Privacy policy

As of: 14 October 2026

1 Controller

The controller within the meaning of the GDPR is:

BERYK Consulting GmbH

Friedrichstr. 155, 10117 Berlin

Email: contact@quupp.com

Represented by: André Rüdiger

2 General information on data processing

We process our users’ personal data only insofar as this is necessary to provide a functioning platform and our content and services. Processing is regularly based on Art. 6(1)(b) GDPR (performance of a contract) or Art. 6(1)(f) GDPR (legitimate interests). The service is directed at entrepreneurs.

3 Hosting, server log files and login log

3.1 We operate the application ourselves on servers of netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, in Germany. The database and document storage, the mail server, and our reach-measurement instance are located there as well. netcup processes the data on our behalf (Art. 28 GDPR).

3.2 Each time our platform is accessed, systems used to provide it may collect data and information (IP address, date and time, page accessed, browser type). This information serves technical provision and IT security (Art. 6(1)(f) GDPR). It is not used for advertising. No service that forwards IP addresses to third parties for reputation checks is used.

3.3 To secure user accounts we keep a login log. It contains the email address, IP address, the event (for example login, failed login, password change, account deletion), the outcome, and the time. For each session we store the IP address at login. The legal basis is Art. 6(1)(f) GDPR (protection against misuse and traceability of account changes). The periods are set out in section 15.

4 Registration and user account

4.1 Use of the service requires registration as an entrepreneur. We process first and last name, email address, and the password as a hash, and also the name on the invoice, the billing address, the VAT identification number where it must be provided, and optionally the commercial-register number. Anyone who enables optional two-factor authentication stores an encrypted TOTP secret with us. The legal basis for the account data is Art. 6(1)(b) GDPR (performance of a contract). For optional TOTP the legal basis is Art. 6(1)(f) GDPR (security of the user account).

4.2 When signing up for the test phase, participants may voluntarily consent to receive information about the service by email. The legal basis is Art. 6(1)(a) GDPR. Consent can be withdrawn at any time by writing to contact@quupp.com. Messages concerning the test participation itself are sent to perform the contract (Art. 6(1)(b) GDPR).

5 Verification of billing details

5.1 Before we enable payment by invoice, we verify the details given at registration. For this we transmit the VAT identification number, the company name, and the address to the VAT Information Exchange System (VIES) of the European Commission and to the German Federal Central Tax Office (Bundeszentralamt für Steuern, BZSt), An der Küppe 1, 53225 Bonn. Both confirm whether the number is valid and whether the name and address match it.

5.2 We also match the company name and the name of the registering person against the sanctions lists of the European Union and the United States (OFAC). We download the lists. The matching takes place on our own systems, and no names are transmitted to third parties in the process.

5.3 The legal basis is Art. 6(1)(c) GDPR insofar as we are obliged to verify VAT identification numbers and to comply with sanctions, and otherwise Art. 6(1)(f) GDPR (protection against bad debts and against dealings with sanctioned persons). We store each check as proof with the time, the list version, the result, and the responses from VIES and BZSt. The proof is kept for 10 years, including after the account has been deleted.

6 Document upload and AI-assisted analysis

6.1 The core function of the service is that users upload documents which are processed in order to provide the analysis owed under the contract. The legal basis is Art. 6(1)(b) GDPR. Where the documents contain personal data of third parties, we process them as a processor under the data processing agreement.

6.2 Part of the analysis is performed by AI models that we operate ourselves. In that case the text passages do not leave our systems. For the remaining analysis we transmit text passages from the uploaded documents to the following processors pursuant to Art. 28 GDPR:

• IONOS Cloud GmbH, Elgendorfer Str. 57, 56410 Montabaur – processing in Germany
• OVH SAS (OVHcloud), 2 rue Kellermann, 59100 Roubaix – processing in France (Gravelines), unless processing exclusively in Germany has been agreed on request

If processing exclusively in Germany has been agreed on request, we use only our own models and IONOS Cloud for inference. Hosting remains with netcup GmbH in Germany. The providers process the content only to produce the analysis result and do not store it permanently. Use for training AI models is contractually excluded. The providers record only metadata such as time, model used, and the size of the request, in order to bill and operate the service.

6.3 The database and object storage for the documents are hosted by netcup GmbH in Germany. Customer documents are not passed to a payment or invoicing service.

6.4 We do not evaluate uploaded documents or the analysis results generated from them for our own purposes. Only aggregated operational metrics with no document content and no personal data are permitted, namely runtimes, error rates, and classification statistics. These metrics are not personal data. We do not rely on a legitimate interest in the document contents.

7 Special categories of personal data (Art. 9 GDPR)

Uploading special categories of personal data within the meaning of Art. 9(1) GDPR is not permitted. These include in particular health data, data concerning sex life or sexual orientation, genetic and biometric data for the purpose of uniquely identifying a natural person, data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, and trade union membership. The user represents that uploaded documents do not contain such data. Consent to the processing of this data is not obtained, because its processing is not intended.

8 Invoices and payment

8.1 We create invoices with Lexware Office, a service of Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg, Germany, acting on our behalf (Art. 28 GDPR). For this Lexware receives the company name, address, VAT identification number, the email address for sending invoices, and the invoice items. The legal basis is Art. 6(1)(b) and (c) GDPR (performance of the contract and commercial and tax duties). Customer documents are not transmitted for this purpose.

8.2 Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, the Netherlands, collects credit-card and SEPA direct-debit payments. For that it receives the company, invoice data, and payment data, not the uploaded documents.

9 Sending emails

We send confirmation codes, invitations, password links, invoices, and account notices via the mail server at netcup GmbH. For each message sent we log the recipient, the type of message, the subject, the time, and the delivery status, so that a failed delivery can be traced. Codes and message text are kept out of the log. The legal basis is Art. 6(1)(b) GDPR for sending and Art. 6(1)(f) GDPR for the log.

10 Customer care

For customer care we use a CRM system that we operate ourselves on our servers at netcup GmbH. In it we record users’ first and last name, email address, company, and billing address. At each login we note the time and IP address. The data is not passed to any external provider. The legal basis is Art. 6(1)(b) GDPR for managing the contract and Art. 6(1)(f) GDPR for the login notes (support with enquiries and detecting unusual access).

11 Ratings and feedback

11.1 Users can voluntarily give stars and comments on individual functions in the workspace. We store them with the account and use them to improve the service (Art. 6(1)(b) and (f) GDPR).

11.2 After a service has been provided we may ask for a rating by email. The link in the message is personal and valid for a limited time. The legal basis is Art. 6(1)(f) GDPR (improving the service) in conjunction with § 7(3) UWG. You can object to such requests at any time by writing to contact@quupp.com, without incurring any costs other than transmission costs at basic rates.

12 Cookies, local storage and reach measurement

12.1 We set these cookies and no analytics or marketing cookies:

• rp_session is strictly necessary for login and the session. It is set on login, registration, the live demo, and accepting an invitation, lasts twelve hours, and is readable only by the server. Logging out and deleting the account remove it. Legal basis: Art. 6(1)(b) and (f) GDPR, § 25(2) TDDDG.
• rp_consent stores the choice in the cookie banner (necessary only, or all). It is necessary so that the banner does not return on every page, and it lasts one year.
• rp-lang stores a language chosen with the switch (German or English) for one year. It is set only if “Accept all” was chosen in the banner and the language is changed. Without that consent the interface follows the browser language.

12.2 We also store entries in the browser’s storage that are necessary for operating the interface (§ 25(2) TDDDG):

• rp-nav-collapsed and rp-project-nav-collapsed remember whether the navigation is collapsed. They remain until the browser data is cleared.
• rp-signup-email and rp-signup-mail-failed show after registration which address the confirmation code was sent to. They last only until the tab is closed.
• rp-demo-notice remembers that the live-demo notice has been read. It lasts only until the tab is closed.

12.3 The public website, meaning the start page, help, and legal texts, loads a script from our own Umami instance at uma.quupp.com, which runs on our servers at netcup GmbH. It sets no cookie and stores nothing on the device. It measures the page viewed, the referrer, the browser, and the device. An account and document contents are not recorded. Sign-in, the workspace, and administration are left out. The legal basis is the legitimate interest in an anonymous measurement of reach for these pages (Art. 6(1)(f) GDPR).

13 Recipients

14 Transfers to third countries

We do not transfer personal data to countries outside the EU or the EEA. Our processors for hosting, AI analysis, and invoicing process the data exclusively in the EU. We download the United States sanctions lists without sending any data there.

15 Storage period

Personal data is deleted as soon as the purpose of processing ceases and no statutory retention duty applies. In detail:

• We keep invoice data for up to 10 years under §§ 257 HGB and 147 AO.
• We keep proof of the checks under section 5 for 10 years, including after the account has been deleted.
• We store uploaded documents and analysis results until the user deletes them, and at the latest until 30 days after the user agreement ends. After cancellation of a paid subscription, projects remain exportable for 30 days and are then deleted. Documents the user uploaded remain accessible during that time via “My area” → “My documents”.
• We delete the login log, the mail log, and processing logs after 30 days. A different period can be set in the administration and is at most 10 years. Registration, password changes, and releases remain noted on the account as proof until it is deleted, and are then deleted with the same period.
• Sessions end after twelve hours or on logout.
• Backups are overwritten after 30 days. Deleted data therefore disappears from the backups no later than 30 days after deletion.
• We delete CRM entries after the customer relationship ends unless a retention duty applies.

16 Contact by email and contact form

If you write to us at contact@quupp.com or use the contact form, we process your name, your email address, and the information in your message in order to reply. We forward messages from the form via our mail server to contact@quupp.com. The legal basis is Art. 6(1)(b) GDPR where the message concerns a contract, otherwise Art. 6(1)(f) GDPR. Messages are deleted once the matter is closed and no retention duty applies.

17 Whether provision of the data is required

Account data and the uploaded documents are required to perform the contract. Without them the service cannot be provided. For payment by invoice, the details for the check under section 5 are also required. The commercial-register number, two-factor authentication, and consent to information about the service are voluntary. There is no statutory duty to provide the data to us.

18 Automated decision-making

18.1 The risk score evaluates projects, not persons.

18.2 The check under section 5 runs automatically. If it succeeds, payment by invoice is enabled. If it does not succeed or a result is still pending, credit card and SEPA direct debit remain available, and an administrator reviews the case manually and can enable payment by invoice. On request we explain the result, accept your comments, and check again. A decision within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you is therefore not made solely by automated means.

19 Right to object

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Art. 6(1)(f) GDPR. With us this concerns the server log files, the login log, the security of the user account including optional two-factor authentication, the check under section 5 insofar as it is not based on a legal duty, the login notes in the CRM, the mail log, and the reach measurement. You can object to requests for a rating by email at any time without giving reasons. The objection is to be sent to contact@quupp.com. We will then no longer process the data unless we can demonstrate compelling legitimate grounds which override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defence of legal claims.

20 Further data-subject rights

You also have the following rights:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR)

To exercise them, contact contact@quupp.com.

21 Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority of your habitual residence, your place of work, or our registered office is generally competent. For us that is:

Berlin Commissioner for Data Protection and Freedom of Information

Alt-Moabit 59–61, 10555 Berlin

22 Changes to this privacy policy

We reserve the right to adapt this privacy policy in order to reflect changes in the law or in the service. The version published on the platform at the time applies.