Privacy Notice | DOCby.net

Note: This is an English translation of our German privacy notice for convenience. The German version is the legally binding one.

1. Data Protection at a Glance

General information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data by which you can be personally identified. Detailed information can be found in the sections below.

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. You will find their contact details in the section “Information on the controller”.

How do we collect your data?

Some data is collected because you provide it to us, e.g. via the contact form. Other data is collected automatically by our IT systems when you visit the website. This is mainly technical data (e.g. browser, operating system or time of the page request). This data is collected automatically as soon as you enter this website.

This website does not set any cookies and does not store any other data in your browser. Fonts, scripts and web analytics are loaded from our own servers; we do not embed third-party content (e.g. Google Fonts, YouTube, map services or social media plugins).

What do we use your data for?

Some of the data is collected to ensure that the website is provided without errors. Other data is used for anonymous usage statistics. Data that you send us via the contact form or by e-mail is used to handle your request.

What rights do you have regarding your data?

You have the right at any time to receive information free of charge about the origin, recipients and purpose of your stored personal data. You also have the right to request the correction or deletion of this data. If you have given consent to data processing, you can withdraw this consent at any time with effect for the future. You also have the right, under certain circumstances, to request the restriction of the processing of your personal data. Furthermore, you have the right to lodge a complaint with the competent supervisory authority. You can contact us at any time regarding this and any other questions on data protection.

2. Hosting

This website is hosted externally. The personal data collected on this website is stored on the hosting provider’s servers. This may include, in particular, IP addresses, contact requests, meta and communication data, contact details, names and website access data. We also operate the service for the contact form and the web analytics (section 5) ourselves on this server.

External hosting is carried out for the purpose of fulfilling contracts with our potential and existing customers (Art. 6 (1) (b) GDPR) and in the interest of a secure, fast and efficient provision of our online services by a professional provider (Art. 6 (1) (f) GDPR).

Our hosting provider processes your data only to the extent necessary to fulfil its service obligations and follows our instructions regarding this data. We use the following hosting provider:

Hostinger operations, UAB
Švitrigailos str. 34
03230 Vilnius, Lithuania

The server is located in a data centre in Frankfurt am Main (Germany).

Data processing agreement

We have concluded a data processing agreement (DPA) with the above provider. This is a contract required by data protection law which ensures that the provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

3. General Information and Mandatory Information

Data protection

We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy notice. Our DOC.mobile and DOC.project platforms are subject to an information security management system certified to ISO 27001.

Please note that data transmission over the internet (e.g. when communicating by e-mail) may be subject to security vulnerabilities. Complete protection of data against access by third parties is not possible.

Information on the controller

The controller responsible for data processing on this website is:

DOCby.net GmbH
Managing Director: Dipl.-Inform. (TU) Rainer David
Nordstraße 13
38106 Braunschweig, Germany

Phone: +49 531 288 539 40
E-mail: service@docby.net

The controller is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data (e.g. names, e-mail addresses, etc.).

Retention period

Unless a more specific retention period is stated in this privacy notice, your personal data will remain with us until the purpose for the data processing no longer applies. If you assert a justified request for deletion or withdraw your consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing it (e.g. retention periods under tax or commercial law); in the latter case, deletion takes place once these reasons cease to apply.

General information on the legal bases for data processing on this website

If you have consented to data processing, we process your personal data on the basis of Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR if special categories of data under Art. 9 (1) GDPR are processed. If your data is required for the performance of a contract or for pre-contractual measures, we process it on the basis of Art. 6 (1) (b) GDPR. We also process your data where this is necessary to comply with a legal obligation, on the basis of Art. 6 (1) (c) GDPR. Data processing may also be based on our legitimate interest under Art. 6 (1) (f) GDPR. The relevant legal bases in each individual case are set out in the following paragraphs of this privacy notice.

Data protection officer

We have appointed a data protection officer:

DDK Datenschutz-Direkt GmbH
Viktoria Lhomme
Carlstraße 50
52531 Übach-Palenberg, Germany

Phone: +49 2451 616314-0
E-mail: info@datenschutz-direkt.de

Recipients of personal data

In the course of our business activities, we work with various external parties. In some cases, this also requires the transfer of personal data to these external parties. We only pass on personal data to external parties if this is necessary for the performance of a contract, if we are legally obliged to do so (e.g. passing on data to tax authorities), if we have a legitimate interest in the disclosure under Art. 6 (1) (f) GDPR, or if another legal basis permits the disclosure. When using processors, we only pass on personal data on the basis of a valid data processing agreement.

No data is transferred to countries outside the EU or the EEA.

Withdrawal of your consent to data processing

Some data processing operations are only possible with your express consent. You can withdraw consent you have already given at any time. The lawfulness of the data processing carried out until the withdrawal remains unaffected.

Right to object to data collection in special cases and to direct marketing (Art. 21 GDPR)

IF DATA PROCESSING IS BASED ON ART. 6 (1) (E) OR (F) GDPR, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE LEGAL BASIS ON WHICH ANY PROCESSING IS BASED CAN BE FOUND IN THIS PRIVACY NOTICE. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA CONCERNED UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS (OBJECTION PURSUANT TO ART. 21 (1) GDPR).

IF YOUR PERSONAL DATA IS PROCESSED FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR SUCH MARKETING; THIS ALSO APPLIES TO PROFILING INSOFAR AS IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL NO LONGER BE USED FOR THE PURPOSE OF DIRECT MARKETING (OBJECTION PURSUANT TO ART. 21 (2) GDPR).

Right to lodge a complaint with the competent supervisory authority

In the event of breaches of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their place of work or the place of the alleged infringement. This right exists without prejudice to any other administrative or judicial remedies. The authority responsible for us is the Data Protection Commissioner of Lower Saxony (Die Landesbeauftragte für den Datenschutz Niedersachsen), Prinzenstraße 5, 30159 Hannover, Germany.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done to the extent technically feasible.

Information, correction and deletion

Within the framework of the applicable legal provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the data processing and, if applicable, a right to correction or deletion of this data. You can contact us at any time regarding this and any other questions on personal data.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. You can contact us about this at any time. The right to restriction of processing exists in the following cases:

If you dispute the accuracy of your personal data stored by us, we usually need time to verify this. For the duration of the verification, you have the right to request the restriction of processing.
If the processing of your personal data was or is unlawful, you can request the restriction of data processing instead of deletion.
If we no longer need your personal data but you need it to exercise, defend or assert legal claims, you have the right to request the restriction of processing instead of deletion.
If you have lodged an objection under Art. 21 (1) GDPR, a balance must be struck between your interests and ours. As long as it has not yet been determined whose interests prevail, you have the right to request the restriction of processing.

If you have restricted the processing of your personal data, this data – apart from its storage – may only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or a Member State.

SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, such as requests that you send to us as the site operator, this site uses SSL/TLS encryption. You can recognise an encrypted connection by the browser’s address bar starting with “https://” and by the lock symbol in your browser bar. Data that you transmit to us is thus protected against being read by third parties while in transit.

Objection to advertising e-mails

We hereby object to the use of contact data published in the context of the imprint obligation for sending unsolicited advertising and information material. We expressly reserve the right to take legal action in the event of unsolicited advertising, for example through spam e-mails.

4. Data Collection on this Website

Cookies and third-party content

This website does not set any cookies and does not store any information in your browser (e.g. in local storage). A cookie banner is therefore not required. Fonts and scripts are embedded locally from our server; no connection to third-party servers is made. References to external websites (e.g. Google Maps for directions or partner websites) are plain links: data is only transferred to the respective provider once you click such a link. That provider’s privacy provisions then apply.

Server log files

Our web server automatically collects and stores information in so-called server log files, which your browser transmits to us automatically. These are:

IP address, truncated only (for IPv4 the last byte, for IPv6 the last 80 bits are removed), so that it cannot be traced back to your connection
date and time of the server request
page requested, status of the request and amount of data transferred
referrer URL
browser type and version as well as operating system (user agent)

Requests for pages that do not exist are additionally logged without an IP address in order to detect broken links. This data is not merged with other data sources.

This data is collected on the basis of Art. 6 (1) (f) GDPR. We have a legitimate interest in the technically error-free presentation, the security and the optimisation of our website – for this purpose, the server log files must be recorded. The log files are continuously overwritten once they reach a fixed size.

Contact form

If you send us enquiries via the contact form, your details from the enquiry form, including the contact details you provided there, will be stored by us for the purpose of processing the enquiry and in case of follow-up questions. We do not pass on this data without your consent.

Data processed: name, company, position, phone, e-mail address, your message and, if applicable, your preferred appointment, as well as technically the time of receipt, the page from which you opened the form, and your truncated IP address.
Transmission: our form service on the server named in section 2 forwards your enquiry by encrypted e-mail to our mailbox service@docby.net at IONOS SE (processor). The form service itself only logs the truncated IP address and the type of enquiry.

This data is processed on the basis of Art. 6 (1) (b) GDPR if your enquiry is related to the performance of a contract or is necessary for pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Art. 6 (1) (f) GDPR).

The data you enter in the contact form remains with us until you ask us to delete it or the purpose for storing the data no longer applies (e.g. after your enquiry has been processed). Mandatory statutory provisions – in particular retention periods (generally 6 years under Section 257 of the German Commercial Code (HGB) or 10 years under Section 147 of the German Fiscal Code (AO) for business correspondence) – remain unaffected. For the spam protection of the form, see section 6.

Enquiries by e-mail, telephone or fax

If you contact us by e-mail, telephone or fax, your enquiry including all resulting personal data (name, enquiry) will be stored and processed by us for the purpose of handling your request. We do not pass on this data without your consent. E-mails are stored in our mailbox at IONOS SE.

The data you send us via contact requests remains with us until you ask us to delete it or the purpose for storing the data no longer applies (e.g. after your request has been processed). Mandatory statutory provisions – in particular statutory retention periods – remain unaffected.

5. Web Analytics

Plausible Analytics (self-hosted)

We use the open-source software Plausible Analytics (Community Edition, developed by Plausible Insights OÜ, Tartu, Estonia). We operate Plausible ourselves on our server (section 2) at plausible.docbynet.cloud. No data is transferred to the developer.

We use Plausible to compile usage statistics in order to improve our website. The following is recorded: page visited, referrer (source of the visit), browser, operating system, device type (derived from the screen width), country of origin, time on page and scroll depth, as well as the following events: submission of the contact form, clicks on phone and e-mail links, downloads of PDF files and clicks on external links.

Your IP address is not stored. It is only used at the moment of the request to determine the country of origin and, together with the user agent, to create an identifier with which visits on the same day are grouped. This identifier is a hash with a random value that changes daily and is deleted after 24 hours; after that, no conclusions about individual visitors are possible. We store the resulting statistical data, which has no personal reference, without time limit.

The use is based on Art. 6 (1) (f) GDPR; we have a legitimate interest in a data-minimising analysis of user behaviour in order to tailor our website to user needs. Plausible does not set any cookies. Source code: github.com/plausible/community-edition.

6. Plugins and Tools

Spam protection with ALTCHA

To protect our contact form against automated submissions (bots), we use the open-source solution “ALTCHA”. It runs entirely on our own server (section 2); no data is transferred to third parties.

How it works: as soon as you use the form, your browser solves a small computational task in the background. The result is submitted with the form and checked by our server. No image puzzle is required and your behaviour is not analysed.
Data processed: your IP address when the task is requested and when the form is submitted, in order to limit abusive numbers of requests. It is only kept in memory for this purpose and discarded after 24 hours at the latest. ALTCHA sets no cookies and creates no usage profile.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in protecting our website against spam and abuse).

7. Our Own Services

Handling of applicant data

We offer you the opportunity to apply to us (by e-mail or by post). Below we inform you about the scope, purpose and use of the personal data collected during the application process. We assure you that your data will be collected, processed and used in accordance with applicable data protection law and all other statutory provisions and that your data will be treated in strict confidence.

Scope and purpose of data collection

If you send us an application, we process the associated personal data (e.g. contact and communication data, application documents, notes taken during interviews, etc.) insofar as this is necessary to decide on the establishment of an employment relationship. The legal basis for this is Art. 6 (1) (b) GDPR (initiation of an employment relationship), supplemented by Section 26 of the German Federal Data Protection Act (BDSG), and – if you have given consent – Art. 6 (1) (a) GDPR. Consent can be withdrawn at any time. Within our company, your personal data will only be passed on to persons involved in processing your application.

If your application is successful, the data you submitted will be stored in our data processing systems on the basis of Art. 6 (1) (b) GDPR and Section 26 BDSG for the purpose of carrying out the employment relationship.

As part of the application process, we may also carry out an internet search about you. This mainly includes Google search, LinkedIn and Xing. The legal basis for this type of processing is our legitimate interest in obtaining an overall impression of publicly available information about you (Art. 6 (1) (f) GDPR).

Data retention period

If we are unable to offer you a position, you decline a job offer or withdraw your application, we reserve the right to retain the data you submitted on the basis of our legitimate interests (Art. 6 (1) (f) GDPR) for up to 6 months from the end of the application process (rejection or withdrawal of the application). The data is then deleted and physical application documents are destroyed. The retention serves in particular as evidence in the event of a legal dispute. If it is apparent that the data will be required after the 6-month period has expired (e.g. due to an impending or pending legal dispute), deletion will only take place once the purpose for further retention no longer applies.

Longer retention may also take place if you have given your consent (Art. 6 (1) (a) GDPR) or if statutory retention obligations prevent deletion.

8. Use of our DOC.mobile and DOC.project Platforms

If you use our DOC.mobile and DOC.project platforms in production, we process your data exclusively on your behalf and in accordance with your documented instructions. This is based on a separate data processing agreement pursuant to Art. 28 GDPR; this privacy notice does not apply to it. On request, we provide our technical and organisational measures (TOMs), the ISO 27001 certificates and a data protection impact assessment (DPIA) pursuant to Art. 35 GDPR: service@docby.net.

Last updated: October 2026

Imprint · Image credits · Disclaimer