IT security and compliance
at enterprise level

Data privacy training is part of Lemontaps' mandatory onboarding process. All Lemontaps employees are committed to confidentiality or compliance with data protection and are familiarized with the consequences in the event of violations. In addition, the company conducts regular training and awareness-raising measures on the handling of personal data, the GDPR, and legal innovations.

Yes, Lemontaps is the only known provider in the EU market certified by TÜV Süd for the development, hosting and distribution of software solutions (SaaS), including service support and production and distribution of NFC cards.

If, contrary to expectations, a data breach occurs at Lemontaps involving a customer's personal data and the breach is likely to result in a risk to the rights and freedoms of the customer's employees, Lemontaps will promptly notify the affected customer in accordance with its legal and contractual obligations so that it can comply with its legal notification obligations to the supervisory authority and the data subjects.

As a European company, data protection and compliance with the GDPR are central components of our product strategy. That is why we already pay attention to principles such as data economy and the use of state-of-the-art measures to ensure an appropriate level of protection when developing our features. To ensure this on a permanent basis, we have also defined a process that continuously incorporates the legal requirements into the product development process and reviews the application at regular intervals.

Lemontaps meets the requirements of the EU General Data Protection Regulation and is data protection compliant as an organization as well as software according to EU-GDPR. To this end, we have checked our product from the outset for the essential legal requirements such as data protection through technology design and through data protection-friendly default settings (Art. 25 EU GDPR) or also the support of the customer in safeguarding data subject rights such as the right to erasure, the right to information or the right to data portability (Chapter 3 EU GDPR) and have made appropriate adjustments.

Yes, for all communication between users and our servers HTTPS is enforced with SSL certificates that are renewed every 3 months. SSL (Secure Sockets Layer) is the standard security technology for establishing an encrypted connection between a web server and a browser. This connection ensures that all data transferred between the web server and the browser remains confidential and unalterable. SSL is an industry standard and is used by millions of websites to protect their customers' online transactions.

Lemontaps relies on Amazon Web Services (AWS) services in Frankfurt, Germany (https://aws.amazon.com/de/compliance/gdpr-center/) to host the software. The data centers used are ISO/IEC 27001 certified and thus meet our high requirements for the physical security of our customers' data. When selecting external service providers that are necessary for the operation of the software (e.g. mail dispatch), the hosting of the data within the EU is a mandatory basic criterion.

The customer is "master of the data" both in the contractual relationship and in the sense of data protection law. He is the sole authorized party with regard to the power of disposal of all data used by him (data entered, data processed, data stored, data output). This also means, in particular, that the customer is responsible for safeguarding the rights of data subjects (Chapter 3 EU-GDPR). Lemontaps is a processor and thus processes your data exclusively on your instructions and for the purposes regulated in the contract for commissioned processing. Specifically, this means that Lemontaps will not sell or share data with third parties under any circumstances. This does not include the transfer of data to subcontractors, which is regulated in the contract for data processing with our customers. Furthermore, Lemontaps reserves the right to use completely anonymized data, e.g. for the purpose of testing or further development of the product. Such anonymization will only take place within the framework of the legal provisions and will take into account the state of the art as well as the recommendations of the Article 29 Working Party and the European Data Protection Board. Anonymized data means that no conclusions can be drawn about Lemontaps or companies. This means that there is no risk to our customers. Lemontaps takes special care to protect the privacy of the customer. Lemontaps complies with all requirements of the EU General Data Protection Regulation and is data protection compliant as an organization as well as software according to EU-GDPR.

Upon termination of the business relationship, persons authorized to issue instructions to the customer may request the release of the data. Subsequently, the data will be irretrievably deleted after expiration of the contractually defined period. In principle, in the unlikely event that Lemontaps ceases business operations, there will be no deviation from this, as the customer is "master of the data" and Lemontaps is merely a processor and thus cannot/will not otherwise dispose of the personal data.

Lemontaps' infrastructure enables daily backups and recovery options.

In the unlikely event of a total system failure, the redundant design of the data centers (productive and backup data) ensures that your data is not lost. In this case, we will ensure the fastest possible recovery in accordance with our emergency plan/disaster recovery concept.