Skip to main content
Free demo available - Try PLANKA today!

Privacy Policy SaaS Hosting

Effective: February 10, 2026 – v1.0

1. Data Controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) is:

PLANKA Software GmbH
Lindauer Str. 4
87439 Kempten
Germany
Email: privacy@planka.group
Managing Directors: Lothar Hinz, N. Berglmeir
Commercial Register: HRB 17740, Local Court (Amtsgericht) Kempten

A Data Protection Officer has not been appointed, as the requirements under § 38 of the German Federal Data Protection Act (BDSG) are not met.

2. Scope

This Privacy Policy applies to:

  • the Provider's website (hereinafter "Website")
  • the PLANKA software in its SaaS version (hereinafter "Software" or "Service")

For the on-premise version, the Provider does not process personal data of end users, as the software is operated on the Customer's own systems. In this case, the Customer is solely responsible for data protection.

For data processing in connection with the purchase transaction by PayPro Global Inc., their own privacy policy applies. It is available on the PayPro Global website.

3. Data Processing in SaaS Use

3.1 Roles Under the GDPR

In SaaS use, the following data protection roles apply:

  • Data Controller for data processing within a PLANKA instance is the Customer (instance administrator), who determines which data is processed in the software and for what purpose.
  • Data Processor is PLANKA Software GmbH, which processes personal data exclusively on behalf of and on the instructions of the Customer.

The details of data processing are set out in a separate Data Processing Agreement (DPA) pursuant to Article 28(3) GDPR.

3.2 Categories of Personal Data

In the course of SaaS provision, we process the following categories of personal data:

Account Data:

  • Username, email address
  • First and last name (if provided)
  • Profile picture (if uploaded)
  • Role and permissions within the instance

Technical Data:

  • IP address
  • Browser type and version
  • Operating system
  • Time and duration of access
  • Referrer URL

Usage Data:

  • Content created, edited, and deleted (boards, cards, comments, attachments)
  • Activity logs within the instance

Customer-Uploaded Data:

  • All content and files uploaded by the Customer or their end users to the software

3.3 Purposes and Legal Bases

Purpose Legal Basis Explanation
Provision and operation of the software Art. 6(1)(b) GDPR Performance of the service agreement
Technical logging (server logs) Art. 6(1)(f) GDPR Legitimate interest in system security and error analysis
Creation of backups Art. 6(1)(b), (f) GDPR Contract performance and legitimate interest in data security
Customer support Art. 6(1)(b) GDPR Contract performance
Billing and license management Art. 6(1)(b) GDPR Contract performance
Compliance with legal obligations Art. 6(1)(c) GDPR Statutory retention obligations

3.4 Retention Periods

  • Account data and usage data: For the duration of the active service relationship. After contract termination, the Customer has 30 days to request the export of their data. After expiration of this period, the data will be irreversibly deleted.
  • Server logs: Automatically deleted after 90 days, unless security incidents require longer retention.
  • Backup data: Deleted 30 days after contract termination.

4. Data Processing on the Website

4.1 Server Logs

When visiting our website, our web server automatically collects technical data (IP address, browser type, pages accessed, time of access). This data is required for the technical provision of the website and to ensure system security. The legal basis is Art. 6(1)(f) GDPR (legitimate interest). Server logs are deleted after 90 days.

4.2 Measuring reach

We count how often individual steps happen on our website – the price list being opened, the trial form being sent. The counting runs on our own servers; we use no analytics software and no external service for it, and no data is transmitted to third parties. What is stored is a total per day and step, together with at most one short value from a fixed list (the plan that was looked at, or a size band). No cookies are set and no IP addresses or identifiers are stored, so identification of individual persons is ruled out. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in improving our web presence). The counting happens on the website only, not within the PLANKA software.

4.3 Contact

When you contact us via the ticket system or by email, we process the data you provide (name, email address, content of the inquiry) to handle your request. The legal basis is Art. 6(1)(b) GDPR (contract performance) or Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries).

5. Cookies

The PLANKA software and our website use only technically necessary cookies (session cookies and login cookies). These cookies are required for the operation of the software and to maintain your session. They do not contain personal tracking information and are deleted at the end of the session or upon expiration of the login validity.

Consent is not required for technically necessary cookies pursuant to § 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG).

Analytics cookies and marketing cookies are not used.

6. Recipients and Data Transfers

6.1 Hosting Providers (Sub-Processors)

SaaS instances are operated on servers of external hosting providers in Germany: currently Hetzner Online GmbH, moving to netcup GmbH over the coming weeks. For Customers within the EU, hosting takes place on servers within the EU. The current list of sub-processors is part of the Data Processing Agreement (DPA), which is available in the customer center.

6.2 PayPro Global Inc. (Merchant of Record)

In the course of the purchase transaction, PayPro Global Inc. transmits customer and payment data to us to the extent necessary for the provision and management of the software license. We transmit to PayPro Global only data necessary for billing or licensing purposes (e.g., number of active user licenses). Personal data of end users or substantive usage data is not transmitted to PayPro Global. PayPro Global is an independent data controller.

6.3 No Other Disclosure

Beyond the above, personal data is not transmitted to third parties unless:

  • this serves accounting or tax purposes, or
  • a legally binding court order requires disclosure.

7. Data Transfers to Third Countries

For Customers located within the EU, personal data is processed exclusively on servers within the European Union. For Customers outside the EU, hosting may take place in data centers outside the EU. In such cases, we ensure an adequate level of data protection through appropriate safeguards (e.g., Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR), to the extent the GDPR applies.

8. Your Rights as a Data Subject

8.1 Rights Against the Data Controller

As an end user of the SaaS version, your data protection claims are primarily directed at the Customer (instance administrator) as the data controller. These include in particular:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object (Art. 21 GDPR)

8.2 Assistance by the Provider

We assist the Customer (data controller) in fulfilling their data protection obligations under the Data Processing Agreement. You may also contact us directly at: privacy@planka.group

8.3 Withdrawal of Consent

To the extent that processing is based on your consent, you may withdraw such consent at any time with effect for the future. The lawfulness of processing carried out prior to the withdrawal remains unaffected.

8.4 Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. The supervisory authority responsible for us is:

Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach
Germany
Website: www.lda.bayern.de

9. Technical and Organizational Measures

We implement appropriate technical and organizational measures to protect your personal data in accordance with Article 32 GDPR, in particular:

  • Encrypted data transmission (TLS/SSL)
  • Server Access via SSH-Keys
  • Firewall and Fail2ban (necessary Ports only)
  • 2FA, SQL-Injection and CSRF/XSS Protection
  • Access control and authorization management
  • Regular security updates
  • Regular backups
  • Physical security of data centers (ensured by the hosting provider)

The specific measures are documented in the Data Processing Agreement (DPA).

10. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy to reflect changes in the legal situation or changes to our services or data processing practices. The current version is available on our website at all times. Registered Customers will be separately informed of material changes.

PLANKA Software GmbH · Lindauer Str. 4 · 87439 Kempten · Germany