Loading…
Legal
Information about personal data processing when visiting our website, using an account or purchasing services. Updated: 14 October 2026.
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
For privacy questions and to exercise your rights, contact Lukas Dahle at contact@systey.com.
We process data you provide, technical usage data and the responses from payment, login and registration services described below. Each section identifies its purposes and legal basis.
Account and contract data are needed for the account relationship or contract administration. Afterwards we retain only data required for legal obligations or establishing, exercising or defending claims. Invoices and accounting vouchers are generally retained for eight years and business correspondence subject to retention for six years from the end of the relevant calendar year (section 147 German Fiscal Code); statutory extensions may apply. Evidence needed for legal claims is retained until the applicable limitation period or proceedings end. Data no longer needed must be deleted.
We use data centre and infrastructure operators for the website, database and booked hosting services. Server locations are Frankfurt am Main, Germany, and Eygelshoven, Netherlands, depending on the service. These providers may access necessary connection, account and hosted data. Processing serves website delivery and security (Article 6(1)(f) GDPR) or contract performance (Article 6(1)(b) GDPR). We do not use a CDN or a separate DDoS protection service.
Each time our website is accessed, our system automatically collects data and information from the accessing system. This is stored in the server's log files. The following may be collected:
The legal basis is Article 6(1)(f) GDPR; our interests are availability, troubleshooting and preventing misuse. Retention depends on the need for fault analysis and attack detection; specific incidents may require longer investigation and evidence preservation. Session IP and device information also enables you to review logins.
Login uses systey_session (up to 30 days), email verification uses short-lived verification cookies, passkeys use systey_passkey_challenge (up to five minutes) and external login uses systey_oauth_state and systey_oauth_pending (up to ten minutes). These support the account and login functions you request (section 25(2)(2) TDDDG; Article 6(1)(b) or (f) GDPR for secure login).
The locale cookie stores your chosen language for up to one year. Browser local storage holds systey-theme until deleted and systey-cookie-notice-v1 to remember acknowledgement of the cookie notice for 180 days. These support requested display settings and notice acknowledgement (section 25(2)(2) TDDDG; Article 6(1)(f) GDPR, our interest in usability). You can delete or block storage through browser settings; account functions may be affected.
Creating a customer account is required to use the dashboard. In the course of registration and use, we process in particular:
Processing provides the account and performs contracts (Article 6(1)(b) GDPR); security logging serves our interest in preventing unauthorised access (Article 6(1)(f) GDPR). Necessary login details are required to provide an account. Passkey biometric data such as fingerprints are not sent to us. Account data are deleted when no longer used, subject to the retention grounds in section 2.
Orders, invoices and account credit require contact and billing information, service and contract data, prices, payment status and transactions (Article 6(1)(b) GDPR); tax records rely on Article 6(1)(c) GDPR. Without required contract and billing information, we cannot process an order.
Server and web hosting providers receive necessary service, allocation and management data for provisioning. For domains we transmit domain names, registrant and contact details and any transfer data to registration providers, registrars and relevant registries, and receive registration and status information (Article 6(1)(b) GDPR). Depending on the domain extension, registries outside the EEA may be involved; the relevant registry and its privacy information must be considered before ordering. We do not generally publish registrant data ourselves.
When you choose Mollie for payment or topping up credit, we transmit the amount, payment description and references. Mollie independently processes payment details entered on its payment page and technical connection data. We receive payment identifiers, status and necessary accounting and refund information. Our processing serves payment administration (Article 6(1)(b) GDPR) and statutory recordkeeping (Article 6(1)(c) GDPR).
Further information on data processing by Mollie can be found in the provider's privacy policy at mollie.com/de/privacy.
Email and SMTP providers process your address, message content and delivery information for account, security, order and contract messages. The legal basis is Article 6(1)(b) GDPR or, for security messages, our interest in protecting accounts (Article 6(1)(f) GDPR). Delivery and error records are needed for delivery, troubleshooting or evidence; mandatory correspondence retention follows section 2.
For email enquiries and support tickets we process contact details, messages, any attachments and necessary contract information. This supports contractual enquiries (Article 6(1)(b) GDPR) or our interest in answering other enquiries (Article 6(1)(f) GDPR). Data are deleted after resolution unless retention or evidence requirements in section 2 apply. Please provide only information needed for the enquiry.
Authorised staff and, as needed, data centre, server, web hosting, database, email and domain registration providers, payment services, tax or legal advisers and legally authorised authorities may access data. Processors may act only on documented instructions under an Article 28 GDPR agreement. Recipients performing their own statutory tasks, such as payment services or registries, act independently. Transfers outside the EEA require Articles 44 onwards GDPR, particularly an applicable adequacy decision or appropriate safeguards such as EU standard contractual clauses and any supplementary measures. You may request information about specific recipients and a copy of applicable safeguards at contact@systey.com.
As a data subject, you have the following rights vis-à-vis the controller:
These rights are subject to the respective statutory requirements. You may object to Article 6(1)(f) processing on grounds relating to your particular situation, and to direct marketing at any time without giving reasons. Withdrawing consent does not affect the lawfulness of earlier processing. To exercise your rights, email contact@systey.com.
You may complain to a supervisory authority, particularly where you live, work or believe an infringement occurred (Article 77 GDPR). The authority for our establishment is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, PO Box 20 04 44, 40102 Düsseldorf, Germany, poststelle@ldi.nrw.de.
www.ldi.nrw.deWe take technical and organizational measures in line with the state of the art to protect your data against loss, manipulation and unauthorized access. Transmission is encrypted via TLS (recognizable by the “https” in the address bar); passwords are stored exclusively as a hash.
If offered and selected, you are redirected to Google or GitHub. We receive a verified email address, name and provider identifier to associate the account (Article 6(1)(b) GDPR). The chosen provider learns that you use it to sign in to Systey and processes connection and login data under its own privacy terms. Email login remains available. Depending on the service, data may also be processed in the USA. The account link is kept until unlinked or the account is deleted, subject to statutory grounds for retention.
We calculate an internal customer assessment using account age, verification status, order and payment history, chargebacks, overdue invoices and account status. This helps staff review payment risk and misuse and decide on manual approvals or credit. This is profiling based on our legitimate interests in fraud prevention and limiting payment defaults (Article 6(1)(f) GDPR). It does not make solely automated decisions producing legal or similarly significant effects. The assessment uses existing account data, whose retention follows section 2. You may object on grounds relating to your particular situation.
When an order is attributed to a referral code, we process the code, partner identifier, order amount, payment status and commission data to account for referrals. The legal basis is Article 6(1)(f) GDPR and our interest in verifiable referral accounting. Partner participation and payout data are processed to perform the partner contract (Article 6(1)(b) GDPR). Currently systey_affiliate may store a referral code for up to 30 days. Storage requiring consent needs prior consent under section 25(1) TDDDG; acknowledging the general cookie notice is not such consent. Accounting retention follows section 2.
When internal push notifications are enabled, order, payment and support events are sent to authorised staff through Pushover. These may include names, customer numbers, order or payment information and ticket subjects and message excerpts. The provider is Pushover, LLC, USA. The legal basis is our interest in timely handling and operational security (Article 6(1)(f) GDPR). Before use, the processing and international transfer requirements in section 11 must be met. Retention depends on delivery and handling needs; the underlying contract and support data follow section 2.
Pushover privacy informationUpdated: 14 October 2026. We update this information when our processing changes.