Privacy Policy
Save this version (TXT) · 2026-11-03
This notice describes OzyCore as controller and its processing of customer documents on instructions.
Data Controller
OzyCore GmbH Kreuzberger Ring 24 65205 Wiesbaden Email: info@ozycore.de
Purpose of processing
OzyCore controls account, billing, security and business communications data. Contract and contact data support contract performance (GDPR Article 6(1)(b) for individual contracting parties, otherwise (f) to serve business clients). Statutory obligations apply to our own tax records (c). Access logs help prevent abuse (f). We process customer documents on documented instructions under the DPA.
Data location
Primary invoice storage is configured in Frankfurt. Support, network and log processing by providers may take place elsewhere. Contact us for information about recipients and a copy of applicable transfer safeguards.
Cookies and consent management
Essential functions protect sign-in and sessions. Analytics and marketing are separate choices. The browser loads the corresponding Google tag only after opt-in. Analytics measures page views and usage. Marketing measures the source of visits and registrations. Google receives technical device, page and event data. Automatic detection of user-provided data is off for the ERI tags. Your choice is stored locally under cookie-consent-v2. Use Cookie settings in the footer to change or withdraw it at any time. With marketing consent we may store the campaign, keyword, referral code and Google click ID in eri_acq_v2 for 30 days and associate them with your account at signup. In the ERI Analytics property, event data retention is set to two months and user data retention to 14 months. New activity resets the retention period for the user identifier. These settings do not limit retention of standard aggregated reports. Google signals and the GA4 user-provided data collection feature are not activated. Automatic user-data detection for the ERI tags is disabled.
Service providers and other recipients
Depending on the feature, data is sent to service providers or public information services. The role depends on the purpose.
Microsoft Ireland Operations Limited
Service: Azure Document Intelligence (OCR processing of PDF receipts). Processing region: Germany West Central (Frankfurt). Retention: maximum 24 hours during processing; the analyse result is also actively deleted via the Delete-Analyze-Result API immediately after our server has retrieved it. Contractual basis: Microsoft Products and Services Data Protection Addendum (DPA), including EU Standard Contractual Clauses. Data categories: PDF content of uploaded receipts (may contain personal data — e.g. names, addresses, contact details of suppliers and employees). Purpose: Structured extraction of invoice data from PDF receipts that are not in EN-16931 XML format. Legal basis: Art. 6 (1) (b) GDPR (performance of contract) in conjunction with Art. 28 GDPR (data processing on behalf).
European Commission (VIES — VAT Information Exchange System)
Service: VAT identification number validation via the public VIES REST API (https://ec.europa.eu/taxation_customs/vies/). Processing region: European Union. Retention: in accordance with the retention rules of the public VIES register; the validation result is cached in our database for a maximum of 30 days. Data categories: VAT-ID (public business identifier); for validated numbers VIES returns company name and address from the public register. Purpose: Validating the validity of a VAT-ID, in particular for cross-border transactions within the EU. The public authority operates the information service under its own responsibility. Section 18e UStG describes the confirmation procedure.
Federal Central Tax Office (BZSt — confirmation of foreign VAT-IDs)
Service: simple confirmation request for a foreign EU VAT-ID via the BZSt's public eVatR REST interface (https://api.evatr.vies.bzst.de). Processing region: Germany. Data transmitted: your company's German VAT-ID (as the requesting party) and the supplier's VAT-ID. Company name and address are not transmitted. Retention: at the BZSt according to its rules; on our side the result (valid/invalid, time, source) is stored on the supplier record and re-checked after 30 days at the latest. If the BZSt does not respond, we query VIES instead (see above). Purpose: Confirming the validity of VAT-IDs of suppliers from other EU member states. The public authority operates the information service under its own responsibility. Section 18e UStG describes the confirmation procedure.
Subprocessors (full list)
• Supabase Pte. Ltd. (Singapore) – database, object storage and authentication; primary storage in Frankfurt (AWS eu-central-1). Contractual basis: Supabase DPA of 1 August 2026 with EU Standard Contractual Clauses, Module 2 or 3 according to the role. Other processing locations follow the DPA. • Vercel, Inc. (USA, EU-US Data Privacy Framework) – hosting of the web and API layer in the EU region Frankfurt (fra1); account and log data may be processed in the USA; EU Standard Contractual Clauses • Mailgun Technologies, Inc. (USA) – receiving and sending email via the EU region; EU Standard Contractual Clauses • Stripe Payments Europe, Ltd. (Ireland) – payment processing and invoicing • Functional Software, Inc. (Sentry, USA) – error and security monitoring in the EU/DE region; EU Standard Contractual Clauses • Inngest, Inc. (USA) – execution of background jobs (job metadata, no invoice content); location per vendor, EU Standard Contractual Clauses • Upstash, Inc. (USA) – rate limiting (hashed keys, no content); location per vendor, EU Standard Contractual Clauses • Cloudflare, Inc. (USA, EU-US Data Privacy Framework) – bot protection (Turnstile) on public forms • Fly.io, Inc. (USA) – operation of the KoSIT validator and the PDF review sandbox in the Frankfurt region; EU Standard Contractual Clauses • Microsoft Ireland Operations Limited – Azure Document Intelligence (OCR) in the Germany West Central region • Google Ireland Limited – Google Analytics 4 and Google Ads only after consent via the cookie banner; no processing of invoice data (website usage only, not a subprocessor under Art. 28 GDPR for customer data)
Google Ads / Remarketing
Only after your consent to the “Marketing” category do we transmit conversion events (e.g. registration) to Google Ireland Limited. Without consent, no Google Ads tag is loaded. Legal basis: Art. 6 (1) (a) GDPR; you can withdraw consent at any time via “Cookie settings” in the footer.
Public validation and support
The public validator sends the selected file to our server for technical validation. Submit only documents you are authorized to send. Authorized support staff can access account and diagnostic information needed to handle requests. Newsletter subscriptions are separate and can be cancelled at any time.
Retention
Customer documents follow the instructions and return provisions in the DPA. OzyCore generally retains its own accounting vouchers for eight years from the end of the year of creation. Ongoing proceedings and other record types can require different periods.
Your rights and objections
Use the contact above to request access, correction, deletion, restriction or, where applicable, portability. You may object to processing based on legitimate interests on grounds relating to your situation and to direct marketing at any time. Consent may be withdrawn for the future. You can complain to a supervisory authority. For a customer invoice, contact the business responsible for that invoice.
Supervisory Authority
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit Gustav-Stresemann-Ring 1 65189 Wiesbaden Phone: +49 611 1408-0 Email: poststelle@datenschutz.hessen.de