Privacy notice

The controller responsible for processing personal data in connection with the Service is techtropy GmbH, Am Anger 1, 87672 Roßhaupten, Germany. Contact details are listed in the legal notice.

We process the following categories of personal data.

You provide personal information, such as your email address and name, when you create an account, when you submit content to the Service, or when you contact us via forms or email. An organization you work or study with may also give us your name and email address, to invite you or to add you to its members, for example for a seminar. For that data the organization is the controller, and we process it on its behalf under the data processing agreement.

For our market research we process data from public sources, namely publicly available publications such as news articles and company websites. In doing so we also process personal data of people who do not use the Service, in particular the name of an article's author and names occurring in the text itself. We use an author's name to attribute a publication and to tell repeated coverage of one story apart. We do not rate or profile individual writers. The legal basis is our legitimate interest in verifiable market research (Article 6(1)(f) GDPR).

When you use the Service, our servers automatically process limited technical usage data in server log files. This data includes your IP address, browser type, pages visited, and the time and date of the request. We use this data solely to deliver the Service reliably, to secure it, and to prevent abuse (Article 6 (1) (f) GDPR).

For each day you use the Service while signed in, we store that your account was active on that date. We store the date alone, without the pages you opened or what you did on them, and we use it only to count how many people use the Service and whether they return (Article 6 (1) (f) GDPR). The record is deleted with your account. Inside a business simulation we record more, which the next paragraph sets out.

To see how the Service is used, we count page views without cookies and without storing anything on your device. For each page view we store the kind of page without any identifiers from its address, the referring website, a campaign or document code carried by the link, your country, the type of device, browser and operating system, and whether you were signed in. To recognize several pages viewed on the same day, we form a pseudonym from your IP address and browser identifier together with a random value that changes daily and is deleted the following day. Neither the address nor the identifier is stored, and the pseudonym cannot be traced back to you or linked to your visits on other days. We never link page views to your account. The records are deleted after 25 months (Article 6 (1) (f) GDPR).

For every email we send, we store the recipient address, the subject, the kind of email and the delivery status our email service provider reports, so that we can show an email was delivered and resolve problems. The content of an email is deleted once it has been sent. The record is deleted after 90 days, and earlier with your account (Article 6 (1) (f) GDPR). We do not track whether you open an email or follow its links.

Inside a business simulation we record how the room works. While you are in a simulation we store which of its pages and sections you open, when you arrived and how long you stayed, together with the moves you make in it, such as a changed decision field or a committed period. Your instructor sees this so that they can run the seminar, and we use it to improve the simulation (Article 6 (1) (b) and (f) GDPR). It covers the simulation only and nothing you do elsewhere in the Service. We keep it for twelve months, and it is deleted with your account.

We use only strictly necessary cookies and preference settings you actively choose. We do not use tracking or advertising cookies. For more information, see our cookie notice.

Where we have not obtained personal data from you but from a publicly available source, we inform you here as required by Article 14 GDPR. The controller is the entity named in the legal notice. The purpose of processing is market research. The legal basis is Article 6(1)(f) GDPR. The categories are the name and the context in which it was published. The source is the publication named in each case. You have the rights set out below, in particular the right of access, to rectification, to erasure, and to object to the processing. Notifying every individual separately would involve disproportionate effort (Article 14(5)(b) GDPR). That is why we provide this information here.

We use your data to provide the Service and your account (Article 6(1)(b) GDPR), to communicate with you, to improve functionality and content, and to detect and prevent abuse and technical problems (Article 6(1)(f) GDPR). Where processing is based on your consent (Article 6(1)(a) GDPR), you may withdraw it at any time with effect for the future. We do not sell your personal data. We make no decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). We do not rate individual people. The posts people hold at companies, read from those companies' own public pages, are recorded and never rated or scored.

We retain personal data only as long as necessary to provide the Service, to comply with legal obligations, and to resolve disputes. When you delete your account, the personal data associated with it is deleted unless a statutory retention obligation requires us to keep it. Personal data not tied to any account, such as the name of an author of an article we have processed, is deleted on request and otherwise once it is no longer needed for its purpose. Stored page text is deleted after a set period unless an entry in the evidence record cites it. You may request deletion of your data at any time.

Your data is processed on servers located in Germany, and our service providers are based in the European Union. We do not transfer your personal data to countries outside the EU or the European Economic Area. Should such a transfer ever become necessary, it will take place only under the safeguards of Chapter V of the GDPR, such as an adequacy decision or standard contractual clauses.

We share personal data only with service providers that process it on our behalf under data processing agreements pursuant to Article 28 GDPR, such as hosting and transactional email delivery. Beyond that, we share it only where we are required to by law or to protect our legal rights. We do not share your data for advertising or analytics purposes.

Where you work in an organization, that organization decides what happens to the content its people put into the Service, and we process it on its instructions under a data processing agreement pursuant to Article 28 GDPR.

Named members of our team can open an organization to support it, to keep it secure and to set up what it has bought. Only those who administer organizations can read its member list, and nobody on our team can sign in as you. Every such access is recorded with the person, the organization, the time and what was done, and we keep that record for one year. The administrators of an organization can read it on the organization's own page.

We use AhaSend B.V. (“AhaSend”), Amsterdam, Netherlands, to deliver transactional emails such as sign-in verification codes and organization invitations. AhaSend processes your email address on our behalf under a data processing agreement pursuant to Article 28 GDPR, solely to deliver these messages. A sign-in verification code email also states the IP address the request came from and the time it was made, so that you can recognize a request that was not yours (Article 6 (1) (f) GDPR). These details are not stored, and AhaSend processes them only to deliver the email. For details, see the AhaSend data processing agreement.

The same email also names the country that IP address belongs to. We look the country up in a database on our own server, so the address is not sent anywhere for this, and the country is not stored either. The database is the free IP to Country Lite database by DB-IP, published under the Creative Commons Attribution 4.0 license: IP Geolocation by DB-IP.

Under the GDPR, you have the right to access your personal data (Article 15), to rectification (Article 16), to erasure (Article 17), to restriction of processing (Article 18), to data portability (Article 20), and to object to processing based on legitimate interests (Article 21). Where processing is based on consent, you can withdraw it at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR). To exercise your rights, contact us at: privacy@techtropy.com.

We take reasonable measures to protect your data, but no method of transmission over the internet is 100% secure.

Our servers are hosted in Frankfurt, Germany, in data centers operated by our partner dataforest GmbH (“dataforest”), Kriftel, Germany. dataforest processes data on our behalf under a data processing agreement pursuant to Article 28 GDPR. These facilities hold industry-standard security and operational audits, including SOC 2 Type II, SOC 1 ISAE 3402 Type II, TÜV Certified Data Center Level 3, ISO 9001:2015, as well as EMAS and ISO 50001 (energy management) certifications. For details on how dataforest processes personal data, see the dataforest privacy policy.

Our Service may contain links to other websites. We are not responsible for their privacy practices.

The Service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this privacy notice from time to time. Changes take effect when posted on this page.

If you have any questions about this privacy notice, contact us at: privacy@techtropy.com.