Privacy Notice

What personal data we process, why, and on what legal basis.

Version 2026-09-08

1. Controller

Provider

— not yet configured —

Email

—

Full provider details are in the Impressum. We are not currently required to appoint a data protection officer, since fewer than 20 people are constantly engaged in automated processing (§ 38(1) BDSG).

2. Two distinct roles

• As controller we process the data you enter when registering for the demo, and the data of visitors to this website. This notice covers that processing.
• As processor we handle data a hotel imports as a point-of-sale CSV. The hotel remains the controller; we act only on its documented instructions under an Art. 28 GDPR data processing agreement (see the AVV / DPA). For that data, the hotel’s own privacy notice governs.

3. Processing activities

3.1 Visiting the website

Your browser transmits technically necessary data that our hosting provider records in server logs: IP address, timestamp, requested resource, HTTP status, bytes transferred, referrer and user agent.

• Purpose: serving the site, stability, attack detection.
• Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in secure and reliable operation.
• Retention: 30 days.

Fonts are served from our own origin. No connection is made to Google Fonts or any other third-party CDN, so your IP address is not disclosed to those parties.

3.2 Demo registration and sign-in

We collect your name, business email address, company, telephone number, job role, and a password that we store only as a bcrypt hash, never in clear text.

• Purpose: creating and administering your account, authentication, address verification, enforcing the trial import limit.
• Legal basis: Art. 6(1)(b) GDPR, performance of the usage relationship at your request.
• Retention: until you delete the account. Unverified accounts are deleted after 30 days.

3.3 Verification and password emails

We send address confirmation and password reset messages through Resend. The corresponding tokens are stored only as SHA-256 hashes, so they are unusable even to someone who obtains database access.

• Legal basis: Art. 6(1)(b) and Art. 6(1)(f) GDPR (account security).
• Retention: 24 hours and 60 minutes respectively.

3.4 Abuse prevention

To resist automated registration and credential stuffing we record sign-up and sign-in attempts, including IP address and timestamp, and use Cloudflare Turnstile on the registration form.

• Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in preventing abuse and protecting our users’ accounts.
• Retention: 30 days.

3.5 CSV import (processor role)

Imported files are processed in memory and not stored. The database holds only import metadata: file name, row count, timestamp and your chosen column mapping.

Files containing a full payment card number are rejected automatically. We process truncated card data only, meaning the last four digits.

• Legal basis: Art. 28 GDPR together with the data processing agreement; the hotel remains controller.
• Retention: contents for at most 60 minutes in memory; metadata until account deletion.

3.6 Marketing email

If you opted in explicitly at registration, we occasionally send product news. Opt-in is double: you receive a confirmation email and are added only after you confirm. We record the timestamp, IP address and the version of the consent wording shown to you.

• Legal basis: Art. 6(1)(a) GDPR and § 7(2)(2) UWG.
• Withdrawal: at any time through the unsubscribe link in every message, without affecting the lawfulness of prior processing.
• Retention: proof of consent kept 3 years after withdrawal, since Art. 7(1) GDPR places the burden of proof on us.

4. Cookies

We use strictly necessary cookies only, so no consent banner is required: § 25(2)(2) TDDDG exempts storage that is strictly necessary to provide a service the user has explicitly requested. German supervisory authority guidance is that a banner should specifically not be shown in this situation, because offering a choice where none exists is itself misleading.

• Session (authjs.session-token, __Secure- prefixed in production): keeps you signed in. Necessary; at most 12 hours.
• CSRF (authjs.csrf-token): protects forms against cross-site request forgery. Necessary; session only.
• Language (closewise_locale): remembers your chosen language. Necessary to render what you asked for; 12 months.

We run no analytics, tracking or advertising cookies, and embed neither Google Analytics nor advertising pixels.

5. Recipients and processors

The current list is always at Sub-processors.

6. International transfers

Our database runs in the European Union (Ireland). Some providers above are established in the United States. Where personal data is transferred to a third country we rely on the European Commission’s Standard Contractual Clauses under Art. 46(2)(c) GDPR, supported by the EU-US Data Privacy Framework adequacy decision under Art. 45 GDPR where the recipient is certified.

That adequacy decision is currently in force, and an appeal is pending before the Court of Justice of the European Union (C-703/25 P). We have therefore put the Standard Contractual Clauses in place as the load-bearing basis throughout, so transfers remain lawful even if the decision falls away. A copy of the safeguards is available on request.

7. Retention

We delete personal data once its purpose has been met and no statutory retention obligation applies. The specific periods are stated with each activity above and are enforced automatically.

8. Your rights

You have the right at any time to:

• access the data we hold about you (Art. 15 GDPR),
• have inaccurate data corrected (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability in a structured, commonly used, machine-readable format (Art. 20 GDPR),
• object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR),
• withdraw any consent with future effect (Art. 7(3) GDPR).

You can exercise access and erasure directly in the application under My data, which gives you a complete JSON export and lets you delete your account with all associated data. A message to our contact address works too; we respond within one month (Art. 12(3) GDPR).

You may also complain to a supervisory authority, in particular the Berliner Beauftragte für Datenschutz und Informationsfreiheit or the authority where you habitually reside (Art. 77 GDPR).

9. Automated decision-making

There is no automated decision-making or profiling within the meaning of Art. 22 GDPR. Night-close reconciliation is rule-based and produces a list for a duty manager to review; it makes no decision about a person.

10. Security

We apply technical and organisational measures under Art. 32 GDPR: TLS in transit, encryption of the database at rest, passwords stored only as bcrypt hashes, tokens stored only as SHA-256 hashes, database access through a least-privilege role, rate limiting on authentication, and logging that excludes personal data. The TOM annex to the data processing agreement sets these out in detail.

11. Changes

We update this notice when our processing or the law changes. The current version is dated 2026-09-08.