Privacy Policy

1. Controller

The controller responsible for data processing on this platform is:

Comms Connect GmbH

Tal 30, 80331 Munich, Germany

Represented by: Rainer Roloff

"Comms OS" / "CommsOS" is a trademark and product of Comms Connect GmbH.

E-mail: info@comms-connect.de

Phone: +49 89 4522 1556

Data protection enquiries: privacy@commsos.de

2. Hosting

The Comms OS platform is operated using the following service providers:

Frontend hosting: Vercel

Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. The Vercel Edge Network may process HTTP requests globally. Application data is not stored at Vercel.

Backend & database: Supabase

Supabase Inc., USA. The Supabase instance for Comms OS runs in the AWS region eu-central-1 (Frankfurt am Main). All application data (database, file storage, authentication) is processed and stored exclusively in the EU.

3. SSL/TLS Encryption

For security reasons, this platform uses SSL or TLS encryption. You can recognise an encrypted connection by the browser's address bar switching from "http://" to "https://". Data you transmit to us cannot be read by third parties.

4. User Accounts and Authentication

A user account is required to use Comms OS. The following data is collected during registration:

• E-mail address
• Password (stored bcrypt-hashed, not in plaintext)
• Name and company affiliation

Authentication is handled via Supabase Auth. Session data is stored in the browser's localStorage. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

5. Data Processing in the Portal

The following data is processed in connection with the use of Comms OS:

• Uploaded documents (invoices, contracts) — stored in Supabase Storage (EU/Frankfurt)
• Analysis data, cost data and savings recommendations — stored in PostgreSQL (EU/Frankfurt)
• The Customer's contract data and asset information

Processing takes place exclusively for the purpose of the contractually agreed analysis and optimisation of your telecom/IT procurement. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

6. Sub-processing

Comms OS processes customer data as a processor under a Data Processing Agreement pursuant to Art. 28 GDPR. The following sub-processors are used:

A Data Processing Agreement (DPA) can be provided on request; see also commsos.de/en/avv.

7. Retention Period

Your data is stored for the duration of the business relationship. After the cooperation ends, data is deleted unless statutory retention obligations apply (6 years under the German Commercial Code (HGB), 10 years under the German Fiscal Code (AO) for documents relevant under commercial and tax law).

8. Your Rights

You have the following rights vis-à-vis us regarding your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent given (Art. 7(3) GDPR)

To exercise your rights, please contact privacy@commsos.de.

You also have the right to lodge a complaint with the competent supervisory authority:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18, 91522 Ansbach, Germany
www.lda.bayern.de

9. Cookies

Comms OS uses exclusively technically necessary session cookies required to operate the platform. No tracking cookies, analytics cookies or third-party cookies are used.

A cookie banner is therefore not required, as no cookies requiring consent are used.