Privacy notice

The controller is SmallBiz Guide GmbH, Nachtigallenweg 17, 65779 Kelkheim, Germany, registered with the commercial register of Königstein local court under HRB 11926, represented by its managing director Robert Hoffmann. Please send privacy requests to info@smallbizguide.de.

We are not required to appoint a data protection officer (§ 38 (1) BDSG); requests are answered by the management.

• Email address — for passwordless sign-in (magic link) and to send the notifications you asked for (alert digest).
• Profile & preferences — language and default market, to personalise the interface.
• Alert rules & events, saved views — content you create, so we can deliver the notifications that match it.
• Newsletter (“PayLens Radar”) — email address and chosen language when you subscribe to the free newsletter. Sign-up uses double opt-in: we only send after you confirm via the link we email you, and the times of sign-up and confirmation are logged. Every issue carries a one-click unsubscribe link (no account needed).
• Contact requests: name, company (optional), email address and your message when you use the contact form; to handle your request. Deleted once the request is closed and no statutory retention duties apply.
• Technical server and access logs — for operation, security and error analysis.

Art. 6(1)(b) GDPR (providing the services you requested — sign-in, notifications), Art. 6(1)(a) GDPR (consent — newsletter; revocable at any time via the unsubscribe link) and Art. 6(1)(f) GDPR (legitimate interest in security and operation, in particular server log files).

We have concluded data processing agreements pursuant to Art. 28 GDPR with the following providers:

• Supabase Inc. — authentication, application database and encrypted file storage. Seat: San Francisco, USA · processing in the EU region Frankfurt · SCCs + EU-US Data Privacy Framework.
• Resend Inc. — delivery of transactional email (sign-in, digest); the email address is transmitted for delivery. Seat: San Francisco, USA · SCCs + EU-US Data Privacy Framework.
• Google Ireland Ltd. — application hosting (Firebase App Hosting), server logs. Seat: Dublin, Ireland · processing in the EU.

Supabase Inc. and Resend Inc. are headquartered in the USA. Both are certified under the EU-US Data Privacy Framework, recognised by the European Commission’s adequacy decision of 10 July 2023; standard contractual clauses (module 2) have been concluded in addition. The processing itself takes place in the EU (Supabase region Frankfurt). No transfers to further third countries take place.

We only use strictly necessary cookies (sign-in session, language preference). Under § 25 (2) no. 2 TDDDG these require no consent. No tracking, no advertising or analytics cookies.

Profile, preference and alert data are stored for as long as your account exists or as long as needed for the purposes above; afterwards they are deleted or anonymised. Newsletter data are stored until you unsubscribe; proof of consent is retained to the extent legally required. Technical server log files are deleted automatically after at most 14 days.

You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR), as well as to withdraw consent you have given (Art. 7(3) GDPR). An informal message to info@smallbizguide.de is enough.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The competent authority is the Hessian Commissioner for Data Protection and Freedom of Information, Postfach 31 63, 65021 Wiesbaden, Germany.