Am neuen Weg 21
82041 Oberhaching
Phone: 0178/7714857
Email: steger@ra-steger.info

II. General information on data processing, categories of data processed

We process personal data of our customers, suppliers and other contractual partners ("business partners") only in compliance with the applicable data protection provisions, for the following purposes:

  • Business communication, e.g. on products, services and projects
  • Organization, maintenance and management of the business relationship
  • Customer surveys, marketing campaigns, market analyses, sweepstakes, competitions or similar actions and events
  • Maintaining and protecting the security of our products, services and websites; preventing and detecting security risks, fraud or other criminal or harmful acts
  • Compliance with legal requirements (e.g. tax and commercial law retention obligations) as well as guidelines and industry standards
  • Performance of existing contracts and the assertion, exercise, enforcement and defense of legal claims, and the settlement of disputes

For these purposes we process the following categories of personal data:

  • Contact information, such as first and last name, business address, business phone/mobile/fax number and business email address
  • Payment data required to process payment transactions or prevent fraud, including credit card information and card verification numbers
  • Other information required in the context of a project or contractual relationship, or provided voluntarily by our contacts, such as orders, inquiries or project details
  • Information collected from publicly available sources, information databases, or credit reporting agencies

Personal data is processed only for the purposes above, based on the fulfillment of our contractual obligations or to protect our overriding legitimate interests, which arise from the pursuit of our corporate purpose.

III. Transmission and disclosure of personal data

We transmit personal data for the purposes above to:

  • Other service providers, insofar as necessary to fulfill the purposes above
  • Courts, regulatory agencies or law firms, to the extent legally permitted and necessary to comply with applicable law or to assert, exercise or defend legal claims
  • Processors, such as IT maintenance service providers, who are bound by our instructions and contractually obligated to comply with applicable data protection requirements

Where the recipients above are located in countries outside the European Economic Area ("third countries") whose applicable law does not ensure the same level of data protection as your home country, we take measures to ensure appropriate safeguards — transferring personal data only to recipients who (i) have concluded EU standard contractual clauses with us as controller, (ii) have adopted Binding Corporate Rules, or (iii) are certified, where based in the US, under an applicable EU/US data transfer framework.

IV. Storage periods

Personal data is deleted or blocked as soon as the purpose of storage ceases to apply, unless an explicit storage period was specified at the time of collection. Storage may continue where required by European or national law; a blocking or deletion also occurs once a legally prescribed storage period expires, unless further storage remains necessary for the conclusion or performance of a contract.

V. Electronic contract signing

When we send you an offer or a contract for electronic signature, you receive a personal link by email. So that only the invited person can open and sign the document, we send the matching access code separately by text message to your mobile number, or give it to you by phone.

What data we process

  • Your name, email address and the mobile number your company or our contact person gave us for this purpose
  • The time and delivery status of the text message. We do not keep the content of the text message (the access code) in our sending log.
  • When you open the link, after entering the access code:
    • date and time of the access
    • the full IP address (purposes: preventing misuse and evidence)
    • the network group derived from it, in coarse form (for IPv4 the /24 group, for IPv6 the /48 group)
    • the browser identifier (purposes: preventing misuse and evidence)
    • the country, only if the upstream CDN server (Amazon CloudFront) tells us; we do not use a geolocation service
    • a random device value that we store in a cookie in your browser (see "Cookie on the contract page")
  • When you sign: date and time, IP address and browser identifier, the name you sign with and, where applicable, the image of your drawn signature

We use this data only for the purposes stated here.

Security when opening the link

When the link is opened, we check whether it is used from a device we already know:

  • New device: We send an email to the address the link was sent to. It states the time, country and device of the access. If the access was not made by you, you can block your link there.
  • Change of device and network: We ask for the access code again. If the code was delivered by text message, we automatically send a new one, at most one every 30 seconds and five per day per link.
  • When signing: We ask for the access code again if the login is more than 15 minutes old.

Cookie on the contract page

When you open the link, we set a cookie with a randomly generated device value. It is used to recognise a device we already know. It is technically necessary, set as an HttpOnly cookie (scripts on the page cannot read it), sent only to the contract page (bilendo.de or docs.bilendo.de) and stored for 180 days. Because the cookie is strictly necessary to provide the secured signing you use by opening the link, no consent is required for it (Section 25(2) no. 2 TDDDG); no consent banner is shown for it. You can delete the cookie in your browser at any time; the next time you open the link, the device is then treated as new.

Confirmation after signing

After you sign, we send a confirmation by email to the address the link was sent to. It contains a link you can use to tell us that the signature was not made by you; it is valid for 30 days. If you use it, we store the time, IP address, browser identifier and your optional message, and we look into it.

Purposes and legal bases

  • Preparing and concluding the contract with your company, Art. 6(1)(b) GDPR where you are a party yourself, otherwise Art. 6(1)(f) GDPR (our interest and that of your company in an effective conclusion of the contract)
  • Making sure that only the invited person opens and signs a document, preventing misuse and proving that the contract was concluded, Art. 6(1)(f) GDPR. For this we store the data listed above when you open and sign. Our legitimate interests are protecting the contracting parties and ourselves against use of a personal link by someone else, and being able to prove the signature; we see no less intrusive means that achieve the same, and we use the network group and the country only in coarse form.
  • Keeping the signed contract and its evidence under commercial and tax retention duties, Art. 6(1)(c) GDPR in conjunction with Section 257 HGB and Section 147 AO

Right to object: Where we rely on Art. 6(1)(f) GDPR, you may object to the processing at any time on grounds relating to your particular situation (Art. 21 GDPR), e.g. by email to datenschutz@bilendo.de. Without the data listed, the document cannot be signed through the link.

Recipients

For sending text messages we use Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, as our processor ("AWS End User Messaging SMS", processed in the Frankfurt am Main region). A data processing agreement is in place. To deliver it, the message is passed to mobile network operators. Traffic to the contract page runs through Amazon CloudFront (also Amazon Web Services EMEA SARL), which processes the IP address and the browser identifier as a processor in doing so. A transfer to third countries, in particular the USA, cannot be ruled out; it takes place on the basis of the EU-U.S. Data Privacy Framework, which Amazon.com, Inc. has joined, or of the EU Standard Contractual Clauses.

Retention

We keep the mobile number, the text message sending log (number, time, status, no content) and the data from opening and signing (IP address, network group, browser identifier, country, device value) together with the evidence of the signature for as long as the contract exists and thereafter for the statutory retention periods of, as a rule, six years, or eight years where the document serves as an accounting record (Section 257 HGB, Section 147 AO), counted from the end of the calendar year in which the contract ends. A link that is not signed expires after 14 days; at our contact person's request the period can be extended to up to 90 days. We delete the data relating to an unsigned link 12 months after the link expires. The cookie stays in your browser for 180 days.

Your choice

If you do not want to receive text messages, please tell your contact person; you will then receive the access code by phone. You will find your further rights, in particular to access, rectification, erasure, restriction and data portability and to lodge a complaint with a supervisory authority, under VI.

VI. Other information, in particular your rights

Further information, in particular on your data subject rights and the legal basis for our data processing, can be found on our homepage under Data Privacy as well as under GDPR.

You can find more information on data privacy and IT security in our Terms & Conditions and under Data Privacy.