Privacy Policy | Settleezy

Section 01

Data Controller (Verantwortlicher)

CompanySettleezy UG (haftungsbeschränkt)

RegisterAmtsgericht Berlin (Charlottenburg) · HRB 286091 B

Managing DirectorMruddual Sojitra

AddressStromstraße 48A, 10551 Berlin

Emailinfo@settleezy.de

Phone+49 030 40785572

Websitewww.settleezy.de

Section 02

Introduction

At Settleezy UG (haftungsbeschränkt), privacy is a very important topic and we want to ensure your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information in compliance with statutory law , in particular the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

This policy applies to all services offered through our website.

Section 03

Categories of Personal Data We Collect

AIdentity Data

Full name, date of birth, gender, nationality
Passport number and expiry date

BContact Data

Email address, phone number
Residential address, country of residence

CEducational Data

Academic qualifications

DTechnical Data

IP address (anonymized for analytics), browser type, device information
Cookies and usage data (with consent)

FCommunication Data

Email communications

Section 04

Purposes of Processing

We process your personal data for the following purposes:

Membership management and account administration
Service delivery and partner deal access
Event management and community features
Payment processing and invoicing
Analytics to improve our platform (with consent)
Newsletter and marketing communications (with consent)
Legal compliance and regulatory obligations
Fraud prevention and security

Section 05

Legal Basis for Processing (GDPR Art. 6)

Consent (Art. 6(1)(a)): Marketing communications, analytics cookies, and optional data sharing.
Contract Performance (Art. 6(1)(b)): To process payments and fulfil our contractual obligations.
Legal Obligation (Art. 6(1)(c)): To comply with tax, accounting, and legal requirements (e.g. invoices).
Legitimate Interests (Art. 6(1)(f)): Service improvement, fraud prevention, and security. Our legitimate interests do not override your fundamental rights.

Section 06

Data Retention Periods

Data Category	Retention Period
Account & Profile Data	Duration of active membership + 3 years after closure (§196 BGB)
Payment & Invoice Data	10 years (§147 AO , German tax law)
Contact Form	2 years or until inquiry resolved
Consents	Duration of consent + 3 years for legal proof
Analytics Data	26 months (Google Analytics standard)
Uploaded documents (e.g. passport, visa)	Duration of service + 30 days post-completion, then permanently deleted

Document Handling: Documents you upload are accessed by our team exclusively to prepare and provide our service. We do not share these with third parties. Upon deletion, files are permanently removed from primary storage, database records deleted, and a deletion event is written to our internal audit log for compliance.

Section 07

Data Sharing & Recipients

We do not sell your personal data. We may share your data with GDPR-compliant service providers and legal authorities when required by law.

Section 08

GDPR-Compliant Service Providers

Data Processing Agreements (DPAs) are in place with all providers:

Provider	Purpose	Compliance
Hostinger	Hosting and CDN	EU region, SCCs in place
Stripe	Payment processing	PCI-DSS Level 1, GDPR compliant
Google Analytics	Website analytics	IP anonymization enabled, consent required
Microsoft Clarity	Session analytics & heatmaps	Loaded after consent; sensitive areas masked
Cal.com	Consultation booking	GDPR compliant scheduling platform
Web Fonts	Typography (Inter, Space Grotesk)	Self-hosted , no external font requests

Section 09

International Data Transfers

Your personal data is primarily processed and stored within the EU/EEA (Germany). Where transfers to the USA occur (e.g. Google, Stripe), they rely on:

EU–US Data Privacy Framework certification
Standard Contractual Clauses (SCCs) approved by the European Commission

Section 10

Data Security

TLS/SSL encryption for all data in transit
Encrypted database and file storage (AES-256)
Role-based access controls (RBAC) for students, counsellors, and admins
Multi-Factor Authentication (MFA/TOTP)
Regular security audits and updates

Section 11

Your GDPR Rights

Art. 15 , Access

Request a copy of all your personal data.

Art. 16 , Rectification

Correct inaccurate or incomplete data.

Art. 17 , Erasure

Request deletion ("right to be forgotten").

Art. 18 , Restriction

Limit processing in certain circumstances.

Art. 20 , Portability

Receive your data in machine-readable format (JSON).

Art. 21 , Object

Object to processing based on legitimate interests.

Withdraw Consent

Withdraw consent at any time without affecting prior processing.

How to exercise your rights: Go to Settings → Privacy in your dashboard to export or delete your data, or email info@settleezy.de. We will respond within 30 days (extendable by 60 days for complex requests).

Section 12

Data Breach Notification

In the event of a personal data breach, we follow a structured response procedure:

Supervisory Authority (Art. 33): If a breach poses risk to your rights, we will notify the Berliner Beauftragte für Datenschutz und Informationsfreiheit within 72 hours.
Data Subject Notification (Art. 34): If a breach poses high risk, we will notify you directly without undue delay.
Internal Logging: All breaches are documented in our internal breach register for accountability.

If you suspect a data breach, please contact us immediately at info@settleezy.de.

Section 13

Right to Lodge a Complaint (Art. 77)

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority. For Germany, this is:

AuthorityBerliner Beauftragte für Datenschutz und Informationsfreiheit

AddressFriedrichstraße 219, 10969 Berlin, Germany

Websitewww.datenschutz-berlin.de

Section 14

Contact Us

Data ProtectionMruddual Sojitra (Managing Director)

Privacy EmailMruddual.sojitra@settleezy.de

General Emailinfo@settleezy.de

Phone+49 030 40785572