Privacy Policy

1 Privacy at a Glance

General Information

The following notes provide a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally.

Data Collection on This Website

Who is responsible for the data collection?

Data processing on this website is carried out by the website operator. Their contact details can be found in the "Data Controller" section of this privacy policy.

How do we collect your data?

Your data is collected in part when you provide it to us — for example, by entering it into a contact form. Other data is collected automatically or after your consent when you visit the website through our IT systems. This is primarily technical data (e.g., internet browser, operating system, or the time of the page request).

What do we use your data for?

Part of the data is collected to ensure the error-free provision of the website. Other data may be used to analyze your user behavior. If contracts can be concluded or initiated via the website, the transmitted data will also be processed for contract offers, orders, or other order inquiries.

2 Hosting

IONOS

We host our website with IONOS. The provider is IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. When you visit our website, IONOS collects various log files including your IP addresses. Details can be found in the IONOS privacy policy: ionos.de/terms-gtc/terms-privacy The use of IONOS is based on Art. 6(1)(f) GDPR. We have a legitimate interest in the most reliable presentation of our website.

Data Processing Agreement

We have concluded a data processing agreement (DPA) with IONOS. This ensures that IONOS processes the personal data of our website visitors only according to our instructions and in compliance with the GDPR.

3 General Information and Mandatory Disclosures

Data Protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy.

Data Controller

Retention Period

Unless a more specific retention period is stated in this privacy policy, your personal data will remain with us until the purpose for the data processing ceases to apply. If you assert a justified request for deletion or withdraw consent to data processing, your data will be deleted unless we have other legally permissible reasons for storage.

Legal Basis for Data Processing

If you have consented to data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, insofar as special categories of data are processed. In addition, the setting of cookies and access to information on your device is governed by § 25(1) TTDSG (German Telecommunications and Telemedia Data Protection Act).

Withdrawal of Consent

Many data processing operations are only possible with your express consent. You can withdraw consent already given at any time — for example, via the "Cookie Settings" link at the bottom of each page. The lawfulness of the data processing carried out until the withdrawal remains unaffected by the withdrawal.

Right to Lodge a Complaint with a Supervisory Authority

In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their place of work, or the place of the alleged violation. The competent supervisory authority for Suppora GmbH is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (State Commissioner for Data Protection and Freedom of Information in Rhineland-Palatinate).

Right to Data Portability

You have the right to have data that we process automatically based on your consent or in fulfillment of a contract handed over to you or to a third party in a common, machine-readable format.

SSL/TLS Encryption

For security reasons and to protect the transmission of confidential content, this site uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the browser address bar changes from "http://" to "https://" and by the lock symbol in your browser bar.

4 Data Collection on This Website

Cookies

Our websites use so-called "cookies." Cookies are small data packets and do no harm to your device. They are stored either temporarily for the duration of a session (session cookies) or permanently (persistent cookies) on your device. Cookies that are necessary to carry out the electronic communication process or to provide certain functions requested by you are stored on the basis of Art. 6(1)(f) GDPR in conjunction with § 25(2) No. 2 TTDSG. All other cookies are set only with your consent under Art. 6(1)(a) GDPR and § 25(1) TTDSG. You can withdraw your consent at any time via the "Cookie Settings" link.

Consent with Borlabs Cookie

Our website uses the consent technology of Borlabs Cookie to obtain your consent for the storage of certain cookies in your browser or for the use of certain technologies and to document this in a data-protection-compliant manner. The provider is Borlabs GmbH, Rübenkamp 32, 22305 Hamburg, Germany. When you enter our website, a Borlabs cookie is stored in your browser, which stores the consents you have given or the withdrawal of these consents. This data is not passed on to the provider of Borlabs Cookie. The collected data is stored until you request us to delete it, delete the Borlabs cookie itself, or the purpose for data storage no longer applies. Mandatory statutory retention periods remain unaffected. Borlabs Cookie is used to obtain the legally required consent for the use of cookies. The legal basis for this is Art. 6(1)(c) GDPR. Details on data processing: Borlabs Cookie Documentation

Inquiries by Email, Phone, or Contact Form

If you contact us by email, phone, or contact form, your inquiry including all resulting personal data (name, inquiry) will be stored and processed by us for the purpose of processing your request. We do not pass on this data without your consent.

AI Phone Assistant

When you call our service number, the call may initially be answered by our AI phone assistant. The AI phone assistant is provided by IONOS SE and operated on European infrastructure under a data processing agreement. The following data is processed: your spoken word during the conversation (speech-to-text), the content topics and concerns of your call, your phone number (if transmitted), as well as the time and duration of the call. Processing is carried out to perform pre-contractual measures or to fulfill a contract (Art. 6(1)(b) GDPR) and on the basis of our legitimate interest in efficient telephone accessibility (Art. 6(1)(f) GDPR). For interactions consciously conducted via the assistant, consent under Art. 6(1)(a) GDPR may additionally exist (announcement/notice at the beginning of the conversation). We have concluded a data processing agreement (DPA) with IONOS. The voice and conversation data is processed exclusively on European infrastructure; permanent storage takes place only insofar as this is necessary for processing your request, for quality assurance, or for legal reasons.

Communication via WhatsApp

For communication with our customers, we use the instant messaging service WhatsApp, among others. The provider is WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland. Communication takes place via end-to-end encryption. Data processing is based on Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (legitimate interest in fast and efficient customer communication).

HubSpot CRM & Contact Form

For our customer relationship management and the processing of contact form inquiries, we use HubSpot, Inc., 25 First Street, Cambridge, MA 02141, USA. Your inquiries and contact data are stored and processed in the HubSpot CRM. Processing is based on Art. 6(1)(b) GDPR. A data processing agreement exists with HubSpot. HubSpot is certified under the EU-US Data Privacy Framework.

Appointment Booking (Cal.com)

For booking appointments and consultations, we use the service Cal.com. The provider is Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA. When booking an appointment, your contact data (name, email address, if applicable phone number) and information about the selected appointment are processed. Processing is based on Art. 6(1)(b) GDPR (contract initiation). A data processing agreement exists with Cal.com. Cal.com bases data transfers to the USA on EU Standard Contractual Clauses. Details on data processing: cal.com/privacy

5 Social Media

Facebook

Elements of the social network Facebook are integrated on this website. The provider is Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. Use is based on your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TTDSG. Details: Facebook Privacy Policy

Instagram

Functions of the Instagram service are integrated on this website. The provider is Meta Platforms Ireland Limited, Dublin, Ireland. Use is based on your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TTDSG. Details: Instagram Privacy Policy

LinkedIn Insight Tag

This website uses the LinkedIn Insight Tag. The provider of this service is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.

Purpose of Processing

With the help of the LinkedIn Insight Tag, we receive information about the visitors to our website. If a website visitor is registered with LinkedIn, we can analyze professional characteristics (e.g., career level, company size, country, location, industry, and job title) of our website visitors and thus better target our site to the respective target groups. Furthermore, we can use the LinkedIn Insight Tag to measure whether visitors to our websites make purchases or take other actions (conversion tracking). Conversion tracking can also be cross-device (e.g., from PC to tablet). LinkedIn Insight Tag also offers a retargeting function that allows us to display targeted advertising outside of our website to visitors of our website, whereby according to LinkedIn no identification of the advertising addressee takes place.

Data Processing by LinkedIn

LinkedIn itself also collects so-called log files (URL, referrer URL, IP address, device and browser characteristics, and time of access). IP addresses are shortened or (if used to reach LinkedIn members across devices) hashed (pseudonymized). Direct identifiers of LinkedIn members are removed by LinkedIn after seven days. The remaining pseudonymized data is then deleted within 180 days. The data collected by LinkedIn cannot be attributed to individual persons by us as the website operator. LinkedIn will store the collected personal data of website visitors on their US servers and use it as part of their own advertising activities.

Legal Basis

Use is based on your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TTDSG. Consent can be revoked at any time. To revoke your consent, please update your cookie settings via the "Cookie Settings" link at the bottom of this page.

Data Transfer to Third Countries

Where personal data is processed in the US, we note that the US does not have an adequate level of data protection according to the European Court of Justice. However, LinkedIn is certified under the EU-US Data Privacy Framework. Further information: dataprivacyframework.gov Details on data processing by LinkedIn can be found in the LinkedIn Privacy Policy: linkedin.com/legal/privacy-policy You can deactivate cookies from LinkedIn and their use for targeted advertising at the following link: LinkedIn Opt-out

6 Analytics Tools and Advertising

Google Tag Manager

We use Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager does not create user profiles of its own and does not store cookies. It serves exclusively to manage and deliver the tools integrated via it. If the tools delivered via the Tag Manager set cookies, this only happens after your consent.

Google Analytics

This website uses functions of the web analytics service Google Analytics. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics enables the website operator to analyze the behavior of website visitors. Use is based on your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TTDSG. Consent can be revoked at any time via the cookie settings. Google is certified under the EU-US Data Privacy Framework. A data processing agreement exists with Google. You can prevent the collection of your data by Google Analytics by installing the following browser plugin: Google Analytics Opt-out

WP Statistics

This website uses the analytics tool WP Statistics. The data collected by WP Statistics is stored exclusively on our own server. We use WP Statistics with anonymized IP. Data processing is based on Art. 6(1)(f) GDPR. We have a legitimate interest in the statistical analysis of user behavior to optimize our web offering.

Google Ads

The website operator uses Google Ads. Google Ads is an online advertising program of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Use is based on your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TTDSG. Consent can be revoked at any time via the cookie settings. Google is certified under the EU-US Data Privacy Framework. Details: Google Privacy Policy

Leadfeeder / Dealfront (company-level visitor identification)

We use the service Leadfeeder from the provider Dealfront Group GmbH, Karlsruhe, Germany. Leadfeeder uses the IP address to identify which company a visitor to our website comes from (so-called reverse IP lookup). Only company-level information (company name, industry, size, region) and browsing behavior on our website (pages viewed, time, referral source, browser/device type) are evaluated. For this purpose, Leadfeeder sets cookies (including _lfa, term up to 2 years) after your consent. Processing takes place exclusively on the basis of your consent via our cookie banner (Art. 6(1)(a) GDPR and § 25(1) TTDSG) and additionally on the basis of our legitimate interest in evaluating company-related interest in our services (Art. 6(1)(f) GDPR). You can withdraw your consent at any time via the cookie settings. A data processing agreement (DPA) pursuant to Art. 28 GDPR exists with the provider. Processing takes place within the EU/EEA. Further information: dealfront.com

7 Newsletter

Newsletter Data

If you would like to receive the newsletter offered on the website, we need an email address from you as well as information that allows us to verify that you are the owner of the email address provided and that you consent to receiving the newsletter. Further data is not collected or is only collected on a voluntary basis. Processing of the data entered in the newsletter registration form is carried out exclusively on the basis of your consent (Art. 6(1)(a) GDPR). You can withdraw the consent given for the storage of the data, the email address, and its use for sending the newsletter at any time, for example via the "Unsubscribe" link in the newsletter. The data you provide for the purpose of subscribing to the newsletter will be stored by us or the newsletter service provider until you unsubscribe from the newsletter and will be deleted from the newsletter distribution list after you unsubscribe from the newsletter. Data stored by us for other purposes remains unaffected by this.

8 Plugins and Tools

Ninja Firewall

To protect our website, we use Ninja Firewall. The provider is NinTechNet Limited, 15/F Cambridge House, Taikoo Place, 979 Kings Road, Quarry Bay, Hong Kong. Ninja Firewall filters incoming requests and blocks malicious traffic. In doing so, IP addresses and other technical connection data are processed. Data processing is based on Art. 6(1)(f) GDPR. We have a legitimate interest in protecting our website from abusive access and attacks.

Google Fonts (locally embedded)

This website uses so-called Google Fonts for the uniform display of fonts. The Google Fonts are installed locally. A connection to Google servers does not take place.

Font Awesome (CDN)

This website uses Font Awesome for the uniform display of icons. The provider is Fonticons, Inc., 6 Porter Road, Apartment 3R, Cambridge, MA 02140, USA. Font Awesome is loaded via a Content Delivery Network (Cloudflare). When you access a page, your browser loads the required icons from the CDN. Your IP address is transmitted to the servers of Fonticons/Cloudflare. Use is based on Art. 6(1)(f) GDPR (legitimate interest in a uniform and fast display of our website).

9 Audio and Video Conferencing

Data Processing

For communication with our customers and prospects, we use online conferencing tools, among other things. The tools we use are listed below. When you communicate with us via video or audio conference, your personal data is collected and processed by us and by the provider of the respective conference tool.

Microsoft Teams

We use Microsoft Teams. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Details on data processing: Microsoft Privacy Use is based on Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (legitimate interest in efficient online communication). Microsoft is certified under the EU-US Data Privacy Framework. A data processing agreement exists with Microsoft.

10 Our Services

Handling of Applicant Data

We offer you the opportunity to apply to us (e.g., by email, mail, or via online application form). Below we inform you about the scope, purpose, and use of your personal data collected as part of the application process. If an employment contract is concluded as a result of your application, we store the data you have submitted for the purpose of the usual organizational and administrative processes. The legal basis is § 26 BDSG-neu, Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR (legitimate interest in conducting the application procedure). If no employment contract is concluded, the application documents are automatically deleted six months after notification of the rejection decision, provided that no other legitimate interests of the controller oppose deletion.

11 OperoGuide SaaS Service

Service Description

OperoGuide is an AI-powered assistant for JD Edwards EnterpriseOne users. The service processes user queries based on uploaded documentation and provides context-related answers.

Account Data

When you register for OperoGuide, we collect: name and email address, company name (optional), password (stored encrypted), and account settings. Processing is based on Art. 6(1)(b) GDPR (contract performance).

Uploaded Documents

Documents you upload to OperoGuide are securely stored on servers in Germany (IONOS), processed for text extraction and creation of searchable embeddings, are accessible only to authorized users within your organization, and are deleted upon request or account termination.

Query Processing

When you submit a query to OperoGuide: Query content is NOT stored. We store neither your questions nor the AI answers. Only metadata is logged: message length, response length, timestamp, and source count. Query counters are collected to enforce plan limits.

Usage Statistics

We collect anonymized usage statistics to improve our service: number of queries per user/organization, feature usage patterns, and performance metrics. This data is processed on the basis of Art. 6(1)(f) GDPR (legitimate interest).

Audit Logs (Business plans and higher)

For compliance purposes, audit logs record: login and logout events, document uploads and deletions, user management actions, and security events (failed logins, 2FA changes). Audit logs are retained for 90 days and contain no query content.

12 AI Processing

Use of Large Language Models

OperoGuide uses AI technology hosted at IONOS to process your queries. When you submit a query, your query and relevant document excerpts are sent to the AI model. The AI generates a response based on your documents. All processing takes place on servers within the European Union.

Data Transmission

During AI processing, the following data may be transmitted: the text of your query, relevant excerpts from your uploaded documents, and conversation context (for multi-step conversations). This data is transmitted via encrypted connections (TLS 1.3) and is not stored by the AI provider after processing.

Data Location

All AI processing for OperoGuide takes place on infrastructure in Germany or the European Union. No data is transferred outside the EU for AI processing.

13 Sub-Processors

We use the following sub-processors to provide our services: All sub-processors are contractually obligated to protect your data in accordance with GDPR requirements. For US-based processors, we rely on the EU-US Data Privacy Framework or EU Standard Contractual Clauses.

14 Browser Extension (OperoGuide)

Extension Functionality

The OperoGuide Browser Extension provides context-related support for using JD Edwards. The extension recognizes the JDE application context (screens, forms, error codes), extracts error messages for automatic error searching, and enables quick access to OperoGuide without leaving JDE.

Data Collected by the Extension

The browser extension collects: current JDE screen/form identifiers, error codes and error messages displayed in JDE, and highlighted text (when you explicitly highlight it for a query).

Data Storage

The extension does not store data locally on your device. All data is transmitted directly to OperoGuide servers for processing and is subject to the same data protection provisions as queries via the web interface.

15 Data Storage & Deletion

Retention Periods

• Account Data: Until account termination + 30 days
• Uploaded Documents: Until deletion by the user or account termination
• Usage Statistics: 12 months (then anonymized)
• Audit Logs: 90 days
• Payment Receipts: 10 years (legal requirement)
• Query Content: Not stored
• Call Data / Conversation Summaries (AI Phone Assistant): 12 months, then deletion unless a statutory retention obligation exists
• Applicant Data: 6 months after completion of the application process
• Contact Inquiries: After completion of the inquiry, unless a statutory retention obligation exists
• LinkedIn Insight Tag Data: Direct identifiers 7 days, pseudonymized data 180 days (by LinkedIn)
• Leadfeeder Cookies: Up to 2 years (revocable via cookie settings)

Account Deletion

You can request the complete deletion of your account and all associated data at any time: via the "Delete Account" function in your dashboard or by email to info@suppora.eu. Following a deletion request, we will delete all your data within 30 days, unless a statutory retention obligation prevents this.