Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other applicable data protection provisions is:

[Organisation / operator name] [Street and number] [Postal code, city] Germany Email: [email address]

(hereinafter "sideKIC" or "we")

2. Data protection officer

[If a data protection officer has been appointed: name and contact details of the data protection officer. Otherwise: No data protection officer has been appointed, as there is no statutory obligation to appoint one.]

3. General information on data processing

sideKIC is a platform for student governments. It combines meeting management, voting, financial bookkeeping with an audit trail, event ticketing and shift scheduling in a multi-tenant workspace. We process personal data exclusively in accordance with the GDPR and the German Federal Data Protection Act (BDSG).

This privacy policy informs you about the nature, scope and purpose of the processing of personal data through the sideKIC platform.

4. Legal bases for processing

We process personal data on the following legal bases:

- Art. 6(1)(a) GDPR – consent - Art. 6(1)(b) GDPR – performance of a contract and pre-contractual measures - Art. 6(1)(c) GDPR – legal obligation, in particular statutory retention obligations under German commercial and tax law (§ 147 AO, § 257 HGB) - Art. 6(1)(f) GDPR – legitimate interests, such as IT security and abuse prevention

5. Data categories and retention periods

We store personal data only for as long as necessary for the respective purpose or as required by statutory retention obligations (storage limitation, Art. 5(1)(e) GDPR). Retention periods are configurable per data category and enforced automatically:

- User accounts: for the duration of active use; inactive or suspended accounts are anonymised after 180 days without sign-in. - Financial requests: drafts, rejected and cancelled requests may be removed; approved and paid requests are retained as institutional records. - Reports: drafts, rejected and cancelled reports may be removed; completed reports are retained. - Attachments to financial requests and reports: automatically deleted after 365 days. - Documents: automatically deleted after 730 days; workflow-linked documents are retained. - Chat conversations and messages: deleted after 730 and 365 days respectively. - Calendar events: deleted after 730 days. - Media assets: deleted after 180 days. - Demo requests: deleted after 365 days. - Invitations: deleted after 365 days. - Audit events: retained permanently and cannot be deleted or anonymised. - Billing records: locked by German bookkeeping law (§ 147 AO, § 257 HGB); retained unaltered for ten years.

6. Anonymisation instead of deletion

Where records must be retained due to legal or audit obligations but a person should no longer be identifiable, we anonymise the data instead of deleting it (Art. 17(3) GDPR). Anonymisation severs the account's sign-in link so that a deactivated account can no longer regain access.

7. Append-only audit trails

Financial requests, reports, document access and meeting events are recorded in append-only ledgers at the database level. These ledgers cannot be modified or deleted and serve traceability and statutory audit obligations.

8. Storage and processors

We engage the following processors that may process personal data on our behalf:

- Amazon Web Services (S3): storage of documents, receipts, reports and backups. Region: eu-central-1 (Frankfurt). The bucket is private; files are served exclusively through short-lived, signed URLs. - Cloudinary: public media only (profile photos, logos) via the EU endpoint (api-eu.cloudinary.com). - Neon: managed PostgreSQL database. - Neon Auth: authentication, sessions and transactional email. - Render: application hosting.

An up-to-date overview of the processors in use is maintained in the platform's subprocessor registry.

9. Data security (Art. 32 GDPR)

We implement appropriate technical and organisational measures, including: tenant-scoped isolation of all queries, role-based access control, rate limits on public endpoints, short-lived signed URLs for file access, and a documented incident-management process with an append-only timeline.

10. Data subject rights

Under Art. 15 to 21 GDPR you have the following rights:

- Right of access (Art. 15 GDPR) - Right to rectification (Art. 16 GDPR) - Right to erasure (Art. 17 GDPR) - Right to restriction of processing (Art. 18 GDPR) - Right to data portability (Art. 20 GDPR) - Right to object (Art. 21 GDPR)

11. Exercising your rights

To exercise your rights, contact [contact email]. Every request is documented in its own append-only processing timeline. Please note that certain data cannot be deleted for legal or audit reasons and can only be anonymised.

12. Transfers to third countries

Personal data is only transferred to countries outside the European Union or the European Economic Area where appropriate safeguards exist, such as standard contractual clauses. The processors in use process data within the European Union or the European Economic Area.

13. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, place of work or the place of the alleged infringement.

14. Changes to this privacy policy

We update this privacy policy when processing activities or legal requirements change. The currently applicable version is available on this page.

Last updated: October 2026