Privacy policy

This is an English translation for your convenience. The German version is legally binding.

This privacy policy tells you which personal data we process when you visit the website alpha-services.de, take the burnout self-test, contact us or use your "Mein Raum" user account, and which rights you have (Art. 13 GDPR). Personal data is any information that relates to you as a person or can be linked to you, such as your name, your email address or your IP address.

1. Summary

• For anonymous traffic analysis we use Umami, a self-hosted, cookie-free tool; beyond that we use no analytics, tracking or advertising services. We only set cookies that are technically necessary. That is why there is no cookie banner.
• The burnout self-test runs entirely in your browser. Your answers and your result are neither sent to us nor stored.
• We serve fonts and images ourselves. No content is loaded from third parties such as Google, YouTube or social networks.
• Netlify provides the website for us. User accounts are held by Supabase on servers in Frankfurt am Main, Germany. Both work on our behalf.
• We do not sell data and we do not make automated decisions about you.

2. Controller

The controller responsible for data processing is:

Synergie-Services GmbH
Carl-Schurz-Str. 12
86156 Augsburg
Germany

Represented by its managing director, Wilfried Zaremba
Phone: +49 170 966 88 68
Email: kontakt@synergie-services.de

Alpha-Services is a service of Synergie-Services GmbH. "We" and "us" in this policy mean Synergie-Services GmbH.

3. Data protection officer

We have not appointed a data protection officer because we are not required to do so under Art. 37 GDPR and § 38 of the German Federal Data Protection Act (BDSG). You can contact us directly with any data protection question, most easily by email to kontakt@synergie-services.de.

4. Visiting the website and server log data

What we process and why

When you open our website, your browser automatically sends technical data to the server that delivers the page:

• your IP address
• the date and time of the request
• the requested address (URL) and the status code of the response
• the page you came from (referrer), if your browser sends it
• browser type and version, operating system and the language set in your browser

We need this data to deliver the website to you, to run it reliably and securely, to fend off attacks and to fix errors. We also use your browser's language setting to show you the website in German or English. We do not combine this data with other data and do not use it to build usage profiles.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is providing the website securely, reliably and quickly.

Hosting by Netlify

Our website is hosted by Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA. Netlify processes the data listed above on our behalf. Pages that our server generates on request are produced in Frankfurt am Main. Netlify delivers all other content through a worldwide server network, usually from a location near you. That is also where the check whether you are signed in happens before we show you "Mein Raum".

We have a data processing agreement with Netlify under Art. 28 GDPR. Netlify is certified under the EU-U.S. Data Privacy Framework. Transfers to the USA are therefore based on the European Commission's adequacy decision of 10 July 2023 (Art. 45 GDPR). Should that decision cease to apply, the European Commission's standard contractual clauses have been agreed (Art. 46 (2) (c) GDPR).

We do not keep server log files of our own. Netlify stores the log data only as long as necessary for the purposes above.

Web analytics with Umami (self-hosted)

For anonymous traffic analysis we use Umami, a privacy-friendly analytics tool that we run ourselves on our own server (analytics.worqable.com) in the European Union. This is not a cloud service run by an external provider; the data collected never leaves our own infrastructure and is not passed on to any third party.

Umami sets no cookies and stores no personal identifiers. It collects only: the page viewed, the referring address (referrer), browser type, device type (desktop, tablet or mobile) and a coarse geographic region (country or state). That region is derived briefly from your IP address; the IP address itself is not stored. Nothing in the data collected lets us identify you or build a profile of your movement across other websites. Where your browser sends the "Do Not Track" setting, Umami honours it and collects no data at all.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is understanding how our website is used so we can improve it, without identifying individual visitors.

We keep the data collected only as long as necessary for this purpose; data no longer needed is deleted on a regular basis.

Because Umami sets no cookies and neither stores information on your device nor reads any from it, no consent under § 25 TDDDG is required for its use.

5. Cookies and storage in your browser

We store information in your browser, or read it from there, only where this is strictly necessary to provide a function you have asked for (§ 25 (2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG). This does not require your consent. We set no cookies for statistics, marketing or advertising and no third-party cookies.

Name	Type	Purpose	When it is set	Storage period
NEXT_LOCALE	Cookie	remembers whether you use the website in German or English	only if that language differs from your browser's language setting	until you close your browser
sb-…-auth-token (split into parts .0, .1 etc. where necessary)	Cookie	keeps you signed in to "Mein Raum"	when you sign in or create an account	until you sign out, at most 400 days
sb-…-auth-token-code-verifier	Cookie	one-time code from the sign-in security procedure	when you create an account	until you sign out, at most 400 days
alpha-theme	Local storage	remembers whether you chose the light or the dark display	only if you switch the display yourself	until you delete the site data in your browser

The "…" stands for the identifier of our Supabase project (see section 8).

We process the sign-in cookies to perform the user agreement for "Mein Raum" (Art. 6 (1) (b) GDPR), and language and display on the basis of our legitimate interest in showing you the website the way you set it up (Art. 6 (1) (f) GDPR).

You can delete or block cookies and stored site data in your browser at any time. Without the sign-in cookies, however, you cannot use "Mein Raum".

6. Burnout self-test

You can take the burnout self-test without signing in. Questions, answers and evaluation run entirely in your browser. Your answers and your result are not sent to our servers or to third parties, and they are not stored in your browser either. As soon as you close or reload the page, they are gone. We therefore do not learn whether or how you took the test. Opening the test page only generates the log data described in section 4.

7. Contact by email or phone

When you email or call us, we process the information you give us, such as your name, your email address or phone number and the content of your message, in order to respond to your request.

The legal basis is Art. 6 (1) (b) GDPR where your request relates to a contract or steps prior to entering into one, and Art. 6 (1) (f) GDPR otherwise. Our legitimate interest is being able to answer requests.

Please only tell us about your health as far as your request requires it. If you expressly send us such information, we process it solely to handle your request (Art. 9 (2) (a) GDPR).

Our mailbox is operated on our behalf by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany (Art. 28 GDPR).

We delete your request once it has been dealt with. If it belongs to a contract or is a business letter, we keep it for as long as the law requires, usually six years (§ 257 of the German Commercial Code, HGB; § 147 of the German Fiscal Code, AO).

The contact form on our website is not active at the moment. It neither sends nor stores anything you enter. Please send us an email instead.

8. "Mein Raum" user account

Registration and sign-in

You need a user account for "Mein Raum". When you register, we process your first name, your last name, your email address and your password. The password is stored only as a hash, that is, in a form we cannot read. For your account we also store a profile with display name, language and user role, and the times of your registration and last sign-in. When you register and sign in, technical log data such as the time and your IP address is recorded in order to detect misuse and protect your account.

The legal basis for the account and its functions is Art. 6 (1) (b) GDPR, because we need the data to perform the user agreement under our terms and conditions. We process the log data on the basis of Art. 6 (1) (f) GDPR. Our legitimate interest is the security of user accounts.

If we send you emails that your account requires, for example to confirm your email address, Supabase sends them on our behalf. We do not send newsletters or advertising by email.

No health data in the user account

We currently store no health data in your user account, including no results of the burnout self-test. Before we offer that, we will ask for your explicit consent (Art. 9 (2) (a) GDPR) and update this privacy policy.

Storage period and deletion

We store your account data for as long as your account exists. You can have your account deleted at any time: just send an email to kontakt@synergie-services.de. When we delete the account, we also delete all data linked to it. We keep sign-in log data only as long as necessary for the security of user accounts.

Supabase

Sign-in, user accounts and the "Mein Raum" database are run on our behalf by Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513 (Art. 28 GDPR). The data is stored on servers in Frankfurt am Main, Germany (region eu-central-1). Supabase belongs to a group of companies that includes Supabase, Inc. in the USA and uses further service providers for operations and support, including outside the EU. Where data is transferred to Singapore or the USA, or accessed from there, the transfer is safeguarded by the European Commission's standard contractual clauses (Art. 46 (2) (c) GDPR), which are part of our data processing agreement with Supabase.

9. Links to other websites

Our website contains links to websites of other providers, such as OpenStreetMap on our contact page. Your browser only connects to such a provider when you click the link. That provider is then responsible for processing your data on its site.

10. Recipients at a glance

Your data is only received by service providers who work on our behalf:

• Netlify, Inc. (USA): website hosting, see section 4
• IONOS SE (Germany): mailbox, see section 7
• Supabase Pte. Ltd. (Singapore), data stored in Frankfurt am Main: user accounts, see section 8

Beyond that, we only pass on data where we are legally obliged to, for example to authorities or courts.

11. Transfers to third countries

Some of our service providers are based outside the EU or access data from there:

• USA (Netlify, the Supabase group and its service providers): for Netlify on the basis of the adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR), otherwise on the basis of the European Commission's standard contractual clauses (Art. 46 (2) (c) GDPR)
• Singapore (Supabase Pte. Ltd.): on the basis of the European Commission's standard contractual clauses (Art. 46 (2) (c) GDPR)

You can ask us for a copy of the standard contractual clauses.

12. Automated decisions

We make no decisions based solely on automated processing within the meaning of Art. 22 GDPR, and we do not carry out profiling. The evaluation of the burnout self-test only calculates, in your browser, an indication for yourself. It has no legal or similarly significant effect on you.

13. Your rights

You have the right

• to access the data we process about you (Art. 15 GDPR),
• to have inaccurate data corrected or incomplete data completed (Art. 16 GDPR),
• to have your data erased (Art. 17 GDPR),
• to restrict processing (Art. 18 GDPR),
• to receive the data you have provided to us in a structured, commonly used and machine-readable format, or to have it transmitted to another controller (Art. 20 GDPR),
• to object to processing (Art. 21 GDPR, see below),
• to withdraw any consent you have given at any time, with effect for the future (Art. 7 (3) GDPR). This does not affect the lawfulness of processing before the withdrawal.

To exercise your rights, an email to kontakt@synergie-services.de is enough.

Right to object

Where we process your data on the basis of Art. 6 (1) (f) GDPR, you may object to this processing at any time on grounds relating to your particular situation (Art. 21 (1) GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your data infringes the GDPR (Art. 77 GDPR), in particular in the EU member state where you live or work. The authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA, Bavarian Data Protection Authority)
Promenade 18
91522 Ansbach
Germany
https://www.lda.bayern.de

14. Obligation to provide data

You are under no legal or contractual obligation to provide us with data. Without the technical data described in section 4, however, we cannot show you the website, and without the details requested at registration you cannot create a user account.

15. Data security

We transmit all content encrypted over HTTPS. In the "Mein Raum" database, access rules ensure that each member can only retrieve their own data.

16. Changes to this privacy policy

We update this privacy policy when our website, our service providers or the law change, for example when we introduce new functions. The version published on this page applies.