Digital business card with data protection made in Germany 

Data privacy training is part of Lemontaps' mandatory onboarding process. All Lemontaps employees are committed to confidentiality or compliance with data protection and are familiarized with the consequences in the event of violations. In addition, the company conducts regular training and awareness-raising measures on the handling of personal data, the GDPR, and legal innovations.

Yes, both our customers as the controller and we as the processor are obliged to conclude a corresponding contract in accordance with Art. 28 EU-DSGVO. We will gladly send you our template upon request.

If, contrary to expectations, a data breach occurs at Lemontaps involving a customer's personal data and the breach is likely to result in a risk to the rights and freedoms of the customer's employees, Lemontaps will promptly notify the affected customer in accordance with its legal and contractual obligations so that it can comply with its legal notification obligations to the supervisory authority and the data subjects.

As a European company, data protection and compliance with the GDPR are central components of our product strategy. That is why we already pay attention to principles such as data economy and the use of state-of-the-art measures to ensure an appropriate level of protection when developing our features. To ensure this on a permanent basis, we have also defined a process that continuously incorporates the legal requirements into the product development process and reviews the application at regular intervals.

Lemontaps meets the requirements of the EU General Data Protection Regulation and is data protection compliant as an organization as well as software according to EU-DSGVO. To this end, we have checked our product from the outset for the essential legal requirements such as data protection through technology design and through data protection-friendly default settings (Art. 25 EU GDPR) or also the support of the customer in safeguarding data subject rights such as the right to erasure, the right to information or the right to data portability (Chapter 3 EU GDPR) and have made appropriate adjustments.

Yes, for all communication between users and our servers HTTPS is enforced with SSL certificates that are renewed every 3 months. SSL (Secure Sockets Layer) is the standard security technology for establishing an encrypted connection between a web server and a browser. This connection ensures that all data transferred between the web server and the browser remains confidential and unalterable. SSL is an industry standard and is used by millions of websites to protect their customers' online transactions.

Lemontaps relies on Amazon Web Services (AWS) services in Frankfurt, Germany (https://aws.amazon.com/de/compliance/gdpr-center/) to host the software. The data centers used are ISO/IEC 27001 certified and thus meet our high requirements for the physical security of our customers' data. When selecting external service providers that are necessary for the operation of the software (e.g. mail dispatch), the hosting of the data within the EU is a mandatory basic criterion.

In principle, neither employees in the data centers nor at AWS have access to your data. The assignment of access rights is logged and based on the "need-to-know" principle. On the Lemontaps side, only our engineering team (server side) as well as our product managers and the employees of the Customer Success Team (customer system side) have access on an ad hoc basis. This is necessary to support the initial setup of the account as well as the processing of service requests.

Accesses are made exclusively via personalized user accounts that are uniquely assigned to a person. The login is done with an email address and a password, which must be set at initial login according to the secure password policy implemented in the application. In addition, we use a highly secure authorization and access platform, which is also used by companies such as Siemens, Pfizer and Zalando, to make login/registration secure and to detect anomalies.

In principle, the access rights are designed in such a way that the requirements of Art. 24 EU-DSGVO for data protection-friendly default settings are met. This means that newly created employees "by default" have no rights beyond editing their own profile. However, you as a customer are able to assign rights individually based on your own authorization concept or to edit the profiles centrally as an administrator.

The customer is "master of the data" both in the contractual relationship and in the sense of data protection law. He is the sole authorized party with regard to the power of disposal of all data used by him (data entered, data processed, data stored, data output). This also means, in particular, that the customer is responsible for safeguarding the rights of data subjects (Chapter 3 EU-DSGVO). Lemontaps is a processor and thus processes your data exclusively on your instructions and for the purposes regulated in the contract for commissioned processing. Specifically, this means that Lemontaps will not sell or share data with third parties under any circumstances. This does not include the transfer of data to subcontractors, which is regulated in the contract for order processing with our customers. Furthermore, Lemontaps reserves the right to use completely anonymized data, e.g. for the purpose of testing or further development of the product. Such anonymization will only take place within the framework of the legal provisions and will take into account the state of the art as well as the recommendations of the Article 29 Working Party and the European Data Protection Board. Anonymized data means that no conclusions can be drawn about Lemontaps or companies. This means that there is no risk to our customers. Lemontaps takes special care to protect the privacy of the customer. Lemontaps complies with all requirements of the EU General Data Protection Regulation and is data protection compliant as an organization as well as software according to EU-DSGVO.

Upon termination of the business relationship, persons authorized by the customer to issue instructions may request the surrender of the data. Subsequently, the data will be irretrievably deleted upon expiration of the contractually defined period. In principle, in the unlikely event that Lemontaps ceases business operations, there will be no deviation from this, as the customer is "master of the data" and Lemontaps is merely a processor and thus cannot/will not otherwise dispose of the personal data.

We create backups of our database and store them securely in our AWS cloud infrastructure. If a restore from a backup is required, our lead engineers can access it.

In the unlikely event of a total system failure, the redundant design of the data centers (productive and backup data) ensures that your data is not lost. In this case, we will ensure the fastest possible recovery in accordance with our emergency plan/disaster recovery concept.