Privacy, Data Protection and Cookies

Privacy Policy

1. Controller and Contact

Codezy IT - Cagdas Inan ATSÜREN
Proprietor: Cagdas Inan ATSÜREN
Lindberghstraße 18
80939 Munich
Germany
Telephone: +49 172 829 33 31
Email: info@codezy.de
VAT ID: DE366771945
Website: www.duppo.de

Codezy IT is the controller for personal data used to operate this English-language Duppo offer, manage its own customer relationship, process subscriptions, handle enquiries and protect the service. You can send a privacy enquiry or rights request to info@codezy.de or the postal address above.

2. Business Records and the Controller–Processor Distinction

Duppo is an online software service. A business using Duppo determines why it records personal data about its customers, suppliers, staff or other contacts. For that business content, the business normally acts as controller and the software provider processes the content on its behalf to supply the service, subject to the applicable processing arrangements and instructions. The fact that information is stored in Duppo does not make Codezy IT the controller of every business record.

If your data were entered by a Duppo customer, contact that business first about the underlying records. Codezy IT can help identify and route a request and assist the responsible business where appropriate. The applicable responsibilities depend on the actual processing activity, not just the account type.

3. Data We Receive

Depending on the functions you use, data may include:
• Registration and account details, such as username, name, business name, email, telephone, language and account status.
• Billing details, selected plan, subscription period, order references, transaction amount, currency and payment or refund status.
• Customer and supplier records, ledger entries, cash records, invoices, appointments, notes and uploaded documents supplied by authorised account users.
• Staff and portal account details, permissions, notifications, support requests, messages and attachments.
• Enquiries sent through forms, email or other provided contact channels.
• Technical and security information, such as IP address, request time, browser information, authentication events, failed attempts and audit events.
• Cookie choices and browser-stored display or language preferences.

The data actually processed depend on your account, selected modules and actions. Do not upload unnecessary identity documents, payment secrets or sensitive information about other people. A business must have a lawful basis for the personal data it enters.

4. Sources and Collection Methods

Data are received electronically through registration, sign-in, checkout, account settings, business records, document uploads, portal and staff functions, support channels and ordinary use of the website. Information may also be supplied by the business that manages your portal or staff account, by authorised colleagues, or by the payment provider when reporting a transaction result. We do not treat another person's submission of your details as your consent to unrelated marketing.

5. Purposes and Legal Bases

Where the GDPR applies, the principal purposes and bases are:
• Providing an account, selected modules and the purchased service: performance of a contract or steps requested before entering a contract, under Article 6(1)(b), when the data subject is a party to that contract.
• Contacting business representatives, administering authorised staff access and responding to operational enquiries: the legitimate interest in communicating with customers and providing a functional business service, under Article 6(1)(f), where appropriate and subject to the individual's rights.
• Recording payments, invoices, refunds and information required by tax or other applicable law: compliance with legal obligations under Article 6(1)(c).
• Authentication, access control, fraud prevention, troubleshooting, audit records and service continuity including backups: the legitimate interest in protecting accounts, personal data and the service under Article 6(1)(f), or a specific legal duty where applicable.
• Optional analytics, marketing technologies or other consent-based processing: the relevant consent under Article 6(1)(a), where required. Consent can be refused or withdrawn.
• Establishing, exercising or defending legal claims: the applicable legal obligation or legitimate interest, according to the circumstances.

Contract necessity is not used as a blanket basis for every person mentioned in a business record. Data processed on a customer's instructions must be supported by that customer's applicable lawful basis.

6. Payments

Card payments are handled through PayTR's payment service where offered. Duppo receives the order and payment-result information needed to record the subscription and payment status. Payment details entered directly into the payment provider's card form are handled through that provider's payment environment. Do not send complete card numbers, card security codes, banking passwords or one-time payment codes to Duppo support. The payment provider's own privacy information applies to processing for which it is independently responsible.

7. Recipients and Access

Personal data are made available only for the relevant purposes and according to the applicable permissions. Recipient categories may include authorised business users, staff and portal users selected by the business; the software operator's authorised support and technical personnel; hosting, database, email, storage and backup service providers; payment providers; professional advisers; and competent authorities where a lawful duty or entitlement requires disclosure.

A business's choice to share an invoice, file or support message with a portal user determines who can receive that shared content. Do not share another person's data without authority. Service providers acting as processors must be covered by the processing and confidentiality safeguards required by applicable law.

8. International Processing

The payment service provider used where PayTR is offered is PayTR Ödeme ve Elektronik Para Kuruluşu A.Ş., Türkiye. Using that payment service may involve processing in Türkiye. PayTR provides its own privacy information at https://www.paytr.com/kisisel-verilerin-korunmasi.

The use of an online service or external email, payment, hosting or backup provider can involve processing in a country different from your own. Where personal data are transferred outside the EEA and GDPR transfer rules apply, the transfer must have an applicable legal basis and the required transfer mechanism, such as an adequacy decision or appropriate safeguards; limited statutory derogations apply only where their conditions are satisfied. Relevant UK transfer rules apply where the UK GDPR applies.

For information about the recipients, processing countries and safeguards relevant to a particular Duppo activity, contact info@codezy.de. An English-language page, a .de domain name or a consent choice does not by itself mean that all processing takes place in one country.

9. Retention

Personal data are retained only as long as needed for the relevant purpose and any applicable legal requirement. The retention criteria include the duration of the account and contractual relationship, the business's instructions for its records, legal accounting and tax duties, the need to resolve a payment dispute or defend a claim, and proportionate security requirements.

Closing an account does not necessarily require immediate removal of every invoice, legal record or protected backup. Records without a continuing lawful purpose must be deleted or anonymised. Backup copies are subject to their rotation and recovery lifecycle; a deletion must also be respected when data are restored. We do not use one universal retention period for all categories.

10. Security and Your Responsibilities

Duppo uses account authentication, access permissions and protected application functions for business records and documents. Authorised users should protect their passwords, review staff and portal permissions, and share documents only with intended recipients. No online system can be described as completely risk-free. Report a suspected unauthorised disclosure or access problem to info@codezy.de without sending further unnecessary personal data.

11. Your Rights

Subject to the applicable law and its conditions, you may request access, correction, erasure, restriction of processing or data portability. You may object to processing based on legitimate interests and to direct marketing. Where processing depends on consent, you can withdraw it without affecting processing lawfully carried out before withdrawal. Statutory rights concerning automated decision-making also remain available where applicable.

Send requests to info@codezy.de, identifying the relevant account and request. We may ask for proportionate information to confirm identity; do not send an identity document unless a suitable verification method has been requested. GDPR requests are generally answered without undue delay and within one month, subject to lawful extensions and exceptions.

You can complain to a competent data protection supervisory authority, including one in the country of your habitual residence, place of work or the alleged infringement. For a private-sector provider in Bavaria, the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) is a relevant authority. Where UK law gives you that right, you may also complain to the Information Commissioner's Office.

12. Required Information, Choices and Changes

Account and transaction data necessary to provide a requested service must be supplied for that service to operate. Missing required registration, verification or billing details may prevent account activation, payment or support. Optional analytics or marketing consent is not a condition for using essential service functions.

This policy provides information; accepting it is not a general consent to all processing. The Cookie Policy explains browser storage and optional technologies. Material changes to processing purposes or information required by law must be communicated through the appropriate channel. Mandatory privacy rights are unaffected.

Data Protection Notice

1. Provider and Privacy Contact

Codezy IT - Cagdas Inan ATSÜREN
Proprietor: Cagdas Inan ATSÜREN
Lindberghstraße 18
80939 Munich
Germany
Telephone: +49 172 829 33 31
Email: info@codezy.de
VAT ID: DE366771945
Website: www.duppo.de

Codezy IT is responsible as controller for its own account administration, contractual, billing, support and service-security processing. Privacy enquiries and requests can be sent to info@codezy.de or the postal address above.

2. Applicable Data Protection Rules

The EU General Data Protection Regulation (GDPR) and other applicable data-protection laws govern processing according to their respective scope. The UK GDPR and Data Protection Act 2018 apply where the relevant processing falls within their scope. Your choice of website language does not by itself determine which law applies or change the identity of the responsible party.

3. Data, Sources and Purposes

Data may be received through registration, sign-in, billing, account settings, contact and support channels, portal or staff use, document sharing and technical operation of the service. A business account holder or an authorised colleague may supply data about the persons involved in its business records.

The relevant categories include identity and contact details, business and account information, invoice and payment-result data, business records and uploaded files, support communications, authorisations and security events. The purposes are providing the requested service, administering the relationship, authenticating users, processing orders and payments, handling support, protecting the service and complying with legal duties.

4. Lawful Bases

The applicable basis depends on the activity. Under the GDPR, it may be contract performance, a legal obligation, a legitimate interest assessed against the individual's rights, or consent where required. Legitimate interests include secure operation, preventing abuse and communicating with business representatives.

5. Business Records and Recipient Categories

A business normally determines the purpose of the personal data it enters about customers, suppliers or staff. It remains responsible for its lawful basis, notices and sharing choices. The service provider's processing on that business's behalf is distinct from its own controller activities.

Data may be made available, as necessary and lawfully permitted, to authorised account users and intended portal recipients, technical and support personnel, hosting, email, storage and backup providers, payment providers, professional advisers and competent authorities. Appropriate processor arrangements and confidentiality requirements apply where required. An external recipient or international transfer requires its own applicable legal conditions; the existence of this notice is not a transfer permission.

6. Retention and Data Minimisation

Only data needed for the relevant purpose should be supplied. Retention is determined by the service relationship, the business's instructions, statutory accounting and other duties, security needs, claims and the backup recovery lifecycle. Data must not be kept indefinitely merely because they were entered into Duppo. Erasure or anonymisation applies when there is no continuing lawful purpose, subject to applicable legal exceptions.

7. Individual Rights

Subject to the applicable law, individuals may seek information or access, correction, deletion, restriction, portability, objection and withdrawal of consent. Rights concerning significant automated decisions remain available where their legal conditions apply.

8. Making a Request

Send a clear request to info@codezy.de or the postal address above, identifying the relevant account, processing activity and right you wish to exercise. Verification should be proportionate; do not send unnecessary identity documents or payment secrets.

For business records controlled by a Duppo customer, direct the request to that business. Codezy IT can assist the responsible party with a request within its role. GDPR requests are generally addressed within one month, subject to lawful extensions and exceptions.

9. Complaints and Further Information

You may complain to a competent supervisory authority without first giving up any other remedy. The Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) is a relevant authority for a Bavarian private-sector provider. Where applicable, UK individuals may complain to the Information Commissioner's Office.

The Privacy Policy contains fuller information on recipients, international processing, retention and rights. The Cookie Policy explains optional device storage and how to change consent. Mandatory rights are not limited by this notice.

Cookie Policy

1. Operator and Contact

Codezy IT - Cagdas Inan ATSÜREN
Proprietor: Cagdas Inan ATSÜREN
Lindberghstraße 18
80939 Munich
Germany
Telephone: +49 172 829 33 31
Email: info@codezy.de
VAT ID: DE366771945
Website: www.duppo.de

This policy covers information stored on or read from your device when you use Duppo. It includes cookies and similar browser storage. Personal-data processing is also explained in the Privacy Policy.

2. Why Browser Storage Is Used

Some storage is needed to maintain a secure sign-in session, protect forms and remember a requested setting. Optional technologies can support audience measurement or marketing only where configured and where the required consent has been given.

A cookie is a small value stored by a browser and sent with relevant requests. Local storage saves a setting in the browser without automatically attaching it to every request. The applicable consent rules cover similar device-storage technologies as well as cookies.

3. Necessary Storage and Preferences

Duppo uses server-session cookies for authenticated application, staff or portal sessions. Their purpose is to maintain the correct sign-in context and protect account actions. The session cookie names used by the relevant service include veresiye_session, duppo_staff_session and duppo_portal_session.

The website stores its consent choice in local storage under duppo.cookie.preferences. That record distinguishes necessary, analytics and marketing preferences and is treated as valid for up to 180 days. If the browser cannot save the preference, a duppo.consent.denied cookie can be used as a fallback for up to 180 days so that an unsuccessful storage write does not restore an earlier optional permission.

The selected public-site theme can be remembered in local storage under duppo.public.theme. Sign-in sessions, language and display preferences are used only according to the relevant service and the choices made. Browser settings or clearing site data can remove persistent local preferences.

4. Optional Analytics and Marketing

Analytics and marketing choices are off by default until a valid affirmative choice is available. Selecting “Necessary only” leaves those optional categories off. Selecting “Accept all” enables the offered optional categories, subject to the site's configured services. The settings control lets you choose those categories separately.

Where Google Analytics is configured and enabled, the consent-controlled website integration loads its measurement script only after analytics consent. Where a Google Tag Manager container is configured and enabled, the corresponding container is loaded only after the relevant marketing permission in the current integration. A configured identifier does not by itself mean a visitor has consented.

Google technologies may use cookies such as _ga and related identifiers to measure visits or perform the functions of enabled tags. The exact optional technologies and their durations depend on the actual enabled configuration. Consent to one category does not authorise unrelated processing, and a tag-management tool is not itself permission for every possible tag.

5. Changing or Withdrawing a Choice

Use “Change preferences” in the footer to reopen the settings. You can refuse optional categories or withdraw an earlier choice. Withdrawal does not affect the lawfulness of processing carried out before it took effect.

When optional permission is withdrawn, the website stops consent-controlled activation, removes accessible recognised tracking cookies where possible and may reload the page to stop already loaded scripts. The website cannot erase data already sent to a third party or directly delete cookies that the browser does not allow its scripts to access. You can also use your browser's cookie and site-data controls.

6. Consent and Legal Basis

Where required, non-essential storage or access requires your consent. Strictly necessary device storage or access may be used without optional consent where the applicable legal exception permits it for a service you expressly request. Related personal-data processing also needs its own lawful basis under the applicable data-protection law.

Refusing analytics or marketing does not prevent use of the essential website or account functions. Blocking all cookies at browser level can prevent sign-in or other functions that rely on a necessary session.

7. Third-Party Payment Pages and External Services

An external payment or other service may have its own cookies, storage and privacy notices when you open its environment. Duppo's website choice does not automatically control every external provider's separate page. Read the relevant provider's notice where its service is used.

8. Further Information

For questions about storage, enabled services or your rights, contact info@codezy.de. The Privacy Policy explains the controller, recipients, retention criteria and available data rights.