Privacy Policy
Version: September 29, 2026
Controller
The controller for data processing on this platform is Picture Perfect Film- & Videoproduktion - Sascha Manke, Westerbachstra脽e 50, 60489 Frankfurt am Main, Germany (see legal notice). For privacy questions, contact [email protected].
Purposes and legal bases
We process personal data to operate the platform: user accounts (name, email address), training participation and results (knowledge checks, certificates), and qualification records you upload. Legal bases are performance of contract (Art. 6(1)(b) GDPR) and - for special categories - your explicit consent (Art. 9(2)(a) GDPR).
Health-related records (Art. 9 GDPR)
Records such as occupational health checks (G37) or eye tests may contain health data. These documents belong to you: you decide on every share with your company individually and can revoke it at any time. Without your active share, your company cannot see the document.
Supply Chain View (Supplier Link)
Companies can link themselves as contractors and suppliers with each other. This linkage occurs exclusively when the supplier actively accepts an invitation; in doing so, they choose which areas to release and may revoke this approval at any time. Only aggregated figures are explicitly transmitted (e.g., "12 certificates valid, 2 expiring") - never names, contact details or documents of individual employees of the supplier. Health-related records (Art. 9 GDPR) are not forwarded, even as document types. The legal basis for transmitting these aggregate values is the legitimate interest of both companies in quality assurance within the supply chain (Art. 6 Para. 1 lit. f GDPR) combined with the explicit approval by the supplier.
Order and billing data
For license orders we process company data, order quantity, invoice number and payment status for contract fulfilment (Art. 6(1)(b) GDPR). Invoice-relevant data is retained in line with statutory retention periods (up to 10 years under German commercial and tax law). Payment is either by invoice or via PayPal (see section "Payment via PayPal"); we do not process payment card data.
Payment via PayPal
If you choose to pay using PayPal, you will be redirected to the payment page of PayPal (Europe) S.脿 r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. In this process, PayPal processes as an independent controller all data required for the transaction (including your IP address, your PayPal account details and the payment amount) in accordance with its own privacy policy. We ourselves receive and store exclusively the reference number of the transaction and its status (successful, cancelled) - no account, card or address data. The legal basis is contract performance (Art. 6 Para. 1 lit. b GDPR). You can find PayPal's privacy policy at paypal.com.
Feedback on Test Access
If a test access expires, we invite you via email to provide brief voluntary feedback. All information provided there is optional. We store your email address only if you explicitly consent to follow-up questions. The legal basis is our legitimate interest in improving the offering (Art. 6 Para. 1 lit. f GDPR), and upon contact, your consent (Art. 6 Para. 1 lit. a GDPR). Feedback remains stored even after deletion of the test access; however, it will then be without reference to a user account.
AI reading aid (optional)
We use AI in several places: for the reading aid (text recognition and translation of uploaded documents), for the translation of support messages, and for the in-course standards lookup that answers your question. The following applies to all these functions: processing takes place exclusively on our own infrastructure in Germany. Locally operated models are used - no external AI services (e.g. US cloud providers) are involved and no content is transmitted to third parties. The reading aid only works at your explicit request for a single document.
Support requests
If you send us a support request, we process your name, your email address and the content of your message in order to handle your enquiry. The legal basis is performance of a contract (Art. 6(1)(b) GDPR); for requests without an existing contract, our legitimate interest in responding (Art. 6(1)(f) GDPR). If your message is not written in German, we translate it automatically so that we can process it; we translate our reply back using the same method. The translation is stored together with the original. We retain your request for as long as is necessary to handle your enquiry and for any follow-up questions relating to it.
Data processing agreement
As a business customer you are responsible for your employees' data and need a data processing agreement under Art. 28 GDPR. Our template is available at any time: https://normproof.de/avv
Sign in with your Microsoft work account
You can link your NormProof account to your business Microsoft account and then sign in with it. This is optional and does not replace signing in with your email address and password. You establish the link yourself, while signed in, in your profile. We store the identifier of your Microsoft tenant, the identifier of your Microsoft account, the timestamp, and the IP address of the linking event. We do not store your name or email address from the sign-in; they are displayed to you at most. No matching is performed via the email address, and no new account is created through this method. The sign-in itself takes place with the provider your company uses for this purpose. We do not transmit any personal data to them; your browser establishes the connection, and we subsequently receive the result. The fact that you have signed in to NormProof is processed by your company's provider, not by us. Personal Microsoft accounts are excluded; linking is only possible with a business account. Every link, sign-in, unlinking, and rejected sign-in is logged. You can unlink at any time in your profile; this requires your password, and the stored identifiers are deleted in the process. If you leave your company or your Microsoft account is discontinued, continue signing in with your email address and password. Your training records remain yours.
Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability, and to withdraw given consent with effect for the future (Art. 15-21 GDPR). You may also lodge a complaint with a data protection authority.
Contact
For privacy requests, please use the contact details in the legal notice. We respond within the statutory deadlines.