Legal Notice

CROYNEL PRIVACY POLICY Last updated: 18 October 2026

This Privacy Policy explains how Croynel processes personal data when you visit croynel.com, use its subdomains and shared account services, purchase products or subscriptions, contact support, receive communications, or use Croynel's download and file-storage functions.

An optional function described below involves processing only when that function is available and you use it. This policy does not mean that every function is available to every visitor. It applies to Croynel services that refer to this policy; separate processing by third-party providers is addressed in their own privacy notices.

1. WHO IS RESPONSIBLE FOR YOUR PERSONAL DATA?

Croynel is operated by Rayan Osailan, trading as BITX Studio. The controller responsible for the processing described in this policy is:

Rayan Osailan BITX Studio / Croynel Schaitbergerstraße 26 91522 Ansbach Germany

Email: [email protected] Telephone: +49 176 81309528 Support: https://croynel.com/support

You can use these contact details for privacy questions and requests to exercise your rights. You do not need an active Croynel account to contact us by email.

Where we store personal data solely on a business customer's instructions, that customer determines the purposes of that processing and is responsible for the corresponding privacy information. This policy covers processing for which Croynel is the controller, including our own account administration, billing, support and security activities.

2. WHY WE PROCESS PERSONAL DATA

The legal bases referred to in this policy are provisions of the EU General Data Protection Regulation (GDPR):

• Article 6(1)(b): processing necessary to provide a service under a contract with you or take steps you request before entering into a contract.
• Article 6(1)(f): processing necessary for legitimate interests, such as securing our services, preventing fraud and resolving enquiries, subject to your interests and rights.
• Article 6(1)(c): processing required to comply with a legal obligation, including applicable accounting and tax requirements.
• Article 6(1)(a): processing based on your consent, such as sending optional advertising emails.

The GDPR text is available at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679

The following sections identify the purposes and legal bases for the individual activities. When you act for a business customer rather than contracting personally, we process your business contact and communication details under Article 6(1)(f), for our interest in administering that business relationship.

Account information is needed to create and secure an account. Required order, billing and payment information is needed to process a purchase and meet applicable legal obligations. Without the information required for a particular function, we may be unable to provide it. Newsletter subscriptions and external sign-in are optional.

This Privacy Policy provides information. Reading it or using the website does not constitute blanket consent to processing.

3. VISITING OUR WEBSITE, HOSTING AND DOWNLOADS

When you access our website or download content, the systems handling your request process connection and request information. This includes your IP address, the requested resource and technical information needed to deliver the response. Depending on the request, technical information can include timestamps, HTTP methods, response codes and browser-supplied request information.

We use Contabo servers in an EU region for hosting and backend operations. Cloudflare handles requests to endpoints routed through its proxy and content delivery network (CDN), helping deliver content and protect availability. Cloudflare can process the traffic passing through its systems, including IP addresses and request information.

We use Cloudflare R2 for public download content, such as installers, updates and product-related materials. Public availability of a file does not make the visitor's connection data public. Private user-file storage is described in section 9.

The purposes are delivering requested content, keeping the website available, diagnosing faults and protecting against misuse. The legal basis is Article 6(1)(f) GDPR. Where delivery is necessary to provide a product or service you have purchased, Article 6(1)(b) also applies to that delivery.

Font files are hosted with our website. Loading those fonts does not initiate a separate request to Google Fonts.

The providers and international processing associated with these services are described in sections 12 and 13. Browser storage is described in section 10.

4. ACCOUNTS, SIGN-IN AND ACCOUNT SECURITY

4.1 Croynel accounts

When you create or use an account, we process the identifiers and profile information needed for the functions you select. These may include your email address, username, name and, where required for a selected function, telephone number. We also process your account status, contact-verification status, account attributes and authentication information.

Our account system stores password hashes rather than readable account passwords. Where you use multi-factor authentication, it also processes the information needed to configure and verify that authentication method.

Session records contain account and client identifiers, generated device identifiers, session credentials, timestamps and the IP address visible to the authentication service. Where requests pass through a proxy, this may be the address of an intermediary rather than the visitor's original address.

We process this information to establish your account, verify contact details, authenticate you and provide the account functions you request under Article 6(1)(b) GDPR. Additional security monitoring is based on Article 6(1)(f), for our interest in preventing unauthorised access and protecting accounts.

4.2 Google and Microsoft sign-in

You can use Google or Microsoft sign-in where offered. Choosing this option connects you to that provider. The provider authenticates you and supplies information linking its account to your Croynel account.

We store the provider identifier, its account identifier, the corresponding internal Croynel account and authenticator identifiers, and creation, update and last-use timestamps. During registration, we also receive your email address if the provider identifies it as verified, and your name or display name if supplied.

We do not receive the password of your Google or Microsoft account. This sign-in integration does not import your profile picture, date of birth or contact list. Provider tokens are not retained as permanent sign-in credentials; Croynel creates its own session tokens. Short-lived security information is used to protect the sign-in exchange against misuse.

The legal basis for Croynel's processing is Article 6(1)(b) GDPR, to provide the sign-in method you request. Google or Microsoft is the source of the information it supplies. Each provider also processes your interaction with its own sign-in service under its own privacy notice:

Google: https://policies.google.com/privacy?hl=en Microsoft: https://www.microsoft.com/en-us/privacy/privacystatement

5. PURCHASES, SUBSCRIPTIONS AND PAYMENTS

When you use purchase, trial or subscription functions, we process information about the selected products, prices, currencies, taxes, discounts, order and invoice identifiers, payment status, transaction times, subscription status and associated usage rights.

Billing information may include your name, billing email address, postal address, tax identifiers and the results of billing or address checks. We retain versioned business records where needed to document the transaction and changes to relevant billing information.

Payments use Stripe-hosted Checkout. You enter payment details into Stripe's checkout, not into Croynel's own card-entry fields. Full card details are not routed through our backend in this integration. Croynel processes the payment references, status and associated business information needed to link the payment to your order, issue invoices and handle refunds or disputes.

Stripe receives information directly from you during checkout and processes the transaction information needed for payment. It also processes certain data for its own fraud-prevention and regulatory purposes. Its privacy notice explains this processing and the applicable Stripe entities: https://stripe.com/privacy

Order handling, subscriptions, payments, refunds and provision of usage rights are based on Article 6(1)(b) GDPR. Required accounting and tax records are processed under Article 6(1)(c). Evidence necessary to establish, exercise or defend legal claims is processed under Article 6(1)(f).

6. FRAUD PREVENTION AND AUTOMATIC PURCHASE CHECKS

We use automated checks to identify suspected fraud and inconsistent transaction information before accepting new purchases. Depending on the transaction and the applicable rules, the information evaluated can include payment successes and failures, refunds, amounts and currencies, disputes and chargebacks, financial inconsistencies, conflicting billing or address information, and associated customer, payment-provider, product and evidence references.

These checks compare relevant transaction information and events against security rules. A suspected inconsistency or fraud indicator can result in a proposed purchase being declined or suspended without a prior human decision on that individual attempt. Our automated purchase checks do not themselves remove access to already paid services; restrictions of that kind require a human decision.

The purpose is protecting customers and Croynel from fraudulent transactions and financial loss. Processing for this purpose is based on Article 6(1)(f) GDPR. You may contact [email protected] or use our support form to contest a refusal, explain your circumstances, request correction of inaccurate information and ask for human review. Your applicable rights concerning automated decisions are described in section 16.

7. SUPPORT AND OTHER ENQUIRIES

When you contact us, we process your contact details and the information you provide so that we can respond. For support tickets, this includes the ticket subject, message contents, ticket identifier, status, internal handling notes, assigned personnel and communication and handling history.

Where an enquiry relates to your contract or steps you request before entering into one, the legal basis is Article 6(1)(b) GDPR. Other enquiries are processed under Article 6(1)(f), for our interest in responding to requests and resolving problems.

Please do not include passwords, complete payment-card details or unrelated sensitive personal information in support messages.

Support tickets are deleted from the ticket system 60 days after the last communication in the ticket. Separate business records, audit evidence and backup copies are subject to the retention provisions in section 14.

Business email is handled through Zoho Mail's European service. Email enquiries therefore involve processing by Zoho as part of receiving, storing and delivering the correspondence.

8. SERVICE MESSAGES AND OPTIONAL NEWSLETTERS

8.1 Service messages

We process recipient addresses, subjects, message contents, message identifiers, dispatch status and delivery information to send account-verification codes, password-reset messages, security notices and contract or support communications.

We use Amazon Simple Email Service (SES), configured in Europe (Stockholm), for email sending. The provider processes recipient addresses, message contents and the technical information needed to deliver the message. Delivery-status information is also associated with the notification.

The legal basis is Article 6(1)(b) GDPR for communications necessary to provide the requested account or contractual service, and Article 6(1)(f) for necessary security and delivery administration. Where a communication fulfils a specific statutory obligation, Article 6(1)(c) applies.

Notification-service records, including recipient details, subjects, message contents and delivery information, are retained for 60 days. This is a storage period, not the validity period of a verification or password-reset code. Separate support, business and audit records follow section 14.

8.2 Newsletters, offers and discounts

We send newsletters and advertising about offers and discounts only if you choose to receive them. The subscription checkbox is initially unticked, and you can create and use your account without subscribing. Your email address is verified before advertising is sent.

We record your subscription, the consent text and the associated consent and withdrawal events. The legal basis for sending advertising emails is Article 6(1)(a) GDPR together with section 7(2), number 2 of the German Act Against Unfair Competition (UWG).

You can unsubscribe at any time through the link in each advertising email or through your account settings. Withdrawal takes effect for future advertising and does not affect the lawfulness of processing before withdrawal. It does not prevent necessary account, security or contractual messages from being sent on their separate legal bases.

We retain consent and withdrawal evidence to demonstrate your choices and avoid sending advertising contrary to them. Necessary evidence processing is based on Article 6(1)(c), in particular the accountability requirements of Article 7(1) GDPR, and Article 6(1)(f) for resolving disputes and respecting withdrawals. The audit retention policy in section 14 applies to these evidence records.

We do not use individual email-opening pixels or person-specific click tracking in our newsletters. Following a link can still involve the ordinary request handling and security records described in this policy.

9. USER FILES AND STORAGE FUNCTIONS

If you use a Croynel file-storage function, we process the files you provide and their associated account and file references to store, synchronise and make them available as requested. The personal data in a file depend on its contents.

Private user-related files and internal backups are stored using Scaleway Object Storage in an EU region. Basic file storage does not include content analysis for an unrelated purpose. If you choose an additional function that processes file contents, the information provided for that function explains its purpose and processing.

The legal basis for providing storage directly to you is Article 6(1)(b) GDPR. Security and recovery processing is based on Article 6(1)(f), for our interest in maintaining the confidentiality, integrity and availability of the stored information. Where a business customer determines the purposes of processing data in its files, the role described in section 1 applies.

10. COOKIES AND BROWSER STORAGE

We use cookies, SessionStorage and LocalStorage for account security and features you request. Cookies are sent to the relevant website with applicable requests. SessionStorage and LocalStorage store information in your browser for use by the website.

Storage or access strictly necessary to provide a digital service you expressly request is covered by section 25(2), number 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG). Other storage or access requires consent where section 25(1) applies. The legal basis for subsequent processing of personal data depends on the function, as explained above; browser-storage permission and GDPR processing grounds are separate requirements.

We use the following entries:

croynel-session Type: Cookie. Purpose: Encrypted sign-in and session information. Duration: Until the associated access token expires; deleted on sign-out.

croynel-verification Type: Cookie. Purpose: Maintaining the state of the email-verification process. Duration: Ten minutes. Resending the verification code renews that period.

croynel-support-<Ticket-ID> Type: Cookie, with the particular ticket identifier forming part of its name. Purpose: Allowing guest access to the support ticket created by the visitor. Access is restricted to the corresponding ticket API path. Duration: 30 days.

__Host-CroynelOAuth Type: Cookie. Purpose: Binding the requested sign-in or registration flow to the browser and preventing forged requests. Duration: Ten minutes for sign-in and normally eleven minutes for registration.

__Host-CroynelExternal Type: Cookie. Purpose: Securing the return from an external sign-in provider and checking the state of that sign-in attempt. Duration: Ten minutes; removed when the return from the provider is processed.

cora:tutorial:v1 Type: SessionStorage. Purpose: Saving the tutorial identifier, version, step, phase and timestamp so the selected tour can continue. Duration: Progress is accepted for twelve hours. An expired entry is removed when next read; exiting or completing the tutorial removes it. The browser's session-storage lifecycle can remove it earlier.

croynel.wishlist:<User-ID> Type: LocalStorage, with the Croynel user identifier forming part of the key. Purpose: Saving product identifiers after a signed-in user chooses to add a product to the wishlist. Shop and product pages read an existing entry after session validation, including when the page regains focus. Duration: No automatic expiry. Sign-out does not remove the entry. Removing the final product leaves an empty list under the account-specific key. You can remove the entry completely using your browser's controls for clearing website data.

The tutorial and wishlist are optional features. Their saved information is used for those functions, not for advertising profiling. We process account-related wishlist data under Article 6(1)(b) GDPR to maintain the saved list you request. Processing tutorial progress is based on Article 6(1)(f), for our interest in providing continuity within the optional website tour. The separate device-storage requirements explained above remain applicable. Signing out is not equivalent to clearing all website data, particularly on a shared device.

Depending on security features triggered for a request, Cloudflare may also use cookies for security or challenge handling. Its cookie documentation explains the feature-specific purposes and lifetimes: https://developers.cloudflare.com/fundamentals/reference/policies-compliances/cloudflare-cookies/

You can inspect, block or delete cookies and other website storage through your browser settings. Doing so may sign you out, remove saved wishlist or tutorial information, or remove access to a guest support ticket. A privacy policy or a browser's general acceptance of cookies is not, by itself, consent to unrelated tracking.

11. REQUEST STATISTICS, SECURITY LOGS AND AUDIT EVIDENCE

11.1 Request counts

We use our own Gateway for server-side request counting. This measurement concerns how often endpoints are called; it is not individual newsletter-opening or click tracking. Aggregated totals that do not identify visitors or accounts may be retained without a fixed time limit.

These aggregate counts are separate from request-level operational and security evidence. A count of requests is not the same record as an identifiable account action. Cloudflare's processing of traffic through its network is also separate from our own Gateway counting.

11.2 Operational logs

Application and error logs help identify faults, investigate access problems and maintain service reliability. They can contain technical events, timestamps, identifiers and diagnostic information. Depending on the event, logs can also contain personal information such as account identifiers or information included in a diagnostic message.

We redact certain secrets from logs, but this does not make all logs anonymous. Operational security and troubleshooting are based on Article 6(1)(f) GDPR. The normal application-log retention period is 30 days; volume limits can cause earlier removal.

11.3 Security and business audit records

We maintain cryptographically protected records of relevant security and business interactions. These include authentication events, permissions and security changes, refused or unusual access, consent and withdrawal events, and contractual or financial operations. Successful routine internal security-snapshot and secret-reading requests do not generate individual audit entries merely because they occur.

For API operations subject to audit, records can include timestamps for the beginning and end, HTTP method, request path, response status, calling service identifier and event identifiers. Audit records also use sequence numbers, hashes and signatures to protect traceability.

The regular API audit does not store complete URLs, query strings, complete HTTP headers, referrers, browser identifiers, IP addresses or request and response bodies as standard fields. Personal identifiers can nevertheless appear in a request path or resource reference. Other records, such as account sessions and error logs, can contain additional information, including IP addresses.

Audit and linked business-history records may include user, session and transaction identifiers, relevant reasons and results, and historical billing information. They can remain attributable to a person. Cryptographic protection does not make readable contents or linkable identifiers anonymous.

We use these records to investigate incidents, establish what happened, protect system integrity, demonstrate consent and transactions, and establish, exercise or defend legal claims. Necessary security and evidential processing is based on Article 6(1)(f) GDPR. Article 6(1)(c) applies where a specific legal record-keeping or accountability obligation requires the particular record. Retention is addressed in section 14.

12. SERVICE PROVIDERS AND OTHER RECIPIENTS

The following providers receive or process information in connection with the functions they perform. They do not automatically receive every category of Croynel data.

Contabo GmbH — server infrastructure for the website and backend, using an EU hosting region. Data on the hosted systems can include account, support, transaction and operational information.

Cloudflare, Inc. — proxy, CDN and network protection for routed endpoints, and R2 for public download content. Relevant data include connection and request information needed to deliver and protect these services. Privacy information: https://www.cloudflare.com/privacypolicy/

Scaleway — private file storage and backups in an EU region. Stored information can include customer files and the personal data contained in backup copies. Privacy information and service documentation: https://www.scaleway.com/en/privacy-policy/

Amazon Web Services — email sending through Amazon SES in Europe (Stockholm). Relevant information includes recipients, message contents and technical delivery information. Data-privacy information: https://aws.amazon.com/compliance/data-privacy/

Zoho — business email through Zoho Mail's European service. Relevant information includes addresses, correspondence, attachments where supplied and mail-delivery information. Privacy information: https://www.zoho.com/privacy.html

Stripe — hosted checkout, payment processing and related payment-security and regulatory activities. Relevant information includes checkout data, payment data and transaction references. Privacy information: https://stripe.com/privacy

Google and Microsoft — authentication through their respective external sign-in services when you select them. The information Croynel receives is described in section 4. Their privacy notices are linked there.

Providers can act on our behalf for service delivery or as independent controllers for particular purposes. In particular, Stripe, Google and Microsoft process certain information under their own responsibility. Their own notices explain that processing, retention and associated rights. A provider's processing of our customer data on our behalf is not the same as its processing for independent purposes.

Where legally required or necessary to establish, exercise or defend legal claims, relevant information may also be disclosed to competent authorities, courts or professional advisers. The legal basis is the applicable obligation under Article 6(1)(c) GDPR or the necessary protection of legal interests under Article 6(1)(f).

13. INTERNATIONAL PROCESSING

Our selected server and private-storage regions are in the EU, and SES sending is configured in Stockholm. Cloudflare operates a global network, and our public R2 downloads are not covered by an EU-only location commitment in this policy. EU-region hosting does not mean that all provider support, group-company processing or onward transfers take place exclusively in the European Economic Area (EEA).

The providers involved may process data outside the EEA, including in the United States and, for relevant provider operations, India. Applicable foreign laws and access rights can differ from those in the EEA.

International-transfer arrangements described in the providers' published terms and privacy information include:

• Cloudflare: the EU–US Data Privacy Framework for covered transfers to its certified US entity, and EU Standard Contractual Clauses for other relevant restricted transfers or as a fallback.
• AWS: EU Standard Contractual Clauses incorporated into its service terms for applicable restricted transfers, unless another recognised transfer mechanism applies.
• Zoho: contractual safeguards based on EU Standard Contractual Clauses for relevant transfers within its group and to engaged third parties.
• Stripe, Google and Microsoft: adequacy arrangements, including the EU–US Data Privacy Framework for recipients and processing within the relevant certification, and Standard Contractual Clauses for applicable transfers not covered by adequacy.

An adequacy decision under Article 45 GDPR applies only within its scope. Standard Contractual Clauses are safeguards under Article 46 GDPR, not a declaration that every destination has identical laws. These mechanisms are separate from the legal basis for the underlying processing.

The relevant published information is available here:

Cloudflare: https://www.cloudflare.com/cloudflare-customer-dpa/ AWS: https://docs.aws.amazon.com/whitepapers/latest/navigating-gdpr-compliance/aws-data-processing-addendum-dpa.html Zoho: https://www.zoho.com/privacy.html Stripe: https://stripe.com/privacy Google: https://policies.google.com/privacy/frameworks?hl=en Microsoft: https://www.microsoft.com/en-us/privacy/privacystatement Scaleway service terms: https://www.scaleway.com/en/contracts/

You can contact [email protected] for information about the recipients and transfer safeguards relevant to your data and to request a copy of applicable safeguards. The linked provider information also explains how copies can be obtained. This policy does not ask you to consent generally to international transfers simply by visiting the website.

14. RETENTION, ACCOUNT CLOSURE AND BACKUPS

14.1 Retention periods

The following periods and criteria apply to Croynel's records. A mandatory legal retention requirement, a substantiated need to preserve particular evidence for legal claims, or an applicable right to earlier erasure or restriction takes precedence where required by law. A retention period does not authorise using the data for unrelated purposes.

Account and profile data: retained to administer the account and provide the services you use. Accounts are not automatically deleted solely because of inactivity. Account closure and erasure requests are addressed below.

Session records: sessions normally have a 30-day validity period. Expired session records enter the separate cleanup process no earlier than seven days after expiry. Revoking a session stops its use but is not the same as immediate deletion of its stored metadata. Browser-cookie lifetimes are listed separately in section 10.

Support tickets: deleted 60 days after the last communication in the ticket.

Notification-service records: recipient details, message subjects, contents and dispatch/delivery information are retained for 60 days.

Application logs: normally retained for 30 days, with hourly cleanup. A volume limit of one million entries can shorten this period. These logs are separate from audit records.

Audit and evidential records: a ten-year retention period applies under Croynel's audit policy. The purpose is preserving traceable evidence of relevant security interactions, consent, transactions and contracts for incident investigation and legal claims. This is our retention policy for these records, not a statement that every technical audit event is subject to a statutory ten-year minimum. Applicable erasure and restriction rights remain unaffected.

Accounting and tax records: invoices are generally subject to eight years' retention under section 14b UStG. Other accounting books and records, vouchers and business correspondence can be subject to ten-, eight- or six-year periods under the applicable German record-keeping rules, depending on their classification. Statutory periods generally run from the end of the relevant calendar year, and statutory extensions may apply.

User files: retained for the storage function requested by you or the relevant business customer and addressed through the applicable file-deletion or account-erasure process, subject to separately retained evidence and backup copies.

Marketing information: used for advertising until you unsubscribe or withdraw consent. Subscription and withdrawal evidence follows the audit policy; retaining that evidence does not permit further advertising after withdrawal.

Other business correspondence: retention is determined by the handling of the enquiry or business relationship and any applicable statutory record-keeping or legal-claim requirements. It is not automatically subject to the ten-year audit period simply because it is an email.

Browser storage: retained as stated for each entry in section 10.

Backup files: deleted after 200 days, as explained below.

The deletion of a support ticket or notification record does not automatically delete a separate invoice, consent record or security event that has its own retention purpose. Conversely, the retention of a particular legal record does not extend the retention of unrelated data merely because they concern the same account.

14.2 Account closure and erasure requests

Closing an account disables its use and removes access credentials and certain profile information. It does not automatically remove every associated record across the service, including external sign-in links, support records, business histories and audit evidence.

You can request erasure of personal data through the contact details in section 1. Our deletion procedures include manual handling across the affected services. Whether particular data can be erased depends on their purpose and any applicable legal grounds requiring or permitting continued retention. Where retention remains necessary, the rights and limitations described in section 16 still apply.

14.3 Backup copies and restoration

Backups support recovery after accidental loss, corruption or operational failure. They can contain copies of personal data that have since been removed from an active system. Backup files are deleted after 200 days; deleting an active record does not immediately rewrite every existing backup.

During restoration, applicable expiry periods are automatically checked and expired data are deleted. Manual or user-initiated deletions are not reliably reapplied in every restoration, so restoring an older backup can reintroduce records deleted in the meantime. This limitation does not remove your statutory rights, including your right to erasure where its conditions are met.

Backup retention is separate from the retention of active business and audit records. The 200-day backup period does not itself extend the permitted operational use of a record.

15. SECURITY

We use encrypted web transport, service and account authentication, access controls, password hashing and cryptographically protected evidence records to safeguard personal data. Administrative access is restricted through the permissions applicable to the relevant functions.

These safeguards support confidentiality, integrity and availability. They cannot provide an absolute guarantee against every security incident, and integrity protection does not make the underlying information anonymous.

16. YOUR RIGHTS

Subject to the conditions of applicable data-protection law, you have the following rights:

Access: obtain confirmation of whether we process your personal data, information about that processing and a copy of the data.

Rectification: request correction of inaccurate data and completion of incomplete data.

Erasure: request deletion where the conditions of Article 17 GDPR are met. Exceptions can apply, including necessary compliance with legal obligations or the establishment, exercise or defence of legal claims.

Restriction: request restricted processing in the circumstances described in Article 18 GDPR, including while disputed accuracy or certain objections are being considered.

Portability: receive data you have provided in a structured, commonly used, machine-readable format, and have it transmitted where technically feasible, when processing is automated and based on consent or a contract.

Withdrawal of consent: withdraw consent for future processing without affecting the lawfulness of processing carried out before withdrawal.

Automated decisions: where Article 22 GDPR applies, you have the rights it provides concerning solely automated decisions with legal or similarly significant effects, including the applicable rights to human intervention, to express your point of view and to contest the decision.

RIGHT TO OBJECT

Where processing is based on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. We may continue only where the applicable grounds for overriding that objection are met, including compelling legitimate grounds or necessary legal claims.

You may object to processing for direct marketing at any time, without giving reasons. This includes profiling related to that marketing. Your data must then no longer be processed for that purpose.

HOW TO EXERCISE YOUR RIGHTS

Contact [email protected] or use https://croynel.com/support. Requests are generally free of charge. Where there are reasonable doubts about the identity of the requester, additional information necessary to verify identity may be requested.

Under the GDPR, you are entitled to a response without undue delay and normally within one month. For complex or numerous requests, this may be extended by up to two further months, with notification and reasons within the initial month. If a request is refused, you are entitled to reasons and information about available remedies.

COMPLAINTS

You may complain to a data-protection supervisory authority, in particular in the EU Member State of your habitual residence, place of work or the alleged infringement. For our establishment in Bavaria, a relevant authority is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) Postfach 1349 91504 Ansbach Germany Website and complaint information: https://www.lda.bayern.de/

You do not have to contact Croynel before making a complaint. Any additional rights under applicable mandatory local law remain unaffected.

17. CHANGES TO THIS POLICY

We update this policy when our services, processing activities or applicable requirements change. The date at the beginning identifies this version. Where a change requires additional information or a new consent, the information or consent request will be provided as required before the affected processing begins. Continuing to use a service is not a substitute for consent where consent is required.