Privacy Policy

1. Privacy at a Glance

What this privacy policy covers

This privacy policy explains what happens to your personal data in three situations:

when you visit this website (trusq.de) or contact us through it (section 4);
when you have an account on the Trusq platform (app.trusq.de) (section 5);
when you write to a business that uses Trusq to handle its customer messages (section 6). In that case the business is responsible for your data, and we process it only on the business's behalf.

Personal data is any data with which you can be personally identified.

Who is responsible

Trusq GmbH, Nürnberg, operates this website and the Trusq platform. You find our contact details in the section "Controller". For messages you send to a business that uses Trusq, that business is responsible; see section 6.

How we collect your data

Some data you give us yourself, for example in the contact form, when you register, or in a message. Other data our systems record automatically when you use them: the browser, the operating system, the time of the request and the IP address. This technical data is kept in server logs for a short time.

What we use your data for

We use your data to run this website and the platform without errors, to answer your enquiries, to conclude and perform contracts, and to bill our customers. We do not analyse your behaviour on this website, we do not use advertising tools, and we do not sell data.

What rights you have

You have the right to receive information free of charge about the origin, recipients and purpose of your stored personal data. You can request the correction or deletion of this data, the restriction of its processing, and a copy in a machine-readable format. If you have given consent, you can withdraw it at any time with effect for the future. You can lodge a complaint with the supervisory authority. Section 3 explains these rights and how to exercise them.

Cookies and tracking

This website does not show a cookie banner because it does not need one. The website sets no cookies, loads no scripts, fonts or images from third parties, and uses no analytics or advertising tools. The Trusq platform sets one cookie after you log in: the session cookie that keeps you logged in. It is strictly necessary for the service you asked for and therefore needs no consent (section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG). Details are in section 5.

2. Hosting and Infrastructure

Hetzner

All our systems run in data centres of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany ("Hetzner"): this website, the Trusq platform (app.trusq.de, api.trusq.de), its database, the storage for file attachments and invoices, the backups, and our own mail servers. The data centres are in Falkenstein and Nuremberg, Germany. Hetzner's privacy policy: https://www.hetzner.com/legal/privacy-policy/

Hetzner has access to the servers only as far as operating them requires. We have concluded a data processing agreement with Hetzner (Art. 28 GDPR), which obliges Hetzner to process the personal data of our visitors and customers only on our instructions and in compliance with the GDPR. Hosting does not transfer personal data to countries outside the European Union. Encrypted backups of our system configuration, which contain no personal data, may be stored in other Hetzner data centres within the European Union.

The use of Hetzner for this website is based on Art. 6(1)(f) GDPR: we have a legitimate interest in a reliable and secure presentation of our website. For the Trusq platform it is based on Art. 6(1)(b) GDPR, as the platform is the service we provide under contract.

3. General Information and Mandatory Disclosures

Data protection

We take the protection of your personal data seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy. Data transmission over the internet, for example by email, can have security gaps; complete protection of data against access by third parties is not possible.

Controller

The controller for the processing described in this privacy policy, except where section 6 says otherwise, is:

Trusq GmbH
Lohestraße 31
90425 Nürnberg
Germany

Phone: +49 1522 8994275
Email: privacy@trusq.de

Commercial register: Amtsgericht Nürnberg, HRB 46174. Managing directors: Orestis Madianos, Stefan Döllner.

The controller is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data.

Storage duration

We store personal data only for as long as the purpose for which we collected it requires, or for as long as the law obliges us to keep it. When the purpose ceases and no retention obligation applies, we delete the data. The periods are:

Enquiries through the contact form, by email, telephone or WhatsApp: until the enquiry has been dealt with and for at most twelve months after that, unless a contract follows or a retention obligation applies.
Record of consent given in the contact form (time, IP address, version of this privacy policy): for as long as the enquiry it belongs to.
Account data of Trusq customers: for the term of the contract. We delete the workspace with all its data no earlier than 30 and no later than 60 days after the contract ends, as agreed in our Terms and Conditions.
Invoices and accounting records: for the statutory retention period under commercial and tax law (section 257 of the German Commercial Code, section 147 of the German Fiscal Code), counted from the end of the calendar year in which the document was created. This is currently eight years for invoices and booking records and ten years for books and annual accounts.
Server logs: see "Server log files" in section 4.
Audit log of the platform (who logged in or changed a setting, when, from which IP address): two years.
Backups: 30 days. A backup is overwritten after 30 days, so deleted data can remain in a backup for up to 30 days after its deletion.
Suppression list of email addresses: an address that unsubscribed from our emails, or whose mails bounced or were reported as unwanted, stays on a suppression list without further data so that we do not write to it again. This entry survives the deletion of the contact.
Ticket and contact data in a business's workspace: the period the business sets; see section 6.

Deletion in two phases. When data in the platform reaches the end of its retention period, or a deletion is requested, it is deleted in two phases. First, the personal identifiers and contact details are replaced by placeholders immediately, so that the record is no longer linked to a person. About 30 days later an automated process removes the remaining data permanently, including the associated tickets and messages. Backups are overwritten after a further 30 days at the latest.

Legal bases

If you have consented to a processing, we process your personal data on the basis of Art. 6(1)(a) GDPR, or Art. 9(2)(a) GDPR where special categories of data under Art. 9(1) GDPR are concerned. Consent can be withdrawn at any time. If your data is needed to perform a contract or to take steps before a contract, we process it on the basis of Art. 6(1)(b) GDPR. If we must process your data to comply with a legal obligation, the basis is Art. 6(1)(c) GDPR. Processing may also be based on our legitimate interest under Art. 6(1)(f) GDPR. Where consent covers the storage of cookies or access to information in your device, the processing additionally rests on section 25(1) TDDDG. The legal basis for each processing is given in the sections that follow.

Recipients of personal data

We pass personal data on to others only where this is necessary to perform a contract, where the law obliges us to, where we have a legitimate interest under Art. 6(1)(f) GDPR, or where another legal basis permits it. Processors act under a data processing agreement (Art. 28 GDPR) and only on our instructions. The recipients are:

Hosting: Hetzner Online GmbH, Germany (processor), for all our systems; see section 2.
Payment: Mollie B.V., Netherlands, for card payments by our customers; see section 5.
Messaging channels: WhatsApp Ireland Limited, Ireland, for the WhatsApp channel; Meta Platforms Ireland Limited, Ireland, for the Instagram channel; and the operator of the Matrix server a business has chosen, for the Matrix channel. Each applies only where a business has booked that channel, or, for WhatsApp, where you write to us on WhatsApp. See sections 4 and 6.
Artificial intelligence: Mistral AI SAS, France (processor), for the language models that classify and answer messages; see section 6.
Our own staff: our employees and managing directors have access to personal data only as far as their tasks require, and are bound to confidentiality in writing. Access by our platform administrators to a customer's workspace takes place only for support and operation and is logged.
Legal, tax and accounting advisors, who are bound by professional secrecy.
Public bodies such as courts, tax authorities or supervisory authorities, where we are legally obliged to disclose.

We do not use any analytics, error-tracking or monitoring service of a third party. Monitoring of our systems runs on our own servers.

Many processing operations are possible only with your consent. You can withdraw consent you have given at any time, informally, for example by email to privacy@trusq.de. The lawfulness of the processing carried out before the withdrawal remains unaffected.

Objection in your particular situation (Art. 21(1) GDPR). Where we process your data on the basis of Art. 6(1)(e) or (f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to that processing, including any profiling based on those provisions. Which legal basis applies to a processing is stated in this privacy policy. If you object, we will no longer process the data concerned unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

Objection to direct marketing (Art. 21(2) GDPR). Where personal data is processed for direct marketing, you have the right to object at any time to that processing, including any profiling related to such marketing. If you object, your data will no longer be used for direct marketing. We do not currently send marketing emails. Should we start, every such email will contain an unsubscribe link, and you can object at any time by email to privacy@trusq.de with the subject "Objection to marketing".

Right to lodge a complaint with a supervisory authority

In the event of infringements of the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR). This right is without prejudice to other administrative or judicial remedies. The supervisory authority responsible for Trusq GmbH is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18, 91522 Ansbach, Germany
https://www.lda.bayern.de

Right to data portability

Under Art. 20 GDPR you have the right to receive the data that we process automatically on the basis of your consent or in performance of a contract, and that you provided to us, in a common machine-readable format, or to have it transmitted to another controller where technically feasible. Send your request to privacy@trusq.de. We provide the data as JSON or CSV files within one month of receiving your request and verifying your identity. If the data concerns messages you sent to a business that uses Trusq, please address your request to that business (section 6); we assist the business in answering it.

Information, rectification and erasure

Under Art. 15 to 17 GDPR you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of the processing, and, where the conditions are met, to the correction or deletion of this data. Send your request to privacy@trusq.de. We may ask you to prove your identity before we answer, and we answer within one month. Customers of Trusq can correct their own account data in the platform; deletion of an account or workspace is requested by email. If your data concerns messages you sent to a business that uses Trusq, please address your request to that business (section 6).

Right to restriction of processing

Under Art. 18 GDPR you have the right to request the restriction of the processing of your personal data. Contact us at any time for this. The right exists in the following cases:

You contest the accuracy of your personal data stored by us. For the time we need to check this, you can request the restriction of the processing.
The processing of your personal data was or is unlawful, and you request restriction instead of deletion.
We no longer need your personal data, but you need it to exercise, defend or assert legal claims.
You have objected under Art. 21(1) GDPR, and it is not yet clear whose interests prevail.

If you have restricted the processing of your personal data, the data may, apart from its storage, only be processed with your consent, to assert, exercise or defend legal claims, to protect the rights of another natural or legal person, or for reasons of important public interest of the European Union or a Member State.

Encryption

This website and the Trusq platform use TLS encryption for all connections. You recognise an encrypted connection by the "https://" at the start of the address and the lock symbol in your browser. Data you send to us over an encrypted connection cannot be read by third parties in transit.

Objection to promotional emails

The use of contact data published in the legal notice for sending unsolicited advertising and information material is prohibited. We reserve the right to take legal action in the event of unsolicited advertising, for example spam emails.

4. This Website

Server log files

When you call up a page or file on this website, the web server records the request: the page requested, the time, the browser type and version, the operating system, the page you came from (referrer), and the IP address of your device. We use these logs only to run the website without errors, to find faults and to defend against attacks. We do not combine them with other data.

The logs are kept on our own servers. They are not sent to any third party. Each service keeps its log up to a fixed size and then overwrites the oldest entries; in practice the entries are overwritten within days. Logs that document a security incident may be kept longer until the incident is resolved. The processing is based on Art. 6(1)(f) GDPR: we have a legitimate interest in the technically error-free and secure operation of our website.

Contact form

When you send us an enquiry through the contact form, we process the details you enter: your name, your email address, your telephone number if you give it, the subject and your message. We use them to handle your enquiry and to answer follow-up questions. We do not pass them on without your consent.

Your enquiry is received by our own customer-service workspace on the Trusq platform, where it is handled like any customer message (section 6 describes the platform): it is stored in our database, made searchable for our team, checked automatically for personal data so that the data can be masked in overviews, and may be answered or pre-drafted by the AI described in section 6. A reply written by the AI is marked as such, and you can ask for a person to take over at any time.

When you submit the form you confirm the checkbox that your details may be processed to handle your enquiry. We keep a record of this confirmation with the time, the IP address from which the form was sent and the version of this privacy policy shown to you, as proof that you agreed (Art. 7(1) GDPR). The record is deleted together with the enquiry.

Legal basis: Art. 6(1)(b) GDPR where your enquiry concerns a contract with you or steps before a contract; otherwise our legitimate interest in handling enquiries addressed to us effectively (Art. 6(1)(f) GDPR); and, where the form asks for it, your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future.

The data you enter in the contact form stays with us until your enquiry has been dealt with and for at most twelve months after that, unless you ask us to delete it earlier, a contract follows, or a statutory retention obligation applies.

Enquiries by email, telephone or fax

If you contact us by email, telephone or fax, we store and process your enquiry, including the personal data it contains (name, enquiry), to handle your request. We do not pass this data on without your consent. Email to and from Trusq is handled by our own mail servers at Hetzner in Germany; we do not use an external email provider.

Legal basis: Art. 6(1)(b) GDPR where your enquiry concerns a contract or steps before a contract; otherwise our legitimate interest in handling enquiries addressed to us effectively (Art. 6(1)(f) GDPR), or your consent (Art. 6(1)(a) GDPR) where we ask for it. The data stays with us until your enquiry has been dealt with and for at most twelve months after that, unless a contract follows or a statutory retention obligation applies.

If you write to us on WhatsApp

You can reach us on WhatsApp. Messages between WhatsApp and Trusq pass through the WhatsApp Business Platform of WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("WhatsApp Ireland").

WhatsApp's end-to-end encryption ends when a message reaches a business on the WhatsApp Business Platform: WhatsApp Ireland processes the content and the metadata (for example your phone number, profile name and the time) to deliver it. From there your message reaches the Trusq platform on our servers at Hetzner in Germany, where it is handled like a contact-form enquiry, including the AI described in section 6. WhatsApp Ireland belongs to the Meta Platforms, Inc. group, USA; processing by WhatsApp LLC and Meta Platforms, Inc. in the USA may occur. Transfers to the USA are based on the "WhatsApp Business Data Transfer Addendum" with the European Commission's standard contractual clauses (https://www.whatsapp.com/legal/business-data-transfer-addendum) and on WhatsApp LLC's certification under the EU-US Data Privacy Framework (https://www.dataprivacyframework.gov/participant/7735). WhatsApp's privacy policy: https://www.whatsapp.com/legal/#privacy-policy

For messages you send us on WhatsApp we are the controller. Legal basis: our legitimate interest in fast and effective communication with customers, prospects and business partners (Art. 6(1)(f) GDPR), or Art. 6(1)(b) GDPR where your message concerns a contract. The content stays with us until your enquiry has been dealt with and for at most twelve months after that, unless a contract follows or a statutory retention obligation applies.

This website contains no web analytics, no tracking pixels and no embedded elements of social networks. Links to other websites, for example to our profiles on social networks, are plain links; no data is transmitted to the other site until you click the link.

5. Your Trusq Account

This section applies to people who register on the Trusq platform and to the users a Trusq customer adds to its workspace. For these processing operations Trusq GmbH is the controller.

When you create a workspace at app.trusq.de, we process your name, your email address, the address of your workspace on the platform, your time zone and your answer to the question whether you are bound by professional secrecy, which decides which edition of Trusq you get. We record that you accepted our Terms and Conditions and the data processing agreement and confirmed that you act as a business, with the time and the version of each document. We send a confirmation link to the address you entered; you complete the registration and set your password through that link. The password is stored only as a hash. Users invited to an existing workspace are registered with their name and email address by the workspace administrator.

After you log in, the platform sets a session cookie in your browser. It contains only a random session identifier, is transmitted over encrypted connections only, cannot be read by scripts, and expires when you log out and at the latest 30 days after login. It is strictly necessary for the service (section 25(2) no. 2 TDDDG) and needs no consent.

The platform keeps an audit log of logins and changes to settings, with the time, the user and the IP address. The log serves the security of the platform and allows our customers to trace who changed what in their workspace. It is kept for two years (see "Storage duration").

Legal basis: Art. 6(1)(b) GDPR (performance of the contract with the customer and steps before it) and, for the audit log, Art. 6(1)(f) GDPR (our legitimate interest in the security of the platform and in proving the acceptance of our contract documents, Art. 7(1) GDPR).

Billing and payment

Our customers pay by credit or debit card. Payments are processed by Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands ("Mollie"). You enter your card details on pages operated by Mollie; they do not reach our servers. We receive from Mollie a customer identifier, the card brand and the last digits of the card, and the status of each payment, and we store these to manage the subscription. Mollie processes your payment data on its own responsibility under its privacy policy: https://www.mollie.com/privacy

Invoices are created by our own billing system on our servers and stored for the statutory retention period (see "Storage duration"). Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(c) GDPR (retention obligations under tax law).

Your workspace content and the AI

The content you store in your workspace (knowledge base, documents, instructions, replies your team writes) is processed by the AI described in section 6 to answer the messages your customers send you: the knowledge base is indexed with the help of Mistral AI, and replies your team writes to escalated enquiries may, if you switch this on, be proposed as new knowledge-base entries that you approve or reject. Your content is used for your workspace only; it is never used to train models or shown to other customers.

6. Messages to Businesses That Use Trusq

Roles

Businesses use Trusq to handle the messages their customers send them by email, web form, WhatsApp, Instagram or Matrix in one inbox. If you write to such a business, that business is the controller for your data. We process your data only on the business's behalf and on its instructions, under a data processing agreement (Art. 28 GDPR). Which data the business processes, for what purpose and for how long is set out in the business's privacy policy, and you exercise your rights (information, correction, deletion, objection) against the business. We support the business in answering your request. This section describes what we do for the business, so that you know what happens to your message.

Channels

Email: the business's support address points to our mail servers at Hetzner in Germany. We receive the email, store it with its attachments in the business's workspace and send replies through the same servers. No external email provider is involved.
Web form: a form on the business's website sends the fields you fill in to our platform. As in our own contact form, the business may ask for your consent and we then store the time, your IP address and the version of the business's privacy notice as proof.
WhatsApp: messages pass through the WhatsApp Business Platform of WhatsApp Ireland Limited, as described in section 4. Where we provide the WhatsApp number to the business, the number is registered to Trusq GmbH, and WhatsApp Ireland sees Trusq as the business behind it; the business remains the controller for your messages.
Instagram: direct messages to the business's Instagram account reach us through the Instagram messaging interface of Meta Platforms Ireland Limited ("Meta"). Meta processes the content and metadata to deliver them; processing by Meta Platforms, Inc. in the USA may occur. That transfer is based on the European Commission's standard contractual clauses concluded by Meta and on Meta Platforms, Inc.'s certification under the EU-US Data Privacy Framework (https://www.dataprivacyframework.gov/participant/7735). Instagram's privacy policy: https://privacycenter.instagram.com/policy/
Matrix: the business connects a Matrix server of its choice, and our platform takes part in the conversation through an account on that server. The operator of that server, chosen by the business, processes the messages according to its own rules; it is not a processor of ours.

A channel is used only where the business has booked and connected it. Where the business has booked the Trusq edition for professions bound by professional secrecy, WhatsApp and Instagram are not available.

Artificial intelligence

The platform contains an AI assistant that works on the messages a business receives. It is provided by Mistral AI SAS, 15 Rue des Halles, 75001 Paris, France ("Mistral AI"), through its platform "La Plateforme", hosted in the European Union. We use the language model Mistral Large to write and check text and the model Mistral Embed to compare text with the business's knowledge base. The assistant does the following, depending on how the business has configured it:

it classifies an incoming message (for example request, complaint, spam) and suggests a priority and tags;
it writes a reply, or a reply suggestion for the business's staff, from the content the business has stored in its knowledge base, and checks the reply against that content before it is sent;
it summarises a conversation for the staff;
it drafts knowledge-base entries from replies the staff wrote, which the business approves or rejects;
it computes an index of the business's knowledge base so that the matching content can be found;
it detects personal data such as names, addresses or bank details in a message, so that the data can be masked in overviews and in the administration interface.

For this, the subject (up to 200 characters) and the text of your message (up to 8,000 characters) are sent to Mistral AI together with the relevant excerpts of the business's knowledge base. Attachments, your IP address and device information are not sent to Mistral AI. Mistral AI processes the data only on our instructions under a data processing agreement (Art. 28 GDPR), does not use it to train models, and hosts it in the European Union.

A reply written by the assistant is marked as automatically generated in the first message of a conversation (Art. 50 of Regulation (EU) 2024/1689, the AI Act). If the assistant cannot answer from the business's content, or is not confident enough, it hands the conversation to a member of the business's staff, and you receive a message saying so. You can ask for a person at any time. The assistant does not give legal, tax or medical advice. The business decides whether and for which channels the assistant is active.

Legal basis for the business: the business's legitimate interest in handling its customers' messages quickly and consistently (Art. 6(1)(f) GDPR) or the contract with you (Art. 6(1)(b) GDPR); the business states the basis in its own privacy policy. For our own enquiries (section 4) the same AI is used on the basis of Art. 6(1)(f) GDPR, our legitimate interest in fast and efficient customer communication.

Retention and deletion in a workspace

How long a business keeps your messages is set by the business. In the platform the business's administrator sets a retention period for resolved and closed tickets; the minimum is 30 days. When a ticket reaches that period, or the business requests the deletion of your data, deletion takes place in two phases as described in section 3: identifiers are replaced immediately, the remaining data is removed about 30 days later, and backups are overwritten after a further 30 days at the latest. Tickets that are still open are not deleted automatically.

Sub-processors

For the processing on behalf of a business we use the following sub-processors: Hetzner Online GmbH (hosting, Germany), Mistral AI SAS (AI, France), WhatsApp Ireland Limited (WhatsApp, Ireland, only where booked) and Meta Platforms Ireland Limited (Instagram, Ireland, only where booked). The data processing agreement with the business contains the authoritative list, including the data centre locations, and the business is informed before a sub-processor is added or replaced.