Privacy Policy

1. Controller
websocon UG, Stralauer Allee 23a, 10245 Berlin, Germany, is the controller for personal data processed via souveraign.io and the SCK Platform cloud Service.

2. Data we collect at signup
When you create a workspace we process: organization name, work email, optional display name, and technical metadata needed to create the account (e.g. timestamps, IP-related security logs).

3. Purposes & legal bases
We process this data to create and operate your workspace, authenticate you (including Magic Link / OTP), provide the Service, secure the platform, and communicate about your account. Legal bases typically include contract performance (Art. 6(1)(b) GDPR) and legitimate interests in securing and improving the Service (Art. 6(1)(f) GDPR).

4. Cookies & analytics
Essential cookies and similar storage needed to run the site (e.g. authentication, language/theme preferences, and your cookie-consent choice) are used as required for the Service. Optional analytics via Google Tag Manager / Google Analytics are loaded only after you actively consent (Art. 6(1)(a) GDPR). You can accept or refuse analytics in the cookie banner and change your choice anytime via “Cookie settings” in the footer. If you refuse or revoke consent, analytics tags are not loaded.

5. Recipients & processors
We use infrastructure and authentication providers necessary to run the Service (e.g. hosting, email OTP). If you consent to analytics, Google (Google Tag Manager / Analytics) acts as a processor/recipient for measurement data as configured in our Google accounts. Processors act under contracts and only on our instructions where applicable.

6. Retention
Account and organization data are retained while your workspace is active and for a limited period afterward as required for security, billing disputes, or legal obligations, then deleted or anonymized. Analytics data retention follows the settings in our Google Analytics property when consent was given.

7. Your rights
Subject to applicable law, you may request access, rectification, erasure, restriction, portability, and objection, and withdraw analytics consent at any time without affecting the lawfulness of processing before withdrawal. You may lodge a complaint with a supervisory authority (in Germany, typically your local Landesdatenschutzbehörde).

8. International transfers
If data is processed outside the EEA (including by Google when analytics is enabled), we use appropriate safeguards (e.g. SCCs) where required.

9. Contact
Privacy inquiries: use the contact options on souveraign.io or write to the operator address in the Legal notice (Impressum).