Privacy Policy of ELLYTIC Technologies UG (haftungsbeschränkt)

3.1 Data You Provide Directly

• Identification data: name, address, contact details.
• Account data: login credentials, authentication data, MFA tokens.
• Administrative and civil registry documents: passports, ID cards, birth/marriage certificates, tax forms, property documents, inheritance documentation, supporting evidence.
• Translation/verification documents: files uploaded for certified or professional translation.
• Declarations and forms: data entered into wizards, questionnaires and self-service modules.
• Communication data: support messages, emails, user requests, content of conversations.
• Payment and billing data: processed exclusively via PCI-DSS compliant processors such as Stripe or PayPal.

3.2 Data Collected Automatically

• Technical identifiers: IP addresses (truncated where possible), device type, operating system, browser type/version.
• Usage data: interactions with features, timestamps, form completion, workflow progression.
• Security logs: login attempts, authentication events, fraud detection signals.
• Diagnostic information: performance telemetry, error reports.
• Cookies and similar technologies (see Cookie Policy).

3.3 Special Category Data

We do not request sensitive categories of data under Art. 9 GDPR.

• However, users may upload documents that contain such information (e.g. health-related notes on civil certificates). In such cases:
• processing is carried out only for the explicit purpose of fulfilling the user’s request,
• the legal basis is Art. 6(1)(b) GDPR (contract) combined with Art. 9(2)(a) GDPR (explicit consent upon upload).

4.1 Contract Fulfilment (Art. 6(1)(b) GDPR)

• Providing translation, administrative, tax, and documentation services.
• Preparing, reviewing and validating forms or wizards.
• Delivering human-in-the-loop AI-assisted outputs.
• Managing user accounts, authentication, MFA and onboarding.

4.2 Legal Obligations (Art. 6(1)(c) GDPR)

• Compliance with German and EU accounting, tax and commercial law.
• Providing statutory retention of invoices and transaction metadata.
• Responding to lawful requests from authorities or courts.

4.3 Legitimate Interests (Art. 6(1)(f) GDPR)

• Platform security, fraud detection and abuse prevention.
• Service improvement and workflow optimisation.
• Internal quality assurance (anonymised or aggregated where possible).
• Ensuring the accuracy of translations and document outputs.

4.4 Consent (Art. 6(1)(a) GDPR)

Users may withdraw consent at any time: privacy@ellytic.com

• Non-essential cookies and analytics.
• Optional communication preferences (e.g., newsletters).
• Processing of sensitive information contained within uploaded documents, when applicable.

All AI processing takes place either on EU-hosted infrastructure, or with subprocessors bound by GDPR-compliant agreements and EU-standard safeguards.

We do not use uploaded data to train public AI models.

6.1 Processors (Art. 28 GDPR)

We share personal data only with the following categories of processors:

• EU-based hosting and cloud services
• Email and communication providers
• Support ticket systems
• Document translation and linguistic QA partners
• Payment processors (e.g., Stripe, PayPal)
• Identity verification or e-signature providers (if used)
• All processors are bound by strict Data Processing Agreements (DPAs).

6.2 Authorities and Institutions

Only with your explicit request or legal obligation, e.g.:

• tax offices
• civil registry offices
• notaries
• property registries
• courts
• banks

6.3 No Third-Country Transfers Without Safeguards

We do not transfer personal data outside the EU/EEA unless an adequacy decision exists (Art. 45 GDPR) or appropriate safeguards (Art. 46 GDPR) are implemented, including Standard Contractual Clauses (SCCs).

Primary data hosting: Germany (EU).

7.1 Documents and Uploaded Files

Deleted 30 days after service completion, unless:

statutory retention obligations apply, or you request earlier deletion (except where prohibited by law).

7.2 Account Data

Retained until account deletion, and thereafter:

anonymized immediately where possible, with certain metadata retained for 6–10 years under German tax/commercial law.

7.3 Security Logs

Stored for 90 days, unless required longer for fraud investigations.

7.4 Backups

Secure encrypted backups are overwritten according to a rolling schedule (30–90 days).