The controller for lexavero.com and for LexaVero processing carried out by us is Hermann Selchow, as identified in the Imprint. Contact: info@lexavero.com. Where another provider, such as Paddle, acts as an independent controller for its own processing, this is explained below.
This Privacy Policy covers lexavero.com and the commercially available LexaVero application insofar as personal data is processed by us. LexaVero is designed so that marketplace exports, bank files and reconciliation results are processed locally on the user's device. This policy therefore distinguishes between local business-data processing and the limited online processing required for the website, licensing, updates, purchases and support.
The website and licensing infrastructure are hosted by allinkl.com. When website or licensing endpoints are accessed, technical log data may be processed, in particular IP address, date and time, requested resource, access status, transferred data volume, referrer, browser, operating system and similar connection information. This processing is necessary to deliver, secure and operate the services reliably. Legal basis: Article 6(1)(f) GDPR, our legitimate interest in secure and reliable operation.
Marketplace exports, bank files, transaction data and reconciliation results selected or created by the user are processed locally on the user's device. Their contents are not transmitted to LexaVero for the reconciliation itself and are not stored by us as part of normal product use. Users remain responsible for securing their own devices, local files, exports and backups.
LexaVero and lexavero.com may store functional information locally in the browser or application storage, for example language preferences, application settings, local work data and other information needed to provide requested functions. Such local storage is not used for advertising. Where storage or access on the user's terminal equipment is strictly necessary to provide a service expressly requested by the user, Section 25(2) no. 2 TDDDG applies. Where personal data is involved, the relevant GDPR legal basis is Article 6(1)(b) and/or Article 6(1)(f), depending on the function.
For initial activation or an activation expressly initiated by the user, the application communicates with LexaVero servers and may process the licence or activation key, the LexaVero marketplace edition, a device identifier generated for licensing, activation status, licence validity information, date and time, and technically necessary connection data such as the IP address contained in server logs. Once a licence has been activated, the application may, when an Internet connection is available, automatically contact LexaVero servers when it starts, when connectivity is restored and at regular intervals during use. For this automatic status check, the licence ID, the device identifier generated for licensing and the relevant marketplace edition are transmitted so that licence status, device assignment and licence validity can be verified. The licence or activation key is not transmitted as part of this automatic status check. The application may also obtain version or update information from our servers. Marketplace exports, bank statements, transaction contents and reconciliation results are not transmitted for any of these purposes. Legal basis: Article 6(1)(b) GDPR for performance of the licence agreement and Article 6(1)(f) GDPR for security, abuse prevention and reliable operation.
We use Cookiebot Consent Management Platform by Usercentrics to manage and document cookie and consent choices on lexavero.com. The service may process information required to display the consent interface and document the user's choice, including consent state, a consent identifier, date and time, technical browser information and, where required for operation, IP-related information. A consent cookie or comparable local storage may be used to remember the choice. The purpose is to manage consent, respect the user's selection and be able to demonstrate consent where required. Legal bases are Article 6(1)(c) GDPR where processing is necessary to fulfil legal obligations and Article 6(1)(f) GDPR for reliable consent management; where consent itself is the legal basis for an optional service, Article 6(1)(a) GDPR applies to that service. Technically necessary storage is based on Section 25(2) no. 2 TDDDG. Further information is available in Usercentrics/Cookiebot's privacy information.
With your consent to the statistics category in Cookiebot, we operate our own first-party visitor analytics on lexavero.com. The analytics records pseudonymous visitor and session identifiers, pages viewed, a cleaned referrer URL without query parameters or fragments, UTM campaign parameters, browser, operating system, device type, language, screen dimensions and active time on pages and sessions. Where a local or server-side GeoIP resolver is available, the IP address may be used transiently to determine a country code; the IP address itself is not stored in the analytics database. We do not use Google Analytics or another external analytics provider for this function. Two first-party statistics cookies may be used: lv_an_v for a pseudonymous returning-visitor identifier for up to 180 days and lv_an_s for the current session for about 30 minutes. Analytics data is retained for up to 12 months and then deleted. The analytics starts only after statistics consent and stops when that consent is withdrawn; the analytics cookies are then deleted. Legal bases: Section 25(1) TDDDG for storage or access on the terminal device and Article 6(1)(a) GDPR for subsequent processing of personal data.
LexaVero purchases are processed through Paddle, which acts as Merchant of Record for the transaction. Paddle processes the personal and payment-related information required for checkout, payment, tax, fraud prevention, invoicing and customer transaction administration under its own responsibility and privacy notice. Paddle may provide us with information required to fulfil the purchase and issue or administer the LexaVero licence, for example transaction or product information and, where necessary, buyer contact information. We do not receive the buyer's full payment-card details. Marketplace exports, bank files and reconciliation data are not transmitted to Paddle as part of the LexaVero purchase flow. Paddle's own processing is governed by its privacy information at paddle.com/legal/privacy.
If you contact us by email or request support, we process the information you provide, such as name, email address, message content and any files or diagnostic material you voluntarily send. We use this information only to handle the request, provide support and, where applicable, perform contractual obligations. Please send only information that is necessary for the support case. Legal bases are Article 6(1)(b) GDPR for contractual or pre-contractual communication and Article 6(1)(f) GDPR for general enquiries, security and the efficient handling of support.
Personal data is disclosed only where necessary for the purposes described above, in particular to hosting and email providers, Usercentrics/Cookiebot, Paddle, and other technical service providers required to operate the website, licensing or purchase process, or where disclosure is required by law. We do not sell personal data. Where a recipient processes personal data outside the European Economic Area, a transfer takes place only in accordance with the requirements of Chapter V GDPR, for example on the basis of an adequacy decision, appropriate safeguards such as Standard Contractual Clauses, or another legally permitted mechanism.
We retain personal data only for as long as necessary for the respective purpose or as required by law. Server logs are retained according to the hosting provider's technical and security settings. Licensing data may be retained for the duration of the licence relationship and, where necessary, beyond it for security, documentation and the establishment, exercise or defence of legal claims. Purchase and accounting information is retained in accordance with applicable statutory retention obligations; Paddle applies its own retention rules to data processed under its responsibility. Support correspondence is retained only as long as necessary for the request and any related contractual or legal documentation requirements. Consent records are retained for as long as necessary to document consent and comply with applicable obligations.
Subject to the statutory requirements, you have the right to request access, rectification, erasure, restriction of processing and data portability. You may object to processing based on Article 6(1)(f) GDPR. Where processing is based on consent, you may withdraw that consent at any time with effect for the future. You also have the right to lodge a complaint with a competent data-protection supervisory authority. Rights relating to processing for which Paddle or another provider acts as an independent controller must generally be exercised with that provider.
We use appropriate technical and organisational measures to protect personal data. No Internet transmission can be guaranteed to be completely risk-free. LexaVero's local-processing design deliberately limits the amount of business and financial data that needs to leave the user's device. We may update this Privacy Policy when legal requirements, providers or material data flows change. The current version published on lexavero.com applies.