Privacy policy – SampleDecks

1. Controller

onexip GmbHPrießnitzstraße 39B01099 DresdenGermanyRepresented by: Managing Directors Matthias Hänel and Tobias Bley

2. Data protection contact

For questions about data protection and for exercising the rights of data subjects, the following address is available:

3. Provision and hosting

The SampleDecks website is provided through Firebase Hosting. The contracting party is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Processing takes place in the European Union (europe-west region). When the site is accessed, technically necessary data is processed:

IP address
time of access
file requested
browser and operating system
referrer
status code

The purposes of this processing are the delivery of the website, its stability and its security.

Server logs are anonymised and deleted after 14 days. The legal basis is Article 6(1)(f) GDPR; the legitimate interest lies in providing the website securely and reliably.

A data processing agreement is in place with Google (Google Cloud Data Processing Addendum). Where data is transferred to a third country, the EU standard contractual clauses apply.

4. Contact form and support

The following details may be processed through the contact form:

name, where provided
email address
topic selected
message
operating system
SampleDecks version
screenshot, if uploaded
technically necessary security data for spam prevention

The purpose is to handle and answer the support request. The recipient of the request is support@ultramixer.com.

The request is processed on the server in a Firebase Cloud Function. The contracting party is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; processing takes place in the European Union (europe-west1 region). Cloud Firestore is accessed in order to limit automated requests; details are given under "Spam and abuse protection".

The support email is sent through Microsoft 365. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Further information is available in the Microsoft privacy statement.

Screenshot upload

one screenshot at most
PNG, JPG/JPEG or WebP
3 MB at most
no permanent storage in a publicly accessible upload area
metadata such as EXIF information is removed before sending
sent as an attachment to the support email

Passwords, complete licence keys and payment details should not be sent through the contact form.

The legal basis is Article 6(1)(b) GDPR where the request concerns a contract, and otherwise Article 6(1)(f) GDPR. An uploaded screenshot is processed solely in order to send the support email and is deleted afterwards; it is not stored permanently.

The support mailbox is located in the European Union. Support requests including attachments are deleted six months after the request has been concluded, unless statutory retention obligations require otherwise.

5. Spam and abuse protection

The following measures are used to protect the forms and the technical infrastructure against automated requests and abuse:

hidden honeypot field
server-side limit on submission attempts
hashed abuse indicators stored for a short time

The limit counts submission attempts per IP address and per email address. Both are stored solely as a hash with a secret salt, never in plain text; the original details cannot be recovered from the hash. Storage is in Cloud Firestore. The contracting party is Google Ireland Limited and processing takes place in the European Union. Entries are deleted automatically after 24 hours at the latest.

The legal basis is Article 6(1)(f) GDPR; the legitimate interest lies in preventing spam and abuse. Where data is transferred to a third country, the EU standard contractual clauses apply.

6. Purchase and payment processing

Purchasing a SampleDecks licence may involve being forwarded to an external payment provider. Payment details are generally entered with that payment provider.

Following a payment, onexip GmbH receives the name, the email address, the details required for invoicing and information about the item purchased. We do not receive complete payment details such as card or account data.

Purchase and invoice data is stored for ten years on account of commercial and tax retention obligations. Licence and activation data is stored for the term of the licence. The legal bases are Article 6(1)(b) and Article 6(1)(c) GDPR.

Payments are processed through Stripe. The contracting party for customers in the European Union is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin D02 H210, Ireland. Stripe acts partly as a controller in its own right and partly as a processor. The Stripe privacy policy is available at stripe.com/privacy.

7. Downloads

The installation files for Windows and macOS are provided from a server of onexip GmbH at downloads.ultramixer.com, not through Firebase. Technically necessary access data is processed when they are retrieved; the server logs are deleted after 14 days.

Downloads are counted in total only and are not attributed to individual people. External download providers are not used.

8. Language settings and local storage

The language you choose and the entries in a form you have not yet submitted are stored in your browser's local storage (localStorage) so that they are still there on your next visit. No cookies are set.

This storage is technically necessary and does not serve advertising or tracking purposes. It can be deleted at any time through your browser settings. No consent is required for it.

9. Newsletter

We use Brevo to send our newsletter. A data processing agreement is in place with the provider; processing takes place on servers in the European Union.

For the sign-up we process the email address, the language selected on the website, as well as the time and IP address of the sign-up and of the confirmation. A first name may optionally be provided; it serves solely to address you personally in our emails. Signing up is fully possible without it. Sign-up follows the double opt-in procedure: once the address has been entered, an email with a confirmation link is sent. Only after confirmation is the address added to the mailing list.

The purpose of this processing is to send information about SampleDecks, in particular about new versions and sample banks. The legal basis is Article 6(1)(a) GDPR; the time and IP address are stored as evidence of consent under Article 6(1)(f) GDPR.

Consent can be withdrawn at any time with effect for the future, for example through the unsubscribe link at the end of every newsletter email. After withdrawal the address is removed from the mailing list; the record of the earlier consent is kept for up to three years.

Brevo evaluates whether newsletters are delivered and opened and whether links they contain are clicked. This evaluation serves technical deliverability and the improvement of the content.

10. Web analytics and marketing

No web analytics take place on sampledecks.com. No analytics or tracking services are used, no conversion tracking is applied to purchase or download buttons, and no marketing cookies are set. A consent banner is therefore not required.

11. External content and links

No external content is embedded: no videos, no social media widgets and no external fonts. The fonts used are delivered from our own server.

External links only lead to the respective provider once they are clicked. Only then can data such as the IP address be processed there. The respective provider is responsible for the content and the data protection of external offerings.

12. Storage periods

Personal data is deleted as soon as the purpose of the processing no longer applies and no statutory or contractual retention obligations stand in the way. In detail:

server logs of the website and the downloads: 14 days
rate limit data and abuse indicators: 24 hours
support requests: six months after the request has been concluded
screenshot attachments: together with the respective support request
purchase and invoice data: ten years on account of commercial and tax obligations
licence and activation data: for the term of the licence

13. Data security

We use the following measures in particular to protect the data processed:

encrypted transmission over HTTPS
access restrictions on the processing systems
secure management of access credentials
further technical and organisational protective measures

Absolute protection against unauthorised access cannot be guaranteed technically.

14. Rights of data subjects

Data subjects have the following rights in particular:

right of access
right to rectification
right to erasure
right to restriction of processing
right to data portability, where applicable
right to object
right to withdraw consent given
right to lodge a complaint with a data protection supervisory authority

A message to datenschutz@onexip.com is sufficient to exercise these rights.

The competent supervisory authority is the Sächsische Datenschutz- und Transparenzbeauftragte (Saxon Data Protection and Transparency Commissioner), Maternistraße 17, 01067 Dresden, Germany (postal address: Postfach 11 01 32, 01330 Dresden), telephone +49 351 85471-101, email post@sdtb.sachsen.de.

15. Automated decision-making

No decision-making based solely on automated processing, including profiling, takes place through the SampleDecks website.

16. Changes

This privacy policy is updated whenever the website, the services used or legal requirements change.