Privacy policy

1. Controller

The controller responsible for data processing on this website within the meaning of the GDPR is:

Mika Joos
Joos Soft Solutions
Listweg 4
72581 Dettingen an der Erms, Germany
Email: info@pfotencard.de
Phone: +49 163 3058605

If you have any questions about data protection, you can contact us at any time at the email address given above.

2. Collection and storage of personal data and the nature and purpose of its use

a) When visiting the website (hosting and server log files)

When you access our website, our hosting provider automatically stores information in so-called server log files. We use the service provider Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, for hosting. Processing takes place in the EU regions Frankfurt am Main (website) and Dublin, Ireland (API servers); insofar as Vercel accesses data in the USA in the course of support or operations, the transfer is safeguarded by the adequacy decision of the EU Commission (EU-US Data Privacy Framework, Vercel is certified) and EU standard contractual clauses (Art. 46 GDPR). The data processed includes:

• IP address of the requesting computer
• Date and time of access
• Name and URL of the file accessed
• Browser and operating system used

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in the secure and stable operation of the website). For security reasons, log files are stored for a maximum of 30 days and then deleted.

b) During registration and contract processing (dog schools)

If you subscribe to our software as a dog school and create a user account, we collect the following data:

• Name of the dog school / company name
• First and last name of the contact person
• Email address and encrypted password (auth data via Supabase)
• Billing address
• Phone number (optional)

Legal basis: Art. 6 (1) (b) GDPR (performance of a contract). The data is stored in our secure database infrastructure at the provider Supabase (server location Dublin, Ireland). Supabase is operated by Supabase, Inc. (USA); access by the US parent company therefore cannot be completely ruled out. The transfer is safeguarded by EU standard contractual clauses (Art. 46 GDPR) and, insofar as the provider is certified, by the EU-US Data Privacy Framework.

c) Registration and sign-in with Google (optional)

Alternatively, you can register and sign in using your Google account (“Sign in with Google”). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Only if you choose this sign-in method will your email address, your name and your Google account ID be transmitted to us via our authentication service (Supabase); Google receives the information that you are signing in to PfotenCard. The legal basis is Art. 6 (1) (b) GDPR (provision of the sign-in method you have chosen). Google may transfer data to the USA; the transfer is safeguarded by the adequacy decision of the EU Commission (EU-US Data Privacy Framework) and EU standard contractual clauses. Further information: policies.google.com/privacy

d) Address autocompletion (OpenStreetMap/Nominatim)

When you enter addresses in the registration form, in the operator portal and in the Academy Studio (e.g. the address of the dog school), we use the Nominatim service of the OpenStreetMap Foundation (St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom) for address suggestions. In doing so, your search input (address text) and your IP address are transmitted to OSMF servers in the United Kingdom. The United Kingdom is covered by an adequacy decision of the EU Commission pursuant to Art. 45 GDPR, so the data transfer is lawful. Legal basis: Art. 6 (1) (b) GDPR (performance of a contract – to correctly record your billing address).

e) When contacting us by email or form

For enquiries of any kind, we offer you the option of contacting us by email or via a contact form. A valid email address is required for this. Processing is based on Art. 6 (1) (b) GDPR (insofar as contractual questions are concerned) or Art. 6 (1) (f) GDPR (legitimate interest in answering enquiries). We store your enquiry (name, email address, optionally phone number, subject and message) in our database at Supabase and delete it no later than six months after processing has been completed, unless statutory retention obligations prevent this.

f) Verification of the VAT identification number

If you provide a VAT identification number when booking a plan, we verify it via the interface of the VAT Information Exchange System (VIES) of the European Commission. In doing so, the number is transmitted to the European Commission or the competent national tax administration. If we carry out a check in the internal administration area, the number is passed on to VIES via the verification service vat.erply.com (Erply, Estonia). The legal basis is Art. 6 (1) (c) GDPR in conjunction with the VAT regulations and Art. 6 (1) (b) GDPR.

g) Application programming interface (API) and webhooks

If a dog school uses our API or webhooks, we store for each API key only a check value (hash), the prefix, the permissions and expiry or revocation dates, as well as logs of write access and webhook delivery attempts (time, endpoint, result). The purposes are the performance of the contract (Art. 6 (1) (b) GDPR) and the security of the platform (Art. 6 (1) (f) GDPR). We delete delivery logs after 30 days and key data at the end of the contract.

h) Reporting obligations as a platform operator (DAC7)

Insofar as we are subject to reporting obligations as a platform operator under the German Platform Tax Transparency Act (PStTG) for sales of online courses via the Academy, we collect the legally required information from the selling dog schools (including name, address, tax or business identification number, VAT identification number, bank details and, for natural persons, date of birth) as well as the revenue, and report it annually to the German Federal Central Tax Office (Bundeszentralamt für Steuern). The legal basis is Art. 6 (1) (c) GDPR in conjunction with §§ 13 et seq. PStTG; the information is deleted ten years after the end of the reporting period (§ 24 PStTG).

3. Payment processing (Stripe)

To process paid subscriptions, we use the payment service provider Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland).

Your payment data (e.g. credit card details, bank account details) is not stored on our own servers but is processed directly by Stripe via an encrypted connection. We only receive status messages about successful or failed payments as well as anonymised invoice references.

Legal basis: Art. 6 (1) (b) GDPR (performance of a contract).

If a dog school activates online payments for its customers, Stripe sets up a separate account for it (Stripe Connect). Stripe collects the information required for identity verification (e.g. name, address, date of birth, bank details, ID data) directly and as an independent controller in order to fulfil its legal obligations (in particular the prevention of money laundering); we only receive the status of the account.

Note on third-country transfers: Stripe may transfer data to the USA. The data transfer is based on the adequacy decision of the EU Commission (EU-US Data Privacy Framework) and on EU standard contractual clauses (SCC) pursuant to Art. 46 GDPR. Further information can be found in Stripe's privacy policy: stripe.com/de/privacy

4. Email communication (Resend)

For the automated sending of transactional emails (e.g. registration confirmations, invoices, password resets), we use the service provider Resend (Resend, Inc., USA). In doing so, your email address is transmitted to Resend.

Note on third-country transfers: The data transfer to the USA is based on the adequacy decision of the EU Commission (EU-US Data Privacy Framework) and on EU standard contractual clauses (SCC) pursuant to Art. 46 GDPR.

4a. Application for the beta phase

If you apply for the beta phase via the form, we process your name, your email address and, if provided, your phone number in order to review your application and contact you. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures). The information is stored in our database at Supabase and deleted no later than six months after the application process has been completed, unless a contractual relationship arises from it.

4b. Public dog school directory

Dog schools that use our software can voluntarily have themselves listed in our public directory on pfotencard.de. Only the information that the dog school itself releases for the directory is published, such as name, address, phone number, email address, website, logo, description, services and opening hours. In the case of sole traders, this information constitutes personal data.

The legal basis is the consent of the dog school (Art. 6 (1) (a) GDPR), which is stored with a timestamp. The dog school is responsible for the accuracy and lawfulness of its information. It can deactivate the entry in the settings at any time; it is then removed from the directory.

4c. Reviews

If you, as a user, submit a review of PfotenCard and expressly agree to it being displayed on our website, we publish your review (stars and text) with your first name and the initial of your surname or, if you wish, anonymously. The legal basis is your consent (Art. 6 (1) (a) GDPR). You can withdraw your consent at any time with effect for the future and request the deletion of your review (email to info@pfotencard.de). Without your consent, the review will not be published.

4d. Newsletter (double opt-in)

If you subscribe to our newsletter, we use your email address exclusively to send you information about PfotenCard (product news, features, offers for dog schools). Subscription takes place using the double opt-in procedure: after signing up, you receive an email with a confirmation link; the newsletter is only activated once you confirm your subscription there. The link is valid for 48 hours. We delete unconfirmed subscriptions after seven days at the latest.

In order to be able to prove your consent (Art. 7 (1) GDPR), we store the time and IP address at the time of subscription and at the time of confirmation, as well as the wording of the declaration of consent. The legal basis is Art. 6 (1) (a) GDPR (consent) in conjunction with § 7 (2) no. 2 UWG (German Act against Unfair Competition); for storing the proof, Art. 6 (1) (f) GDPR. The newsletter is sent via the service provider Resend (see section 4).

You can unsubscribe from the newsletter at any time via the unsubscribe link at the end of every email or by email to info@pfotencard.de; your consent is thereby withdrawn with effect for the future. After unsubscribing, you will no longer receive any newsletters. The proof of the consent given and withdrawn is kept for a further three years from unsubscription and then deleted.

4e. Services of the dog schools (app, link pages, newsletters, Academy)

Dog schools can operate their own services with PfotenCard: a customer app, link pages under pfotencard.de/l/…, newsletters to their customers and online courses in the Academy. The respective dog school is the controller for the processing of the data you provide there (e.g. subscribing to a dog school's newsletter, bookings, purchases); PfotenCard processes this data as a processor pursuant to Art. 28 GDPR. Details can be found in the dog school's privacy policy, which is linked on each of these pages.

Link pages do not set cookies and do not use tracking; only total page views and clicks are counted, without reference to individual visitors. Accessing them generates server logs as described in section 2 a). The dog schools' newsletters are sent via Resend (section 4) and contain no tracking pixels or personalised click tracking. PfotenCard itself is the controller for the learners' accounts in the Academy; the privacy policy on akademie.pfotencard.de provides information on this. The Academy's course videos are stored at BunnyWay d.o.o. (bunny.net), Ljubljana, Slovenia, and played via its content delivery network; in the process, the IP address, time and device data of those accessing them are processed. Bunny is engaged as a processor; where delivery takes place via servers outside the EU, this is safeguarded by EU standard contractual clauses.

We process reports of illegal content (via the “Report content” form in the app, the Academy, on link pages and in the dog school directory, or by email to abuse@pfotencard.de) in order to review them and inform the parties involved (Art. 6 (1) (c) GDPR in conjunction with Art. 16, 17 Digital Services Act). Only the information from the form (reason, location, substantiation, name and email address, declaration of good faith) and the platform concerned are stored; we do not store IP addresses in this context. We only pass on the name and email address of the reporting person to the dog school concerned if this is required by law. The information is automatically deleted six months after the case has been closed, and reports that have not been closed after 24 months at the latest, unless it is needed for legal disputes.

5. Cookies, local storage and tracking

Technically necessary storage: We use technically necessary cookies and local storage entries (e.g. for the login area and your session) to provide the core functions of the website. Legal basis: § 25 (2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) in conjunction with Art. 6 (1) (b) GDPR.

Analytics and tracking: We currently do not use any comprehensive tracking or analytics tools (such as Google Analytics). Should we use such tools in the future, this will only happen after your express and informed consent, obtained via a consent request at that time. The legal basis would then be Art. 6 (1) (a) GDPR. You can withdraw any consent given at any time.

6. Disclosure of data to third parties

Your personal data is only transferred to third parties insofar as this is necessary for the performance of the contract or we are legally obliged to do so. Our processors (hosting: Vercel/Supabase, payment processing: Stripe, email delivery: Resend, address autocompletion: OpenStreetMap/Nominatim, optional Google sign-in: Google Ireland Ltd.; in the apps and the Academy additionally error monitoring: Sentry, video hosting: bunny.net) have been carefully selected and are contractually obliged to comply with data protection requirements. Data is not passed on for advertising purposes or to other third parties.

7. Internal usage statistics (product analysis)

In order to further develop PfotenCard, analyse errors and plan capacity, we evaluate aggregated usage figures in the internal super admin area. These include, for example, the number of uploaded homework assignments, chat messages sent, appointments booked, shop orders and certificates issued, as well as which modules (e.g. calendar, shop, chat, VIP module), level systems and branding settings (e.g. logo, colours) are used or configured by the individual dog schools.

This evaluation takes place exclusively in the form of figures and aggregates (e.g. “342 homework posts” or “Shop module active at 12 of 40 dog schools”). No names, email addresses, message content, dog names or other personal data of individual end customers (dog owners) are displayed or exported in the super admin area. To support a dog school, authorised staff can view its settings in a read-only view from which personal data is removed before display. Access to individual data of end customers only takes place in the cases governed by section 8 of the DPA (request from the dog school in a support case, abuse report or specific security risk), primarily pseudonymised and read-only, and is recorded in the dog school's audit log, which the dog school can view in the operator portal. Only authorised staff of Joos Soft Solutions have access to these statistics.

The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in product improvement, error analysis and stable operation of the platform). Insofar as the underlying data is processed on behalf of the respective dog school, this takes place within the framework of the data processing agreement (DPA) concluded with the dog school pursuant to Art. 28 GDPR – see there for details.

8. Storage period

We only store your personal data for as long as is necessary to fulfil the respective purposes or as required by statutory retention periods. Data from contractual relationships (invoices, subscription data) is retained in accordance with the retention periods under tax and commercial law: invoices and accounting records for eight years, commercial and business letters and other documents for six years, in each case from the end of the calendar year (§ 147 AO, § 257 HGB in the version applicable since 2025). After the end of the contract, data not subject to retention obligations is deleted within 30 days.

The provision of your data is neither required by law nor by contract. However, without the data marked as mandatory during registration or booking, we cannot conclude a contract with you. No automated decision-making, including profiling (Art. 22 GDPR), takes place.

9. Your rights as a data subject

Under the GDPR, you have the following rights vis-à-vis us:

• Access to your personal data being processed (Art. 15 GDPR).
• Rectification of inaccurate or incomplete data (Art. 16 GDPR).
• Erasure of your data, unless statutory retention obligations prevent this (Art. 17 GDPR).
• Restriction of processing (Art. 18 GDPR).
• Data portability in a commonly used format (Art. 20 GDPR).
• Objection to processing insofar as it is based on legitimate interests (Art. 21 GDPR). If you object, we will no longer process your data unless we can demonstrate compelling legitimate grounds for the processing.
• Withdrawal of consent given at any time with effect for the future (Art. 7 (3) GDPR).

To exercise your rights, simply send an email to: info@pfotencard.de

Right to lodge a complaint: Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority. The competent supervisory authority for Baden-Württemberg is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany (www.baden-wuerttemberg.datenschutz.de).