Privacy policy

1. Data protection at a glance

General information

This privacy policy explains the nature, scope and purpose of the processing of personal data when you use our website cusoso.com and the cusoso Sign platform (sign.cusoso.com). Personal data is any information that can be used to identify you directly or indirectly.

As of: October 2026.

2. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

3. Our role for the cusoso Sign platform

When we use cusoso Sign for our own business processes, we are the controller of the data processed there. If a customer uses the platform for their company (e.g. for their own customers, contracts, invoices or employees), the customer is the controller of that data and we process it as a processor under Art. 28 GDPR. We provide the required data processing agreement on request. The data of the individual business units is kept separate.

4. Collection and processing of data

Automatic data collection when visiting the website

When you visit our website and the platform, technically necessary data is collected (e.g. browser type, operating system, time of the request, requested address, status code, IP address). This data is required to deliver the pages correctly and to ensure security. It is only stored as long as necessary for operation and security.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation).

5. Hosting and infrastructure

cusoso Sign platform: Hetzner (Germany)

The platform runs on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in the Nuremberg data centre. It is deployed through an environment that we operate ourselves (Coolify, Docker, Traefik) on these servers; no other service providers get access to your data. A data processing agreement under Art. 28 GDPR exists with Hetzner. The connection is encrypted with TLS; the certificates are issued by Let's Encrypt (only the domain name, no user data, is transmitted). Database and files are backed up regularly on our server.

Legal basis: Art. 6(1)(b) and (f) GDPR.

6. YouTube videos

Videos from YouTube may be embedded on our website. The videos are only loaded after explicit consent via the cookie consent tool in use. Only after consent is a connection to YouTube servers established. Personal data (e.g. IP address) may be transmitted in the process.

Legal basis: Art. 6 (1) (a) GDPR (consent). Consent can be withdrawn at any time with effect for the future.

7. Fonts and libraries

All fonts ("Exo", "Inter") and all software libraries (including Bootstrap, Bootstrap Icons, jQuery, Chart.js, Quill, PDF.js, Tailwind CSS) are delivered from our own servers. No fonts, scripts or styles are loaded from content delivery networks or from Google; therefore no personal data is transmitted to third parties for this purpose when our pages are opened.

Audience measurement (start page)

To evaluate the use of our start page and website we use the Umami software. Umami runs as our own installation on our servers at Hetzner in Germany (umami.cusoso.com); no data is transmitted to third parties. Umami works without cookies and without storing or reading information on your device. Statistical data such as the page viewed, referring page, browser, operating system, device type, screen size, language and country is recorded; the IP address is not stored in plain text and no personal user profiles are created. Google Analytics is not used.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in optimising our offering).

8. Contact, e-mail and appointment booking

Contacting us by e-mail

If you contact us by e-mail, the data you send (e.g. name, e-mail address, content of the message) is stored and processed. Our e-mail system (Microsoft 365) is provided by Microsoft Ireland Operations Ltd.; a data processing agreement (Data Processing Addendum) exists with Microsoft.

Legal basis: Art. 6 (1) (b) GDPR (pre-contractual measures) or Art. 6 (1) (f) GDPR (legitimate interest in handling general inquiries).

Appointment booking via Microsoft Bookings

To arrange consulting appointments we use the service “Microsoft Bookings”, provided by Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

When you book an appointment, the data you enter (e.g. name, e-mail address, possibly phone number and other voluntary information) is processed to organize and hold the appointment.

The processing is carried out to perform pre-contractual measures pursuant to Art. 6 (1) (b) GDPR. Microsoft processes the data on our behalf pursuant to Art. 28 GDPR. A corresponding data processing agreement (Data Processing Addendum) has been concluded with Microsoft.

Further information on data protection at Microsoft can be found at:
https://www.microsoft.com/de-de/privacy/privacystatement

9. cusoso Sign platform

Account, sign-in and cookies

For your user account we process name, e-mail address, role, assignment to business units, language setting and sign-in times. Passwords are stored only as a hash. After several failed sign-ins the account is temporarily locked; the number of failed attempts is stored for this. Sign-in can optionally take place via Microsoft (Entra ID) or Auth0 if enabled by your company; your credentials are then processed by the respective provider and we receive name and e-mail address.

We only use technically necessary cookies: the session cookie "session" (contains sign-in status, security token and language setting, deleted when the browser is closed), the cookie "remember_token" (only if you choose "Keep me signed in", 14 days by default) and, for password-protected offer websites, an access cookie (8 hours). No consent is required for these.

Legal basis: Art. 6 (1) (b) GDPR (performance of a contract) or Art. 6 (1) (f) GDPR (secure operation); § 25 (2) TDDDG (technically necessary cookies).

Reset password

If you request a new password, we send a personal link to the e-mail address on file that is valid for 60 minutes and can be used only once. We do not disclose whether an address exists with us.

Activity logging

For traceability and security the platform logs actions in an audit log (user, action, affected record, time, IP address and browser identifier), e.g. creating, changing and deleting records, signatures as well as sign-in and verification events. The audit log is only visible to administrators.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in security, provability and prevention of misuse).

E-mail delivery via Brevo

We send system messages of the platform (e.g. invitations to sign, confirmation codes, links to reset the password, notifications, reminders, sent invoices and signed documents as attachments) via the SMTP service of Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France). Brevo processes recipient address, name, content and attachments of the message as well as delivery data as our processor under Art. 28 GDPR; a data processing agreement exists with Brevo. If Brevo uses sub-processors outside the EEA, this is based on standard contractual clauses. We use Brevo exclusively for transactional e-mails, not for newsletters or advertising.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract or pre-contractual measures) and Art. 6(1)(f) GDPR (reliable delivery).

Digital signature

When you sign an offer or document digitally, we process your name, your e-mail address, the time of the signature and the signature image or signature block. External signers do not need a user account: access is via a personal, time-limited link. In addition, each time the link is opened we send a six-digit confirmation code to your e-mail address so that only the invited recipient gets access. The code is valid for ten minutes, is stored only as a hash and deleted after use; failed attempts are counted and limited. We also store the time and IP address of the confirmation and the signature as well as the browser identifier.

A signature protocol can be created for every document. It lists all signers with name, e-mail address, status (signed, pending, declined), time, type of identification and IP address as well as the checksum (SHA-256) of the document. External signers receive a short version without other people's e-mail and IP addresses. If a signer declines to sign, we store the reason given and communicate it to the creator of the document. Completed documents and resolutions receive an electronic seal of the platform (PAdES) together with a time stamp from a time-stamping service (DigiCert, Inc., 2801 N. Thanksgiving Way, Lehi, UT 84043, USA). Only a checksum (hash) of the seal signature and the technical connection data of our server are transmitted there, neither the document content nor data of the signers. The signatures are simple electronic signatures within the meaning of the eIDAS Regulation.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract or pre-contractual measures) and Art. 6(1)(f) GDPR (provability and protection against unauthorised access). The signed document is sent to you by e-mail.

Password-protected offer websites

On request we provide offers with a password-protected web page. When this page is opened, exported as PDF, when attachments are downloaded, when the digital acceptance is started and when a wrong password is entered, we log:

• date and time of the access,
• the type of access (e.g. view, PDF export, download of an attachment),
• the IP address,
• browser identifier (user agent).

The purpose of the logging is to let the creator of the offer see whether and how often the offer was viewed, and to protect against unauthorized access (e.g. repeated wrong password entries). The IP address is used to recognize whether several accesses come from the same connection. Views by cusoso employees are not counted.

The log data can only be viewed by the creator of the offer and the persons authorized for the offer within cusoso. It is not passed on to third parties and is deleted when the offer website is deleted.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in following up the offer in the course of business initiation and in the security of the page). You can object to the processing pursuant to Art. 21 GDPR; please contact contact@cusoso.com.

AI-supported functions

The platform offers optional functions that use a language model (LLM): creating texts for offer websites and enriching leads from publicly available company information. As provider we generally use Anthropic (Anthropic PBC, 548 Market Street, San Francisco, CA 94104, USA; access via the "Claude API" programming interface). The administrators of a business unit can alternatively configure another OpenAI-compatible service or a self-operated model with their own access; we tell you on request which provider is responsible for your data. We only transmit the content needed for the task to the provider: for offer websites descriptions of modules, services and attachments as well as the company name, never prices or contact persons; for lead enrichment the publicly available imprint text of a company website. The results are reviewed by staff before they are used. Anthropic processes data submitted via the programming interface as a processor under its commercial terms (data processing addendum with standard contractual clauses) and, according to its commitment, does not use it to train its models.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in efficient offer creation). For providers in the USA the transfer is based on standard contractual clauses or the EU-US Data Privacy Framework.

Retrieval of public websites in the CRM

When a lead is created, the platform can, at the user's request, retrieve the imprint page of the given company website to prefill company details (address, managing directors, contact data). Only publicly provided information is taken over.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in B2B business initiation).

Modules and processed data

Depending on the modules used, the platform processes the following data:

• CRM, partners and offers: company and contact data of prospects and business partners (name, position, e-mail, phone, address, notes, comments, follow-ups).
• Orders, invoices and contracts: invoice data, addresses, VAT ID, Leitweg ID, contract parties, terms, deadlines and uploaded files; invoices can be generated as e-invoices (XRechnung, ZUGFeRD) and sent by e-mail.
• Projects and time tracking: tasks, assignments and working hours of employees; employee and organisation data (name, function, department, superiors).
• Corporate: resolutions, shareholder data (name, date of birth, residence or registered seat, shareholding) and shareholder lists.
• Cash planning and budgets: financial planning data of the company, account balances on balance dates and approvals.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract), (c) GDPR (statutory retention and proof obligations, e.g. HGB, AO, Section 40 GmbHG), (f) GDPR (legitimate interest in efficient business operations) and Section 26 BDSG (employee data).

Push notifications

If you allow notifications in your browser, we store the push endpoint provided by your browser together with keys and send reminders about due tasks, payments and appointments. Delivery runs via the push service of your browser vendor (e.g. Google, Apple, Mozilla), which technically processes data such as your IP address. You can withdraw your consent at any time in your browser.

Legal basis: Art. 6(1)(a) GDPR (consent) and Section 25(1) TDDDG.

10. Recipients and transfers to third countries

We only pass personal data on to the service providers named in this policy, insofar as this is necessary for the respective function: Hetzner (hosting, Germany), Brevo (e-mail delivery, France), Microsoft (e-mail system and appointment booking, Ireland), Anthropic (AI functions, USA), DigiCert (time stamp of the seal, USA), Microsoft or Auth0 if sign-in via SSO is enabled, and the push services of the browser vendors. Where data reaches countries outside the EEA (in particular the USA), the transfer relies on standard contractual clauses under Art. 46 GDPR or an adequacy decision (EU-US Data Privacy Framework). Data is not passed on for advertising purposes.

Email log: for every email sent by the platform we store recipient, subject, time, type of message and the delivery status reported by Brevo (e.g. delivered or undeliverable), but not the content or attachments. The purpose is proof of dispatch and troubleshooting of undelivered messages (Art. 6(1)(f) GDPR). Entries are deleted after 180 days.

11. Retention period

Personal data is only stored as long as it is necessary for the respective purpose or statutory retention obligations apply. We retain accounting-relevant documents such as invoices and contracts in accordance with the statutory periods (e.g. Section 147 AO, Section 257 HGB; depending on the document six to ten years). We delete access logs and security data as soon as they are no longer required for operation and security. Confirmation codes and password reset links expire after a few minutes or one hour respectively.

12. Data security

We take technical and organisational measures to protect your data, including encryption of transmission (TLS), hashed storage of passwords and codes, role-based access restriction by business unit, limitation of sign-in attempts, logging and regular backups.

13. Your rights

Within the scope of the applicable legal provisions you have the right at any time to:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to the processing (Art. 21 GDPR)
• withdraw a consent given, with effect for the future

To do so, please contact contact@cusoso.com.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.