Privacy Policy

Patalyze GmbH (“Patalyze”) operates patalyze.com (the “Site”). This page informs the individual who accesses the Site (“Visitor”) how Patalyze’s services collect, use and disclose personal information.

Patalyze only uses Visitor’s personal data within the scope of legal regulations, in particular the General Data Protection Regulation (“GDPR”) and the German Federal Data Protection Act (“BDSG”). With this privacy policy, Patalyze informs Visitor, regardless of whether Visitor has set up a user account, uses Patalyze’s Services or visits Patalyze’s website, about the nature, scope and purposes of the collection, use and processing of personal data by Patalyze.

1. Data Controller#

The data controller responsible for data processing pursuant to the GDPR, BDSG, other data protection laws applicable in the member states of the European Union, and other regulations relating to data protection is:

Patalyze GmbH, Stadionstraße 6, 85716 Unterschleißheim, Germany

If Visitor has any questions or concerns about privacy, please contact info@patalyze.com. For the conclusion of a data processing agreement pursuant to Art. 28 GDPR (see section 5) and for general questions about Patalyze’s Services, please contact info@patalyze.com. Further information on the data processing when contacting Patalyze can be found in section 9.

2. Scope of Data Protection#

Data protection applies to personal data as defined by the GDPR, i.e. all information relating to an identified or identifiable natural person. An identifiable natural person is deemed to be a natural person who can be identified directly or indirectly, in particular by means of assignment to an identifier such as a name, an identification number, location data, an online identifier or to one or more specific attributes.

3. Using Patalyze’s Services#

When Visitor is logged into a Patalyze account, Patalyze’s Terms and Conditions apply.

According to its Terms and Conditions, Visitor may not process personal data in connection with Patalyze’s Services without the data subject’s consent or another sufficient legal basis. Records made available through the Services, such as patents and court and legal documents, may contain personal data. For example, patents contain inventor, applicant and assignee names, and court and legal documents may contain the names of parties and other individuals. Visitor is responsible as controller for any personal data it introduces or processes through the Services.

4. Account#

Visitor needs to create a Patalyze account for becoming a user of Patalyze (“User”). To create the account, the following personal data will be stored:

• Email address
• One-time sign-in codes sent by email (stored in hashed form until they expire after ten minutes)
• IP address
• Device identifiers
• Operating system
• Referrer URL
• First name, surname, and company name / organization name
• Possibly other, additional data Visitor provided during the registration process

Patalyze processes the email address, sign-in codes, first name, surname, company name, and possibly other, additional data Visitor provided during the registration process on the basis of Art. 6 para. 1 sentence 1 lit. b) GDPR to perform the contract of use. Visitor’s IP address, operating system, device identifiers, and referrer URL are processed in accordance with Art. 6 para. 1 sentence 1 lit. f) GDPR, as it is in Patalyze’s legitimate interests to match Visitor’s IP address, operating system, device identifiers, and referrer URL with data from other Visitors that have misused Patalyze’s service in the past for fraud prevention purposes.

Creating a Patalyze account is a prerequisite for using Patalyze Services but does not oblige Visitor to purchase a paid offering. User can request deletion of the Patalyze account at any time by email to info@patalyze.com. An Organization can be deleted by its owner in the settings. Deletion takes effect after a confirmation period of twenty-four hours.

If Visitor uses Single Sign-On (SSO) to log in to Patalyze (via Google or Apple), there is no need for a separate registration with Patalyze. During the Single Sign-On, the Visitor allows Patalyze to store Visitor’s email address, first and last name, profile picture, and unique identifier from the SSO provider. Where Visitor uses Apple’s Hide My Email, Patalyze receives the relay address Apple provides. Patalyze processes this data on the basis of Art. 6 para. 1 sentence 1 lit. b) GDPR.

Upon purchase of any paid offerings, Patalyze additionally collects the following personal data in accordance with Art. 6 para. 1 sentence 1 lit. b) GDPR:

• Email address
• Name
• Address
• Payment details such as credit card or SEPA direct debit (bank account / mandate) information
• Tax information (if applicable)
• Possibly other, additional data User provided during the payment process.

To process payments, Patalyze forwards the necessary payment data to Patalyze’s authorized payment service provider Stripe Payments Europe Ltd., Block 4, Harcourt Centre, Harcourt Road, Dublin 2, Ireland (“Stripe”). Where necessary, Stripe will transfer the data to Stripe, Inc., located in the USA. Further information on data protection at Stripe and compliance with the requirements of Art. 44 GDPR can be found in the Stripe Privacy Policy and the Stripe Privacy Center. Patalyze has concluded a data processing agreement with Stripe, which allows Stripe to process the data solely in accordance with Patalyze’s instructions and not for its own purposes. Receipts and invoices are sent by Stripe.

In addition to the aforementioned data, Patalyze processes further (usage-)data relevant for the provision and billing of Services, such as the AI & Data Usage consumed by Research Agent runs, Data API requests, product searches, web searches, browser sessions and document processing, each recorded individually with the amount consumed, the model used where applicable and the User who initiated it. The processing and storage of the aforementioned data is necessary for the conclusion of the contract as well as its performance and is therefore justified according to Art. 6 para. 1 sentence 1 lit. b) GDPR. If User themselves is not a party to the contract, but Patalyze is provided to User, e.g. by employer or an Organization to which they belong, Patalyze justifies the processing of the data mentioned in section 4 and the aforementioned usage data via Art. 6 para. 1 sentence 1 lit. f) GDPR, as this is necessary for the performance of the business relationship with Patalyze’s customers, i.e. User’s employer or User’s Organization.

Patalyze stores the data for the duration of the contract term and subsequently, if applicable, for the duration of statutory retention periods, insofar as these prescribe the retention for the respective types of data. Patalyze will delete User’s account if requested to do so. Otherwise, Patalyze will maintain User’s account so that it is available to Users in the event of a renewed use without the User having to register again. This is in User’s as well as in Patalyze’s legitimate interests pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR. Patalyze may delete an Organization that has been inactive for more than a year after advance notice (Section 10.6 of the Terms and Conditions).

In the settings under “Usage”, Users can also view data about usage behavior e.g. the Number of Records, the value of AI & Data Usage consumed and the AI & Data Usage Balance purchased. Patalyze justifies this data processing via Art. 6 para. 1 sentence 1 lit. b) GDPR, insofar as it is necessary for the performance of the contract, in particular for billing purposes or for managing the remaining AI & Data Usage Balance. Insofar as the processing goes beyond what is necessary for the performance of the contract, Patalyze bases the processing on Patalyze’s legitimate interests pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR, as Patalyze seeks to meet Users’ wish to visualize information on usage behavior in a transparent manner. The graphical representation of the development of consumption over the contract period is considered to be also in the interest of Users.

If User’s access to Patalyze Services is provided by the User’s employer or an organization to which User belongs, it is possible that Patalyze shares data about User’s usage (e.g. the value of AI & Data Usage consumed, Number of Records, last login date) with User’s employer or organization on request. Providing this data corresponds to Patalyze’s legitimate interests as well as the legitimate interests of Organization in receiving information about the use of the Services Organization has paid for.

5. Processing of Organization Content#

Patalyze processes Organization Content (Input and Output) on behalf of the Organization that holds the account, as processor within the meaning of Art. 4 no. 8 and Art. 28 GDPR, under the data processing agreement that forms part of the Terms and Conditions. The Organization is the controller for the personal data contained in Organization Content, and Patalyze processes it only on the Organization’s documented instructions to provide the Services described in the Service Specification, using the sub-processors listed in the data processing agreement. Patalyze is itself the controller for account, billing, security and usage data (sections 4, 7 and 8).

To provide the AI-based Services, Patalyze transmits Organization Content to the model selected by the Organization for AI processing on the Organization’s behalf. All models Patalyze provides are hosted within the European Union, and none of the providers hosting them uses Organization Content to train models. This does not apply to model providers that Organization supplies itself (Section 3.1 of the Service Specification), to which Organization Content is transmitted directly from the User’s browser or device. Where a User keeps a Database on their device (local storage mode, Section 2.7 of the Service Specification), the content of that Database is not transmitted to Patalyze, except for the requests listed there: requests to models Patalyze provides, search and embedding requests, web and product searches, hosted browser sessions on the website, and emails the Research Agent sends. Patalyze does not store the content of model requests and responses. It records the usage (model, token counts, time, User). Organization Content is deleted upon deletion of the relevant Record, Database or Organization, or after the retrieval period under Section 10.8 of the Terms and Conditions, subject to statutory retention periods and Patalyze’s log-retention practices.

6. Storage of Data When Using Services#

When using Patalyze’s Services, section 3 of this privacy policy applies. The following data is stored for each Database:

• Records (such as products, patents, scientific papers, technical standards, court and legal documents and Custom Objects)
• Number of Records
• Mappings between Records
• Attributes
• Table, dashboard and note pages
• Research Agent conversations and summaries of runs (on the device for local Databases)
• Status/progress of Research Agent runs
• Errors that occurred during Research Agent runs

The following data is stored for each User or Organization:

• Memories written by the Research Agent (Section 2.1 of the Service Specification), which can contain information about a User’s preferences and working context. A memory is stored for the User who created it within one Organization and is visible only to that User, who can view, edit and delete it in the settings. In local storage mode memories are stored on the device instead
• Skills and connectors the User configures, including the access credentials and tokens of external tools the User connects
• Usage records (section 4)
• Notification preferences and other settings

Keys for model providers that Organization supplies are stored on the User’s device only (browser storage or the operating system’s keychain) and are not transmitted to Patalyze.

Records, mappings, attributes and pages are processed on behalf of the Organization (section 5). Status, progress and error records of Research Agent runs are processed on the basis of Patalyze’s legitimate interest (Art. 6 para. 1 sentence 1 lit. f) GDPR) in identifying sources of error in the Services (such as generating mappings or writing pages). This data is retained for the duration of the contract and deleted when the corresponding Record, Database or Organization is deleted. Access is limited to authorized personnel.

Patalyze maintains a security and compliance audit log recording administrative and security-relevant actions (such as the acting user, the action, the affected resource and the time). This audit log, and any records Patalyze must keep under statutory retention obligations (for example under commercial and tax law), are retained on the basis of Art. 6 para. 1 lit. c) and f) GDPR and Art. 17 para. 3 GDPR.

7. Automatic Collection of Data via Website Access#

Regardless of whether visitors have an account registered with Patalyze, devices automatically transmit certain data for technical reasons when accessing Patalyze’s website patalyze.com. The following data that Visitor may send will be stored:

• Date and time of access
• Browser type and version
• Operating system
• URL of the website previously visited
• Volume of data transmitted
• Requested domain
• Notification of successful data retrieval
• Abbreviated/anonymized IP
• Full IP address
• Diagnostic information in the event of errors

Processing is carried out in accordance with Art. 6 para. 1 sentence 1 lit. f) GDPR based on Patalyze’s legitimate interest in improving the stability and functionality of Patalyze’s website. The data is stored for purely technical reasons. Website access data is used for error analysis, ensuring system security, logging access to Patalyze and for improving Patalyze’s Services. Based on visitor’s IP address, Patalyze uses geolocation to determine the region from which visitors are visiting Patalyze’s website. Patalyze uses this information to check whether Patalyze can offer Service in visitor’s region, which corresponds to Patalyze’s legitimate interests pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR. IP addresses are processed on the basis of Art. 6 para. 1 sentence 1 lit. f) GDPR for system security and fraud prevention and are deleted or anonymized as soon as they are no longer required for those purposes, at the latest when the contract ends, unless an incident requires longer retention.

Patalyze’s website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA (“Vercel”), whose edge network delivers the pages and protects the contact forms against abuse by rate limiting. Vercel Web Analytics and Vercel Speed Insights measure page views and loading performance without cookies or device storage, using an anonymized visitor hash that is discarded daily. This is based on Patalyze’s legitimate interest in the stability and performance of the website, Art. 6 para. 1 sentence 1 lit. f) GDPR. The service-status badge shown on the website is loaded from BetterStack (status.patalyze.com), which receives Visitor’s IP address and browser metadata when a page showing the badge is displayed (Art. 6 para. 1 sentence 1 lit. f) GDPR, Patalyze’s interest in showing current service availability).

Patalyze’s API and Data API hosts (api.patalyze.com, data.patalyze.com) are routed through the network of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (“Cloudflare”), which analyzes connection metadata (such as the IP address) to detect and block abusive traffic and may set the bot-protection cookie listed in section 8. Requests are encrypted in transit, so Cloudflare processes connection metadata rather than content. Separately, Patalyze stores certain data at rest with Cloudflare’s R2 object storage (exported patent Records, organization logos and user profile pictures) and with Google Cloud Storage (uploaded documents and their extracted text, product and page media, screenshots and PDFs captured by browser sessions, skills and bug-report screenshots). The use of these providers is in Patalyze’s legitimate interest to secure and operate the Services, Art. 6 para. 1 sentence 1 lit. f) GDPR. Patalyze has concluded data processing agreements with Vercel, Cloudflare and Google, which may therefore only process the data according to Patalyze’s instructions and not for their own purposes. Visitor can find more information in Vercel’s Privacy Policy and Cloudflare’s Privacy Policy.

The Desktop App contains no analytics or crash reporting. It checks for updates by requesting the current version manifest from Patalyze’s release server. That request contains the operating system and processor architecture and, for technical reasons, the device’s IP address.

8. Use of Cookies and Other Storage Technologies#

Patalyze uses cookies, web storage objects and other storage technologies to provide Visitor with a variety of features and improve Visitor’s experience. If Visitors do not want Patalyze to use such technologies, Visitors can change the browser settings accordingly. If Visitors completely disable the use of cookies, web storage objects and other technologies, the functionality and scope of the website may be impaired.

Patalyze specifically uses cookies or web storage objects in the following categories:

• Necessary: These cookies or web storage objects are necessary for Patalyze’s website to work properly, to enable smooth navigation and access Patalyze’s most important functions. This includes essential security and accessibility features and preferences such as interface language as well as the handling of the checkout process for Patalyze. The collecting of data via the necessary cookies or web storage objects is justified according to § 25 para. 2 no. 2 TDDDG (“Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz”: German Telecommunications Digital Services Data Protection Act). The further processing of this data is either necessary in accordance with Art. 6 para. 1 sentence 1 lit. b) GDPR for performing the contract or justified due to Patalyze’s legitimate interest in presenting Patalyze’s Services and Patalyze in accordance with Art. 6 para. 1 sentence 1 lit. f) GDPR.
• Performance: These cookies or web storage objects measure how Patalyze’s site is used. Patalyze uses this information to improve its website and services. With these cookies Patalyze measures, for example, how often Visitor returns and which functions they use. Patalyze and its external service providers use these cookies or web storage objects with Visitor’s explicit consent in accordance with § 25 para. 1 TDDDG. The further processing of this data is also based on Visitor’s consent, Art. 6 para. 1 sentence 1 lit. a) GDPR.

The table below lists the different types of technologies that may be used on Patalyze’s website. Cookies or web storage objects are stored until the specified expiration time or until Visitor deletes them in Visitor’s browser or, if it is a session cookie, until the session has expired. Patalyze’s cookie banner offers a binary choice: Visitor can accept or decline non-essential cookies, which controls only the analytics cookies and web storage of PostHog. Visitor can change this choice at any time in the cookie banner.

To better understand how Patalyze’s Services are used and to better tailor Patalyze’s Services to the needs and desires of Patalyze’s customers, Patalyze analyzes pseudonymized data about the customers’ use of Patalyze Services. The analysis allows Patalyze to understand general usage habits and derive different target and user groups. Patalyze can then address the identified user groups in a more specific way and, for example, point them to previously unused or unknown features of Patalyze Services. In this way, Patalyze enables customers to get to know and use all the features of Patalyze and can thus improve the user experience of the Patalyze Services. This corresponds to Patalyze’s legitimate interests according to Art. 6 para. 1 p. 1 lit. f) GDPR.

9. Contacting Patalyze’s Sales or Support Team#

Visitors have the possibility to contact Patalyze via various contact forms on Patalyze’s website. Visitors can also contact Patalyze directly by email via info@patalyze.com. Visitor can send support inquiries via patalyze.com/support and sales inquiries via patalyze.com/sales.

For both support and sales inquiries including any subsequent correspondence, Art. 6 para. 1 sentence 1 lit. b) GDPR serves as the legal basis for the processing of Visitor’s personal data, as the processing is necessary for the initiation of the contract or the conclusion and performance of Patalyze’s contract. Art. 6 para. 1 sentence 1 lit. b) GDPR also provides justification for the processing of personal data that may be contained in documents sent to Patalyze’s support team. Patalyze will store Visitor’s data for the duration of Patalyze’s business relationship and subsequently for the duration of the legal retention periods where this is required. The processing of Visitor’s personal data as part of Patalyze’s customer database and the analyses of Patalyze’s customer-related processes is based on Art. 6 para. 1 sentence 1 lit. f) GDPR, as this is in Patalyze’s legitimate interest.

Visitors can book a demo through the scheduling tool of Cal.com, Inc., embedded on the website. The data entered when booking (name, email address, chosen time and any notes) is processed by Cal.com on Patalyze’s behalf under a data processing agreement, on the basis of Art. 6 para. 1 sentence 1 lit. b) GDPR. Loading the booking widget transmits Visitor’s IP address to Cal.com. Further information can be found in Cal.com’s Privacy Policy.

Visitors also have the option of contacting info@patalyze.com with questions or concerns about data protection at Patalyze. Patalyze processes Visitor’s data in accordance with Art. 6 para. 1 sentence 1 lit. c) GDPR in conjunction with Arts. 12 to 22 GDPR in order to handle the request.

10. Service Providers#

Patalyze may share your personal information with the third-parties listed below for the purposes that are described in this Privacy Policy or otherwise with Visitor’s consent.

Patalyze only shares Visitor’s personal information with those of its employees, contractors, and affiliated organizations that (i) need to know that personal information in order to process it on Patalyze’s behalf or to provide services available on the Site, and (ii) that have agreed not to disclose it to others.

Patalyze engages a number of service providers or partners to manage or support certain aspects of its business operations on Visitor’s behalf. Patalyze uses the following service providers who will handle Visitor’s personal information:

• Apple: Single sign-on authentication
• BetterStack: Status page and status badge (status.patalyze.com)
• Browserbase: Browser sessions
• Cal.com: Demo scheduling
• Cloudflare: Network security for the API hosts and object storage
• Convex: Application backend and database hosting
• Dub.co: External Link Management
• Exa: Web and product search
• Google Cloud Platform: Object storage & AI processing of submitted content
• Google Workspace: Internal Collaboration Tools
• Hetzner: Cloud data hosting
• Lyceum Technology Germany GmbH: AI processing of submitted content
• Microsoft Azure: AI processing of submitted content
• Notion: Internal Collaboration Tools
• PostHog: Analytics & Error Tracking
• Resend: Email Server
• Stripe: Payment processing
• Vercel: Website hosting, web analytics and performance measurement

Patalyze service providers and partners are required by contract to safeguard any personal information they receive from Patalyze and are prohibited from using the personal information for any purpose other than to perform the services as instructed by Patalyze.

11. Newsletter#

Patalyze may send Users who have purchased a paid offering information about similar Services by email under § 7 para. 3 of the German Act against Unfair Competition (UWG), provided they were informed of their right to object when their address was collected and have not objected. Given the existing contractual relationship, it is also in Patalyze’s legitimate interest to inform such Users as set out above (Art. 6 para. 1 sentence 1 lit. f) GDPR). All other marketing emails, including the Patalyze Newsletter with news on Patalyze’s Services, offers, promotions and marketing campaigns, are sent only with Visitor’s consent (Art. 6 para. 1 sentence 1 lit. a) GDPR, § 7 para. 2 no. 2 UWG). Recipients can object or withdraw consent at any time with effect for the future via the unsubscribe link at the end of each email or by sending an email to info@patalyze.com.

Upon signing up to the Newsletter, Patalyze will forward Visitor’s email to Patalyze’s authorized service provider Plus Five Five, Inc., 2261 Market Street #5039 San Francisco, CA 94114 (“Resend”).

12. Service and Notification Emails#

Patalyze sends emails that are necessary to provide the Services: one-time sign-in codes, invitations, welcome messages, confirmations of support and sales inquiries, confirmations for the deletion of an Organization and the transfer of its ownership, security notices, reports and questions the Research Agent sends at a User’s direction or when a run is waiting for the User’s answer, and product-update notices. These emails are sent through Resend (section 10) on the basis of Art. 6 para. 1 sentence 1 lit. b) GDPR and, for product-update notices and for reports sent to other Users of an Organization, lit. f) GDPR. Users control agent reports, agent questions and product-update emails in their notification settings. Sign-in, invitation, security and confirmation emails cannot be disabled while the account exists. Receipts and invoices are sent by Stripe (section 4).

13. Social Media Profiles#

Patalyze operates several social media profiles (“Social Media Profiles”) on various social networks e.g., LinkedIn. Patalyze regularly publishes posts about its Services, new Service features as well as new job offers. If Visitor interacts with Patalyze’s pages or contacts Patalyze via them and Visitor is a member of the respective social network, Patalyze may receive and process data that identify Visitor. As operator of the Social Media Profiles, Patalyze also has the option of viewing anonymous statistics on the interaction of Visitor with Patalyze’s pages (insight function). For this purpose, the operators of the social networks record Visitor’s interactions with Patalyze’s pages using cookies and similar technologies. Visitor can find more information on this kind of data processing on the LinkedIn Privacy Policy.

The legal basis for the operation of Social Media Profiles and the insights function is Patalyze’s legitimate interest within the meaning of Art. 6 para. 1 sentence 1 lit. f) GDPR in using the Social Media Profiles as an information channel. With regard to the insights function, Patalyze has a legitimate interest in understanding the visits and interactions with Social Media Profiles in order to be able to respond to them and to further improve Patalyze’s presence. Insofar as Visitor’s consent given to the social network justifies the data processing within the framework of the respective social platform, processing is carried out on the basis of this consent.

Patalyze together with the operator of the respective social network are jointly responsible for the data processing operations triggered when Visitor accesses the Social Media Profile. The essence of this joint-controller arrangement, in particular the allocation of responsibilities and the point of contact for exercising data-subject rights, is set out in the respective network’s joint-controller addendum (for LinkedIn, the LinkedIn Page Insights Joint Controller Addendum). In summary, Patalyze is responsible for its own posts and its use of the aggregate page-insights statistics, while the network operator is responsible for the platform’s own processing and is the primary contact for data-subject rights regarding that processing. However, the operators of the social networks may also process Visitor’s data for their own purposes, which are not depicted in this privacy policy. It is also possible that data collected about Visitor will be transferred to third countries, in particular the USA. Patalyze has no influence on this data processing and refers to the privacy policies of the respective social networks.

14. Webinars#

Patalyze may offer video-based interactive events on the Services Patalyze offers (“Webinars”). Visitor and User can participate in the Webinars (“Participant”). Patalyze uses video conferencing services provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), on whose platform the webinars are held. Patalyze has concluded a data processing agreement with Google and Google may only process personal data according to Patalyze’s instructions and not for its own purposes.

Patalyze collects the following personal information from Participants before or during the Webinar:

• User information (First name, last name, display name, email address, profile picture).
• Communication data (Data that the Participant independently enters, uploads or shares as part of the webinar).
• Meeting metadata and telemetry data (This technical data is, among other things, data relating to the use of the service, including when and how sessions were conducted (IP address, event logs, session information, etc.), as well as device and hardware information that Google needs to access in order for features such as camera, microphone, etc. to be operational in the context of participation).

Patalyze may record webinars and publish them afterwards on the Site or Social Media Profiles. Visitors will not be visible or identifiable in these recordings. As participants can only ask written questions, they will not appear visually in the recording. The answer to the participant’s question will be part of the webinar recording. If, contrary to expectations, personal data of the participants is visible during the recording, it will be made unrecognizable before publication. The recording and storage of the webinar is based on Art. 6 para. 1 sentence 1 lit. f) GDPR, as these processing operations are in Patalyze’s legitimate interest to improve the quality of Patalyze’s webinars. When the webinars are published, no further processing of personal data will take place, as Patalyze will make them unrecognizable beforehand, if they can be viewed at all.

15. Job Applications#

Patalyze offers Visitor the opportunity to apply for a position at Patalyze in response to a job posting, by email. This digital recruitment process means that in order to complete the application procedure, Visitor’s application data (usually name, contact information, cover letter, resume, as well as other supporting documents and credentials) is collected and processed electronically. The personal data Visitor provides will be used exclusively for processing Visitor’s job application. Visitor’s data will only be shared with persons involved in the application process. If Visitor submits Visitor’s documents in German only, even though an English version of the documents was requested in the job advertisement, Patalyze reserves the right to translate Visitor’s documents into English. The legal basis for the processing of Visitor’s applicant data is Art. 6 para. 1 sentence 1 lit. b) and Art. 88 para. 1 GDPR and, to the extent applicable, § 26 para. 1, 8 sentence 2 BDSG (“Bundesdatenschutzgesetz”: German Federal Data Protection Act). If Visitor applies for a freelance job at Patalyze, the legal basis for the processing of Visitor’s applicant data is Art. 6 para. 1 sentence 1 lit. b) GDPR.

If, following the recruitment process, an employment contract is concluded, Patalyze will store Visitor’s personal data as part of Visitor’s personnel file for the purpose of standard organizational and administrative procedures, in compliance with the more extensive legal obligations. In this case, the legal basis for the processing of Visitor’s data is Art. 6 para. 1 sentence 1 lit. b) and Art. 88 para. 1 GDPR and, to the extent applicable, § 26 para. 1 BDSG. When working on a freelance basis for Patalyze, Patalyze will store Visitor’s personal data for the purpose of executing Visitor’s contract with us. In this case, the legal basis for the processing of Visitor’s data is Art. 6 para. 1 sentence 1 lit. b) GDPR.

In the event of a rejection on Visitor’s part or ours, Patalyze will retain the data submitted to Patalyze for up to a maximum of six months following notification of the rejection. Patalyze will subsequently delete the data unless legal regulations require Patalyze to store the data for a longer period.

If Visitor expressly agrees to a longer storage period of Visitor’s data e.g., for Visitor’s inclusion in Patalyze’s internal applicant pool, the data will be further processed based on Visitor’s consent in accordance with Art. 6. para. 1 sentence 1 lit. a) GDPR. Visitor’s data will then be stored in Patalyze’s pool of applicants for 1000 days. Visitor can withdraw Visitor’s consent at any time with effect for the future.

16. Data Security#

Visitor’s connections to Patalyze’s website and Patalyze’s apps are protected with encryption techniques in line with the current state of the art. The level of protection also depends on which encryption Visitor’s Internet browser and/or mobile device supports. Visitor can tell whether an individual page of Patalyze’s website is transmitted in encrypted form by looking at the closed key or lock symbol in the status bar of Visitor’s browser. Patalyze also uses suitable technical and organizational security measures to protect Visitor’s data against accidental or intentional manipulation, partial or complete loss, destruction or unauthorized access by third parties. Patalyze’s security measures are continuously improved in line with technological developments.

17. Visitor’s Rights#

The following rights are granted by the GDPR. If Visitor wishes to exercise any of the rights listed below, Visitor can contact Patalyze at patalyze.com/support.

• Right to confirmation and right of access
• Right to rectification
• Right to erasure
• Right to restriction of processing
• Right to object (Art. 21 GDPR)
• Right to withdraw Visitor’s consent
• Right to data portability: the right to receive the personal data Visitor provided in a structured, commonly used and machine-readable format and to have it transmitted to another controller where technically feasible (Art. 20 GDPR)

The right to erasure does not apply to the extent processing is necessary to comply with a legal retention obligation or for the establishment, exercise or defense of legal claims (Art. 17 para. 3 GDPR). In such cases Patalyze restricts the relevant data instead of deleting it and deletes it once the applicable retention period has ended (see section 6).

In addition, Visitor can object to the further processing of Visitor’s data if Patalyze processes Visitor’s data based on Patalyze’s legitimate interest (Art. 6 para. 1 sentence 1 lit. f), Art. 21 GDPR). If Patalyze processes Visitor’s data for the purpose of direct advertising, Visitors have a general right to object. If Patalyze does not process Visitor’s data for advertising purposes, the objection must be based on Visitor’s particular situation.

Visitors also have the right to lodge a complaint regarding the processing of Visitor’s personal data with a supervisory authority, such as the data protection supervisory authority responsible for Patalyze: Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, email: poststelle@lda.bayern.de.

18. Changes to the Privacy Policy#

Patalyze reserves the right to amend this privacy policy. The current version of the privacy policy can be accessed at any time on Patalyze’s website.