Privacy policy

Memik Inel Eisenacher Straße 41 10781 Berlin Germany

General enquiries: value@valuespoc.com Data protection enquiries: privacy@valuespoc.com

We process personal data of business users, platform administrators, and website visitors in accordance with the General Data Protection Regulation (GDPR) and applicable national law.

Personal data means any information relating to an identified or identifiable natural person. Processing includes collection, storage, use, and deletion.

Depending on the context, we rely on:

• Art. 6(1)(b) GDPR: performance of a contract or pre-contractual steps
• Art. 6(1)(f) GDPR: legitimate interests such as security and product improvement, where not overridden by your interests
• Art. 6(1)(a) GDPR: consent, for example for optional analytics cookies
• Art. 6(1)(c) GDPR: compliance with legal obligations

Where special categories of data are processed, additional requirements apply.

The public websites and the platform run on servers of IONOS SE in Germany that we operate ourselves, database, authentication and file storage included. The technology is built on open-source components and involves no proprietary cloud services.

On each request the web server processes log data (IP address, timestamp, page requested, user agent) to ensure availability, security and abuse prevention. We also use those same logs to count how often each page is read. The IP address is shortened before anything is counted. No script runs in your browser for this and no data goes to a third party. The legal basis is Art. 6(1)(f) GDPR. Server logs are rotated automatically and kept no longer than error analysis and security monitoring require. If a technical error occurs on a page, your browser sends a short error report (error text, affected page, browser identifier) to our server. It contains nothing you entered and is logged without your IP address.

The public-sector offering at gov.valuespoc.com carries a privacy statement of its own.

The public website (www.valuespoc.com) embeds no third-party analytics, tracking, or advertising services. What is stored on your device is limited to what the site needs in order to work: the selected language and your display settings, in your browser's local storage and in a language cookie. This needs no consent, which is why the website shows no consent banner. The complete inventory, with purpose and retention per entry, is in our Cookie Policy.

Inside the application, cookies for authentication, session management and security are added. There a banner asks on your first visit whether you allow usage statistics. Nothing is pre-selected, and you can change your decision at any time through the cookie settings.

The contact form sends us your name, business email address, organisation, the topic you picked and your message. We process these details to answer your enquiry and to arrange demos or pilots. The legal basis is your consent under Art. 6(1)(a) GDPR. You give it by submitting the form and can withdraw it at any time at privacy@valuespoc.com.

Alongside the enquiry we record the moment of your consent, the user agent and a check value derived from your IP address. That value is produced with a secret key, cannot be turned back into an IP address and serves only to limit automated bulk submissions.

If you send the enquiry from the website, we also keep with it the page your visit started on, the website you came from (its name only) and the campaign parameters of the link you followed. Until you submit, the page holds these details only in your browser's memory. If your browser sends the Global Privacy Control signal, none of this is kept. The legal basis is our legitimate interest in understanding how enquiries reach us, under Art. 6(1)(f) GDPR.

The data is kept only as long as the enquiry and its follow-up require, unless statutory retention obligations apply.

If you book an appointment through the website, we process your name, email address, optionally your organisation and what you tell us about your enquiry, in order to arrange and hold the appointment. The legal basis is Art. 6(1)(b) GDPR, as the processing happens at your request and to take steps prior to a contract. We also store a salted hash of your IP address to prevent abuse of the booking function. The legal basis for that is our legitimate interest in a functioning service under Art. 6(1)(f) GDPR. The data is deleted once the appointment is held or cancelled and no longer needed for traceability, at the latest after six months. You can cancel a booked appointment at any time using the link in the confirmation email. If you book through the website, we also keep with the booking the page your visit started on, the website you came from (its name only) and the campaign parameters of the link. Until you submit, the page holds these details only in your browser's memory, and with Global Privacy Control none of this is kept. The legal basis for that is Art. 6(1)(f) GDPR.

Registered users provide organisation and profile data to use the platform: account credentials, roles, content of initiatives, tenders and bids, documents, communication metadata, and audit events.

Processing is necessary to operate the platform, enforce access controls, and maintain an auditable record of decisions.

We use no third-party analytics service on the public websites, neither Google Analytics nor Matomo, Plausible or a comparable product, and no advertising networks.

We count ourselves how the websites are used. We record the pages opened, whether a visit came from outside and from which website (its name only), the campaign parameters of the link (utm_source, utm_medium, utm_campaign), clicks on a small fixed set of buttons such as demo, contact, pricing or appointment, the start and end of an explainer film, whether a form could be submitted, and the addresses of pages that do not exist. From the user agent our server derives only the device type (phone, tablet, computer) and the browser family. We do not store the user agent itself or your IP address for this. Nothing is stored on or read from your device, there are no cookies and no identifier that links page views to a person. We therefore see page views, not visitors.

We delete the individual events after 30 days. After that only daily totals remain. If your browser sends the Global Privacy Control signal, we count nothing. The legal basis is our legitimate interest in improving what the websites offer, under Art. 6(1)(f) GDPR. The data is processed in our own platform database and not passed to third parties.

Inside the signed-in application we record usage statistics (pages visited, time spent, load times) to detect errors and bottlenecks and to improve the application. This happens only with your consent under Art. 6(1)(a) GDPR, which you give or refuse in the application's consent banner and can withdraw at any time through the cookie settings. This data stays scoped to the organisation it belongs to and is not passed to analytics vendors.

With your consent or where permitted for existing B2B relationships, we may send product updates, event invitations, or onboarding content. You can opt out at any time via the unsubscribe link or by contacting privacy@valuespoc.com.

We use service providers under data processing agreements pursuant to Art. 28 GDPR. These are currently:

• IONOS SE, Germany: servers for the websites, the application, the database and file storage, and the mail server that delivers system and notification email
• Language-model providers for the AI features: Anthropic, OpenAI, Mistral AI, Google or IONOS depending on configuration. One provider is set up per installation, and an individual organisation can select a provider of its own within it. Before transmission, the names of people and organisations recorded in the platform are replaced with placeholders, and email addresses, phone numbers, IBANs and tax identifiers are masked. Names that appear only in free text or uploaded documents may be transmitted.

Other participants in a sourcing procedure may receive data you submit in tenders, bids or Q&A when your workflow requires sharing. Invited providers see the published content of requests and tenders, for example.

The platform is operated entirely in Germany. A transfer to a third country arises only where a language model outside the European Union is configured for the AI features.

We base such transfers on the European Commission's standard contractual clauses under Art. 46(2)(c) GDPR, supported by technical and organisational measures. Beforehand, the names of recorded people and organisations are replaced with placeholders and contact details are masked. The transmitted text nonetheless remains personal data.

We name the providers configured for a specific installation on request. Where a language model at IONOS SE in Germany is set up, no transfer outside the EU arises. The platform can therefore be operated entirely within the European Union.

We retain personal data only as long as necessary for the purposes described or as required by law. Typical periods include:

• Account and contract data: duration of the relationship plus statutory limitation periods
• Tender and award records: as needed for audit, billing reconciliation, and legal claims
• Marketing consents: until withdrawal
• Server logs: short-term, then deletion or anonymisation

Subject to legal conditions, you have the right to access, rectification, erasure, restriction of processing, data portability, and objection. Where processing is based on consent, you may withdraw consent at any time without affecting prior lawful processing.

Contact privacy@valuespoc.com to exercise your rights. You also have the right to lodge a complaint with a supervisory authority.

We may update this Privacy Policy when our services, legal requirements, or subprocessors change. Material changes will be communicated via the website or, where appropriate, by email to registered users.

The "As of" date at the top indicates the current version.