Privacy Policy

1. Controller

The controller responsible for data processing on this platform within the meaning of the GDPR is:

BICEPS GmbH
Hagenring 85
38106 Braunschweig, Germany
Email: info@bi-ceps.de

You can find the complete contact details in our Imprint.

2. Data protection contact

No data protection officer has been appointed, as there is no legal obligation to do so. Your contact for data protection matters is Benjamin Pagel, email: b.pagel@bi-ceps.de, or by post to the above address marked "Data Protection".

3. Types of Data Processed

• Master data (name, company, address, email, phone number)
• Access credentials (username, password hash, 2FA secret)
• Usage data (login times, IP addresses, pages visited)
• Content data (posts, media, comments, ideas, approvals)
• OAuth tokens of external platforms (Facebook, Instagram, LinkedIn, etc.)
• Chat histories with AI assistants and WhatsApp messages

4. Purposes of Processing

• Provision of platform functions (Art. 6(1)(b) GDPR — contract)
• Content creation with AI support (Art. 6(1)(b))
• Publishing on connected social media platforms (Art. 6(1)(b))
• Security, fraud prevention, logging (Art. 6(1)(f) — legitimate interest)
• Billing and accounting (Art. 6(1)(c) — legal obligation)

5. Recipients of Data · Sub-processors

To provide our services, we use carefully selected service providers (sub-processors). A complete and always up-to-date list of all sub-processors used can be found at:

→ List of Sub-processors

We conclude data processing agreements (DPA) pursuant to Art. 28 GDPR with our sub-processors. Transfers to third countries (in particular the USA) take place only on the basis of an adequacy decision of the European Commission (e.g. the EU-U.S. Data Privacy Framework) or EU Standard Contractual Clauses (SCC).

6. Retention Period

• Account data: duration of the contractual relationship + 30-day grace period after account deletion
• Invoice data: 10 years (Sec. 147 of the German Fiscal Code, AO)
• WhatsApp messages: 90 days (automatic deletion thereafter)
• Login and session logs: 30 days
• Audit logs (approvals, etc.): 3 years

7. Your Rights

You have the following rights at any time:

• Access (Art. 15 GDPR) — upon request, we will provide you with all data stored about you
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR) — directly in your user account under "Delete account"
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR) — export of your data as JSON/ZIP
• Objection (Art. 21 GDPR)
• Withdrawal of consent at any time with effect for the future
• Complaint to a supervisory authority (Art. 77 GDPR)

Please send requests to: b.pagel@bi-ceps.de

8. Cookies and Session Handling

We use technically necessary cookies for session management and CSRF protection mechanisms (Art. 6(1)(f)). These cookies are strictly required for the operation of the platform and are deleted when the browser is closed or after the session duration. We do not use any tracking or marketing cookies.

9. Security

We use encryption (HTTPS/TLS) for all data transfers. OAuth credentials are stored encrypted (Laravel encrypted cast). Two-factor authentication is mandatory for all administrator roles.

10. Changes to This Privacy Policy

We adapt this privacy policy in the event of changes to the platform, our services, or the legal situation. The current version is available via this page.

[PLATZHALTER: Verarbeitung öffentlicher Kommentare (Community-Management)]

[PLATZHALTER: Soweit unsere Kunden die Kommentar-Funktion des Posteingangs nutzen, werden öffentliche Kommentare unter deren Social-Media-Beiträgen (Instagram, Facebook) verarbeitet. Dabei werden die Kommentar-ID, der Nutzername sowie der Text des Kommentars von der jeweiligen Plattform abgerufen und für Zwecke des Community-Managements und der CRM-Kommunikation gespeichert. Rechtsgrundlage ist Art. 6 Abs. 1 lit. f DSGVO (berechtigtes Interesse an der professionellen Betreuung öffentlicher Interaktionen). Die Daten werden ausschließlich im Auftrag unserer Kunden verarbeitet (Art. 28 DSGVO) und nicht für eigene Zwecke genutzt. Eine Löschung erfolgt automatisch bei Beendigung der Kundenbindung oder auf Anfrage. Weitere Informationen zur Datenverarbeitung durch die jeweiligen Plattformen entnehmen Sie den Datenschutzerklärungen von Meta (Instagram, Facebook).]