Privacy Policy

As of: November 2026

This is a translation. In case of doubt, the German version prevails.

Deutsche Fassung

This privacy policy explains which personal data we process when you visit our website protol.io, contact us or use our software protol.io (web application and mobile app).

1. Controller

Lido Apps UG (haftungsbeschränkt)
Steinstraße 13
14482 Potsdam
Germany

Represented by the managing director Kevin Drossard
Email: info@protol.io

We have not appointed a data protection officer, as we are not legally required to do so. If you have any questions about data protection, please contact us at the email address above.

2. Our role: controller or processor

protol.io is software for businesses. We offer it exclusively to business customers.

• Website, contact requests and contractual relationship: Here we are ourselves the controller within the meaning of the GDPR.
• Data within the software: We process the data that our customers and their employees enter in protol.io on behalf of the respective customer in accordance with Art. 28 GDPR. In this case the controller is the company that uses protol.io (usually your employer). This is based on a data processing agreement between us and the customer.

If, as an employee of a customer, you have questions about your data in protol.io or wish to exercise your rights, please contact your employer first. If such a request reaches us directly, we forward it to the customer.

3. Visiting our website

3.1 Server log files

When protol.io is accessed, technically necessary data is processed automatically: IP address, date and time of access, page requested, amount of data transferred, browser and operating system, and the previously visited page (referrer).

• Purpose: delivering the website, stability and security (e.g. defending against attacks)
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and functioning service)
• Retention period: 14 days, then deletion
• Hosting: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located in the European Union.

3.2 Cookies and similar technologies

We do not use any analytics, tracking or marketing tools on the website.

4. Contacting us

If you contact us by email, we process the information you provide (name, email address, company, content of the message) in order to handle your request.

• Legal basis: Art. 6(1)(b) GDPR, where your request is aimed at a contract; otherwise Art. 6(1)(f) GDPR (legitimate interest in responding)
• Retention period: until the request has been fully dealt with; beyond that only where statutory retention obligations apply
• Email provider: email service provider for business enquiries. A transfer to the USA cannot be ruled out in this context (see section 8).

Contact form on protol.io

If you write to us through the contact form on our website, we process the details you enter there: contact person, company, email address and your message. We use them only to answer your inquiry. The legal basis is Art. 6(1)(b) GDPR where your inquiry aims at entering into or performing a contract, otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering inquiries).

Your details are not stored in a database. Our server forwards them as an email to our mailbox info@protol.io; we use the email service Resend to send it. We keep the email until your inquiry has been fully dealt with, unless statutory retention obligations apply.

To prevent abuse, our server counts inquiries per IP address in memory; the address is deleted there no later than 16 minutes after the last inquiry and is not stored permanently. A field that visitors cannot see is used to detect automated submissions. Section 3.1 (server logs) applies to visits to the website as well.

5. Customer and contract data

To initiate and perform contracts, we process contact details of contact persons (name, position, business contact details), contract and billing data, and communication with us.

• Legal basis: Art. 6(1)(b) GDPR (contract or pre-contractual measures), Art. 6(1)(c) GDPR (legal obligations), Art. 6(1)(f) GDPR (communication with our customers' contact persons)
• Retention period: for the duration of the business relationship; thereafter where retention obligations under commercial and tax law apply (up to ten years)
• Other recipients: tax advisors and service providers for accounting and payment processing

6. Use of the protol.io software

6.1 Data processed

When the software is used, we process in particular the following categories of personal data:

• Account and master data: e.g. name, business email address, role and permissions, organizational assignment, settings
• Login data: To sign in, the necessary account data and session information are processed. Passwords are not stored in plain text but as cryptographic password hashes (bcrypt).
• Content data: content that users enter, upload or edit in the software, including text, images, audio and video recordings
• Usage and log data: Depending on the function, technical usage, access and security logs are processed, such as the times of sign-ins, certain system events and, where recorded, the associated user identifiers. Details of purpose and retention period follow from the information below.
• Device data: e.g. identifiers for delivering notifications

6.2 Purposes

We process this data in order to provide and operate the software, to inform users about relevant events, to ensure the security and stability of the service, to prevent misuse, to fix errors and to bill usage under the customer contract.

6.3 Storage on the device

The software stores information on the device insofar as this is technically necessary for its functions, e.g. the login session, settings and data that is synchronized with our servers.

• Legal basis: Section 25(2) no. 2 TDDDG (strictly necessary for the requested service) in conjunction with the respective legal basis of the processing

6.4 Mobile app permissions

The app only requests access permissions when you use a function that needs them (e.g. camera, microphone, photos, location, notifications). You can revoke permissions you have granted at any time in your device's settings. Individual functions may then not be available.

6.5 Notifications

We send notifications by email and as push notifications to mobile devices. Users can specify in their settings which notifications they receive and through which channel. We deliver push notifications to iOS devices via Apple's notification service (Apple Push Notification service). This involves your device's push identifier and a short, fixed text per type of notification, for example "New task for you"; the notification contains no audit titles, no locations, no due dates, no names of persons and no free text. You only see details once you open the app. Push notifications are an optional additional feature; you can turn them off in your device settings.

If you enable push notifications, protol.io uses the Apple Push Notification service (APNs) to deliver short notices to your device. For this purpose, a device-specific push token, the app identifier, a standardized notification text and, where applicable, a technical reference identifier are transmitted to Apple. Names, audit titles, locations and freely entered content are not transmitted as message text. Further information is only retrieved from protol.io after you open the app.

APNs is provided by Apple Inc. (USA) as part of the Apple Developer Program. According to its general privacy policy, Apple Distribution International Limited in Ireland is responsible for the personal data of individuals in the European Economic Area. Apple describes its own international data transfers as using standard contractual clauses. Further information is contained in Apple's privacy policy and the APNs terms of use. Enabling push notifications is voluntary and can be revoked in the device settings; the provision of the core functions of protol.io is independent of this. If you disable push notifications, the app unregisters your device the next time it is opened; after that, no further push notifications are initiated.

If you enable push notifications on your Android device, protol.io uses Google's Firebase Cloud Messaging (FCM) service to deliver short notices. This involves processing a Firebase installation or push identifier, technical app identifiers, standardized notification texts and, where applicable, technical reference identifiers. Names, location names, audit titles and free text are not transmitted in the push content. The app retrieves detailed information from the protected protol.io server only when it is opened.

Google processes the customer data required for delivery as a processor in our processing chain on the basis of the Firebase Data Processing and Security Terms. Processing on global infrastructure and in third countries, in particular the USA, is possible. For the relevant transfers, Google uses the transfer mechanisms applicable under its contractual terms, in particular the EU-U.S. Data Privacy Framework for appropriately certified recipients and otherwise appropriate standard contractual clauses. Google may process further technical usage and service data in accordance with its own privacy policy and the applicable terms.

Enabling push notifications is voluntary and can be disabled in the device settings. When a device is signed out or the installation concerned is finally deactivated, we arrange, using the available Firebase functions, for the associated registration or installation identifier to be removed. For this, Google describes a deletion period of up to 180 days from active systems and backups after a deletion request has been received.

6.6 AI-supported functions

Some functions of the software are supported by artificial intelligence. When you use such a function, the content required for it is transmitted to a specialized provider of AI services and processed there solely to generate the respective result.

• Processing takes place within the European Union.
• The providers are contractually obliged not to use the data for training their models and not to store it for longer than necessary for the processing.
• We do not make any automated decisions within the meaning of Art. 22 GDPR using AI.
• AI-supported functions are only active once a responsible person at the organization has consented; consent can be withdrawn at any time.

To speed up repeated requests, the provider may temporarily hold certain input and context components, including personal content, in a technical cache, usually for about five minutes; this period may be extended on renewed use. The cache serves only the technical execution of the AI functions; it does not involve any use for training AI models.

6.7 Legal bases and retention period

Insofar as we act as a processor, we process the data only on the customer's instructions. The legal basis is determined by the customer as the controller. Insofar as we pursue our own purposes (operation, security, protection against misuse, billing), we rely on Art. 6(1)(b) and (f) GDPR.

We record and bill the consumption of the AI functions per customer organization. As a controller in our own right, we process the data required for contract administration, invoicing, verifying correct billing and detecting and preventing misuse. This may include identifiers of individual users, insofar as they are needed to exclude non-billable AI calls by our own employees, to clarify technical billing errors or to detect misuse. Such identifiers are generally removed after 89 days at the latest, unless a specifically justified longer retention is required. Analyses of the usage behavior of individual employees for our customers' purposes, by contrast, take place exclusively within the agreed processing on behalf.

We keep purchases of AI budget and changes to the AI billing settings, with the identifier and email address of the person who made them, as billing records for ten years after the end of the calendar year in which they were made, because commercial and tax retention obligations require this (Section 257 HGB, Section 147 AO).

Content and account data are stored for as long as the customer contract exists or until the customer deletes them. After the end of the contract, we delete the customer data within 90 days, unless a statutory retention obligation prevents this. We delete technical logs after 90 days at the latest.

6.8 Comment reports and blocking

Users can report comments within their organization and block other users. When a comment is reported, the comment concerned, the reporting person, any reason given, and the handling status and handling are logged. Authorized administrators of the organization handle the reports.

When a user is blocked, we store which person blocked which other person. Blocking serves to hide the blocked person's comments from the blocking person. It does not change the organization's permissions or operational audit records.

This information is processed as part of the processing on behalf of the respective customer organization.

6.9 Optional app lock

You can additionally protect the mobile app with Face ID, fingerprint or your device passcode. The check takes place exclusively on your device, by its operating system. Our app only receives the information whether unlocking succeeded. We do not receive or store any biometric data in the process.

7. Service providers

To operate our website and software, we use carefully selected service providers that we have contractually bound as processors in accordance with Art. 28 GDPR. These include providers of the following categories:

• data center, hosting and database services
• services for sending emails
• providers of AI services
• map services for determining coordinates from addresses (only for addresses of locations, not for data of users)

Our servers and databases are located in the European Union.

We provide our customers with a list of the service providers we use as part of the data processing agreement. Data subjects can obtain the specific recipients of their data on request.

8. Transfers to third countries

Some of our service providers are based outside the EU or the EEA (in particular in the USA) or may transfer data there. In these cases we ensure an adequate level of data protection, either through an adequacy decision of the EU Commission (e.g. for companies certified under the EU-U.S. Data Privacy Framework or for the United Kingdom) or through EU standard contractual clauses pursuant to Art. 46(2)(c) GDPR.

9. App stores

You download the mobile app via the Apple App Store or Google Play. In doing so, Apple or Google process data under their own responsibility (e.g. your store account and download information). We have no influence over this. The privacy notices of the respective provider apply.

10. No disclosure for advertising purposes

We do not sell personal data and do not use it for advertising. Data is disclosed to third parties only to the categories of service providers named in this policy, where required by law (e.g. to authorities) or with your consent.

11. Data security

We take technical and organizational measures in accordance with Art. 32 GDPR to protect your data against loss, manipulation and unauthorized access. These include in particular:

• Encryption: Encrypted connections (in particular TLS) are used when personal data is transmitted between the intended system components. Other systems and end devices are protected by appropriate access and device protection measures, depending on their technical environment. For the mobile app, the protection of locally stored data also depends in particular on the security settings of the device used.
• Separation of customer data: Each customer's data is kept separate at the database level. Users can only access data of their own organization.
• Roles and permissions: Within an organization, a role and permission concept controls who may view and edit which data.
• Secure login: Passwords are not stored in plain text but as cryptographic password hashes (bcrypt). In the mobile app, login credentials are kept in the operating system's protected storage.
• Protection against misuse: Input is validated on the server, and the number of requests is limited to prevent attacks and overload.
• Traceability: Depending on the type of data, the platform records the time of creation and the assigned person or organizational assignment. Certain security-relevant and administrative events are also logged. A complete version or change history of all content is not kept.
• Data minimization: Notifications on the lock screen contain no confidential details.

12. Your rights

Under the GDPR you have the right of

• access to your stored data (Art. 15),
• rectification of inaccurate data (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20),
• objection to processing based on our legitimate interest (Art. 21), on grounds relating to your particular situation,
• withdrawal of consent you have given, with effect for the future (Art. 7(3)).

For data that we process on behalf of a customer, please address your request to the customer (see section 2).

Deleting your account

You can delete your account yourself: in the app under Account → "Delete account" or in the browser under Settings → Account. To do so, you confirm your password. You are signed out on all devices immediately. Your organization's administrators are notified and have 14 days to hand your tasks, roles and responsibilities over to others; they cannot cancel the deletion. If your organization has to keep your data longer, for example because of a statutory retention obligation, it can postpone the deletion once, with a reason, by at most 90 days; we tell you the reason and the new date by email.

Postponements of a self-requested account deletion are logged with the time, the authorized person involved, the length of the postponement and the documented reason. The log is generally deleted twelve months after the account deletion has been completed, unless longer retention is required to comply with a legal obligation or because of specifically documented litigation or a security incident. Use of the logs is limited to processing and evidencing the account deletion.

Your account. After these 14 days (or after the postponement) we delete your account: your name, your email address, your login, your profile picture, your device identifiers for push notifications and your notification settings. We confirm the deletion to you by email.

Your organization's audit records. Deleting your account does not delete your organization's records. Content you created for your organization, such as completed audits with answers, photos and signatures, tasks and comments, remains with the organization; it appears without your name as "Deleted user". It is not fully anonymous as a result: it remains linked through an internal identifier, and signatures, photos or text may still point to you. How long it is kept is decided by your organization as the controller.

AI reports and AI histories. Saved AI reports and histories of the AI functions in which you were involved are deleted separately, 90 days after your account is deleted.

Data remaining in technical systems

Individual information may remain temporarily in technical logs and backups after the account deletion. Technical logs are subject to different retention periods depending on the type of data, generally up to 89 days.

Data previously transferred to our synchronization service may remain there until it is technically cleaned up. Insofar as further data relating to you must be kept in operational audit records or because of statutory obligations, its retention follows the rules applicable to it.

Deleting your account ends your access rights but does not automatically delete all operational records you previously worked on.

Your account is managed by your organization. You can also request the deletion from an administrator of your organization or write to us, by email to info@protol.io or by post to Lido Apps UG (haftungsbeschränkt), Steinstraße 13, 14482 Potsdam; we will then forward your request to your organization.

Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg
Stahnsdorfer Damm 77
14532 Kleinmachnow
www.lda.brandenburg.de

You can also contact any other data protection supervisory authority, in particular the one at your place of residence or place of work.

13. Changes to this privacy policy

We adapt this privacy policy when our software, our service providers or the legal situation change. The version published on protol.io at the time applies.