Privacy Policy of cityscaper GmbH

(Pelicad is a software product of cityscaper Gmbh)

‍

1. Introduction
   Cityscaper GmbH ("we," "us," "our") values the privacy of your personal information. This Privacy Policy explains how we collect, use, and protect your data when you use our website and the Pelicad web app service. Please read this policy carefully to understand our practices regarding your personal information.
   ‍

2. Data Controller
   cityscaper GmbH
   Kleinmarschierstr. 33, 52062 Aachen, Germany
   Email: privacy@pelicad.com
   ‍

3. Personal Information We Process & How We Use Your Information‍
   1. ‍Registration and Account Creation
      ‍To access certain services of Pelicad, you must create an account, which requires providing personal information such as your name and email address which is stored in Google Firebase. The legal basis for processing this data is the fulfillment or initiation of a contract, per Article 6(1)(b) GDPR.
      
      We retain this data for as long as your account remains active. If the account is inactive or terminated, the data will be deleted or anonymized.
      ‍‍
   2. Account Settings
      You can customize your account settings, including setting your name, address, and email preferences which is stored in Google Firebase. The legal basis for processing this data for EEA users is your consent, per Article 6(1)(a) GDPR.
      ‍‍
   3. Payment Processing
      Payments for Pelicad services are handled by Stripe, Inc. We collect your name, payment method details, and transaction information. The legal basis for processing this payment data is the fulfillment or initiation of a contract, per Article 6(1)(b) GDPR.
      ‍‍
   4. Project Management
      When managing projects on Pelicad, we collect details such as project name, description, and team member information through Google Firebase. This data is used to facilitate project collaboration and management. The legal basis for processing this data is the fulfillment or initiation of a contract, per Article 6(1)(b) GDPR.
      ‍‍
   5. Invitation of Team Members
      When inviting team members, their names, email addresses, and roles are collected through Google Firebase. Ensure that you have obtained their consent before providing their data to us. The legal basis for processing this data is the fulfillment or initiation of a contract, per Article 6(1)(b) GDPR.
      ‍‍
   6. Use of Display Tools
      We collect data such as the number of clicks and the time of use when you utilize Pelicad’s display tools through Google Firebase. This data is processed to enhance your experience with the display features. The legal basis for processing this data is the fulfillment or initiation of a contract, per Article 6(1)(b) GDPR.
      ‍‍
   7. Model Sharing
      Users have the possibility to share data (3D models, renderings) within the platform with third parties, such as customers and other stakeholders. When sharing models, we collect the recipient’s email address and model details through Google Firebase. We stress that Pelicad is not sharing any data to third parties without direct action of the user. Please ensure you have the recipient's consent before sharing. The legal basis for processing this data is the fulfillment or initiation of a contract, per Article 6(1)(b) GDPR.
       
   8. Demo Requests & Consultation Scheduling
      If you request a demo or schedule a consultation, we collect your name, contact information, and company details through Hubspot. This data is used to provide you with the requested information or service. The legal basis for this processing is your consent, per Article 6(1)(a) GDPR.
      ‍‍
   9. Customer Services
      ‍When you use our customer service via support channels, we may collect your email address and details of your query through Hubspot. The legal basis for this processing is your consent, per Article 6(1)(a) GDPR.
      ‍‍
   10. Newsletter
       If you subscribe to our newsletter, your email address and name will be used for promotional purposes through Hubspot. You may unsubscribe at any time. The legal basis for this processing is your consent, per Article 6(1)(a) GDPR.
       ‍‍
   11. Stability of services
       Every time you use services, we collect your IP address, version information about browsers used, your operating system and general non-identifiable demographic data (“operating data”) through Google Firebase. We use this operating data to identify and resolve errors, to determine the stability of the website in different browsers and operating systems, and to make adjustments or improvements. These interests have been carefully balanced against your rights and freedoms, and we have determined that this processing does not adversely impact your rights as a data subject. The legal basis for this processing is our legitimate interest, per Article 6(1)(f) GDPR.
       ‍‍
   12. YouTube
       We use components (videos) from YouTube on our website. Here we use the “extended data protection mode” option provided by YouTube. When you access a page that has an embedded video, a connection is established to the YouTube servers and the content is displayed on the website by notifying your browser. The legal basis for this processing is your consent, per Article 6(1)(a) GDPR.
       ‍‍
   13. Google Web Fonts
       We use so-called web fonts to display fonts uniformly. When you access a page, your browser loads the required web fonts into your browser cache in order to display texts and fonts correctly. For this purpose, the browser you use must connect to Google's servers. This gives Google knowledge that our website was accessed via your IP address. The use of Google Web Fonts is in the interest of a uniform and attractive presentation of our online offerings. The legal basis for this processing is our legitimate interest, per Article 6(1)(f) GDPR.
       ‍‍
   14. Audio and video conferencing
       We use online conference tools, among other things, to communicate with our customers. The specific tools we use are listed below. If you communicate with us via video or audio conference via the Internet, your personal data will be collected and processed by us and the provider of the respective conference tool.
       
       The conference tools collect all the data that you provide/use to use the tools (email address and/or your telephone number). The conference tools also process the duration of the conference, start and end (time) of participation in the conference, number of participants and other “contextual information” related to the communication process (metadata).
       
       Furthermore, the provider of the tool processes all technical data that is necessary to process online communication. This includes in particular IP addresses, MAC addresses, device IDs, device type, operating system type and version, client version, camera type, microphone or speaker as well as the type of connection.
       
       If content is exchanged, uploaded or made available in any other way within the tool, it will also be stored on the tool provider's servers. Such content includes, but is not limited to, cloud recordings, chat/instant messages, photos and videos uploaded to voicemails, files, whiteboards and other information shared while using the Service.
       
       The legal basis for processing this data is the fulfillment or initiation of a contract, per Article 6(1)(b) GDPR. We use Google Meet as a conferencing tool, so the Google Privacy Policy applies
       ‍

4. Use of Cookies and Tracking
   We use cookies and similar tracking technologies to enhance your experience on our website, to understand your interactions with our services, and to improve our offerings based on those insights. You will be asked to consent to our use of non-essential cookies when you first visit our website. You can control the use of cookies at any time through your browser settings or by using our cookie management tool. Please note that disabling non-essential cookies may affect the functionality of our website and the services we offer. Specifically, we use cookies to:
   • Maintain your session and remember your preferences during interactions.
   • Analyze how our services are used, helping us to troubleshoot any problems and to monitor our own performance.
   • Deliver targeted advertising based on your browsing habits and preferences.
     We obtain your consent for the use of tracking technologies in accordance with the legal requirements of the GDPR, ensuring that you have all necessary information to make an informed decision. If you accept the use of cookies your data may be shared with Hubspot and Google Analytics.
     ‍

5. Data Deletion and Storage Period
   We retain your personal information only as long as necessary to fulfill the purposes outlined in this policy or as required by law. Once the data is no longer needed, it will be deleted or anonymized.
   ‍

6. How We May Share or Disclose Your Personal Information
   We only share your personal information with third parties when necessary to provide our services or comply with legal obligations. We ensure that any third parties processing your data on our behalf adhere to GDPR requirements. 
   
   Where possible your data is processed within the EEA. Especially, Stability of Service Data, which is used for validating your credentials, is transferred to countries outside the EEA. Whenever your data is transferred to countries outside the EEA we will ensure appropriate safeguards are in place as required by Article 44 of the GDPR namely by signing Standard Contractual Clauses, which are legal contracts that ensure your data is protected even when processed in countries that do not have equivalent data protection laws.
   
   We may send or otherwise share Personal Information with our local or foreign subsidiaries or affiliates for the purpose of storing such information on our behalf, or carrying out other processing on our behalf. We require these entities to agree to process such Personal Information in accordance with this Privacy Policy.
   
   For more details, please refer to the partners Privacy Policies:
   Stripe Privacy Policy, which uses your data to save and conduct payments with your payment details and inform you about the status of your payments.
   Hubspot Privacy Policy, which uses your data such as name and email to send you, if agreed upon, automated emails also for promotional purposes and tracks touch points with you as a customer for information flow between different employees at Pelicad.
   Google Analytic Privacy Policy, which uses your data to create usage data for our website to evaluate the promotional efficiency.
   Firebase Privacy Policy, which uses your data for account creation, editing and validation.
   Webflow Privacy Policy, which uses your data when you sign up on our website so we can contact you after signing up through our website.
   Youtube Privacy Policy, which uses your data to track your usage of Youtube and which pages you have visited.
   Google Privacy Policy, which uses your data to display Google fonts.
   ‍

7. Third Party Links
   Occasionally, at our discretion, we may include or offer third party products or services on our website. These third party sites have separate and independent privacy policies. We therefore have no responsibility or liability for the content and activities of these linked sites. Nonetheless, we seek to protect the integrity of our site and welcome any feedback about these sites.
   ‍

8. Data Security and Data Breach Notification
   1. Data Security Measures
      We implement a variety of technical and organizational measures to ensure that your data is protected against unauthorized access, alteration, disclosure, or destruction. These measures include, but are not limited to, encryption of data during transmission and storage, use of secure network protocols, access controls to limit who can access your data and regular security training for our staff. We continually review and update our security practices to adapt to new technologies and threats.
      ‍
   2. ‍Data Breach Notification
      In the unlikely event of a data breach, we will notify affected individuals and relevant data protection authorities within 72 hours of becoming aware of the breach, as required by the GDPR. This notification will include all necessary information about the extent of the breach, the data involved, the potential impact on our users, and our planned response measures. Additionally, we will provide guidance on steps our users can take to protect themselves.
      ‍‍
   3. Children’s Privacy Policy
      The services are not structured to attract minors. Accordingly, we do not intend to collect Personal Information from anyone we know to be minors. If we learn that we have collected Personal Information from minors, we will use commercially reasonable efforts to delete that data as quickly as possible. If you believe that we might have any such data, please contact us at privacy@pelicad.com.
      ‍
   4. ‍Your Rights as a Data Subject
      As a data subject under the GDPR, you have the following rights regarding your personal information:
      ‍
   5. ‍‍Right to Access: You have the right to obtain confirmation from us as to whether or not your personal data is being processed, and, where that is the case, access to the personal data and information such as the purposes of the processing, the categories of data involved, and the recipients or categories of recipients to whom the data has been or will be disclosed.
      ‍
   6. ‍Right to Rectification: You have the right to request the rectification of inaccurate personal data concerning you. You also have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
      ‍
   7. ‍‍Right to Erasure ("Right to be Forgotten"): You have the right to request the erasure of your personal data without undue delay where one of the following grounds applies:
      1. The personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed.
      2. You withdraw consent on which the processing is based, and there is no other legal ground for the processing.
      3. You object to the processing and there are no overriding legitimate grounds for the processing
      4. The personal data has been unlawfully processed.The personal data must be erased to comply with a legal obligation.You have the right to obtain a restriction on the processing of your personal data where one of the following applies:
         • You contest the accuracy of the personal data, for a period enabling us to verify the accuracy of the data.
         • The processing is unlawful, and you oppose the erasure of the data and request the restriction of its use instead.
         • We no longer need the personal data for the purposes of processing, but you require it for the establishment, exercise, or defense of legal claims.
         • You have objected to processing pending the verification of whether our legitimate grounds override your rights.
           ‍‍
   8. ‍Right to Data Portability: You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format and have the right to transmit those data to another controller without hindrance from us.
      ‍
   9. ‍‍Right to Object: You have the right to object at any time to the processing of your personal data based on our legitimate interests. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims.
      ‍
   10. ‍Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
       ‍‍
   11. ‍Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement if you consider that the processing of your personal data infringes the GDPR.
       ‍
   12. ‍‍Data Protection Officer: To exercise any of your rights under the GDPR, or if you have any questions about how we handle your personal data, please contact our Data Protection Officer (DPO). Contact details: Email: privacy@pelicad.com
       
       Address: cityscaper GmbH, Kleinmarschierstr. 33, 52062 Aachen, Germany. We may answer within a month or within two month in case of complex issues.
       ‍
   13. ‍‍Changes to this Privacy Policy: We may update this Privacy Policy from time to time. The latest version will always be available on our website. We encourage you to review this policy regularly to stay informed about how we are protecting your personal information.