Menu

Home
Login Start for free

Data protection declaration

With this data protection declaration we would like to inform you about the kind, scope and purpose regarding the processing of personal data ( subsequently only referred as "data" ). Personal data means all data that has a personal relation to you, e.g. name, address, e-mail address or your user behavior. This data protection declaration applies to all data processing operations conducted by us both within the scope of our core activity and for the online media we maintain. Please note that in case of doubt the German version applies.

Controller for data processing

The controller within the meaning of the General Data Protection Regulation (GDPR) for the processing described in this data protection declaration is the operator of SavePaperwork. You can find the complete contact details in our Imprint .

This data protection declaration also applies on the pages of businesses that use our software, wherever we process data there ourselves, for example for web analytics. These businesses state their own details in the imprint on their pages.

For data protection matters, please contact the email address provided in the Imprint with the subject "Data Protection".

Processing of your data as part of the core activity of our company

If you are our customer or business partner or are interested in our services, the kind, scope and purpose of processing your data is based on the contractual or pre-contractual relationship existing between us. In this sense, the data processed by us includes all those data which are or were supplied by you for the purpose of using the contractual or pre-contractual services and which are required to process your inquiry or the contract made between us. As far as nothing else results from the further references of this data protection declaration, the processing of your data as well as their passing on to third parties is restricted to those data which are necessary and purposeful to answer your inquiries and/or to fulfill the contract concluded between you and us, to protect our rights as well as to fulfill legal obligations. We will inform you of which data is required for this purpose before or during the data collection process. If we use third party providers to provide our services, the data protection information of the respective third party provider applies.

Concerned data:
  • Asset data (e.g. names, addresses)
  • Payment data (e.g. bank details, invoices)
  • Contact details (e.g. e-mail address, telephone number, postal address)
  • Contract data (e.g. subject of contract, contract period)
Affected persons:

Interested persons, business and contract partners

Intended use:

Management of contractual services, communication and answering of inquiries, office and organizational procedures

Legal base:

Fulfilment of contract and pre-contractual inquiries, Art. 6 para. 1 lit. b GDPR, legal obligation, Art. 6 para. 1 lit. c GDPR, legitimate interest, Art. 6 para. 1 lit. f GDPR

Your rights according to the GDPR

According to the GDPR you are granted the following rights, which you can assert at any time:

Right to receive disclosure

You have the right to demand information from us about whether and which of your data we process.

Right of rectification

You have the right to request the correction of incorrect data or the completion of incomplete data.

Right for Deletion

You have the right to demand the deletion of your data.

Right of restriction

In certain cases you have the right to demand that we only process your data to a limited degree.

Right of data transferability

You have the right to request that we transfer your data to you or another responsible representative in a structured, common and machine-readable format.

Right of Complaint

You have the right to complain to a supervisory authority. The supervisory authority of your usual place of residence, your workplace or our office is responsible.

Right of withdrawal

You have the right to revoke your consent to data processing at any time.

Right of contradiction

You have the right to contradict at any time the processing of your data, which we rely on our legitimate interest according to art. 6 paragraph 1 letter f GDPR. If you make use of your right of contradiction, we would ask you to explain the reasons. We will then no longer process your personal data unless we can prove to you that compelling reasons for data processing worthy of protection outweigh your interests and rights.

Regardless of the above, you have the right to contradict the processing of your personal data for the purposes of advertising and data analysis at any time. Please direct any objection to us. Independently of that, you may revoke any consent already given for Microsoft Clarity or external content at any time via Cookie settings. We do not enable Microsoft Ads permissions; external services are only loaded according to your selection.

When do we delete your data

We delete your data when we no longer need them or when you tell us to do so. This means that - unless otherwise stated in the individual data protection notices in this privacy policy - We delete your data,

  • if the purpose of the data processing has ceased to exist and thus the respective legal base mentioned in the individual data protection notices no longer exists, e.g.
  • if you make use of your right of revocation and no other legal base for the processing within the meaning of Art. 6 para. 1 lit. b-f GDPR intervenes,
  • if you make use of your right of contradiction and no compelling reasons worthy of protection oppose the deletion.

Insofar as we have to retain (certain parts of) your data for other purposes, however, because this is required for example for tax retention periods (usually 6 years for business correspondence or 10 years for accounting records) or for the assertion, exercise or defence of legal claims arising from contractual relationships (up to four years) or the data is used to protect the rights of another natural or legal person, we will not delete (that part of) your data until after these periods have expired. Until the expiry of these periods, however, we will limit the processing of this data to these purposes (fulfilment of the storage commitments).

Cookies & Web Technologies

We use necessary technologies as well as optional analytics and external content on the basis of consent.

Cookie Details
Necessary technologies

Essential for sessions, security, sign-in, and core functions.

Analytics

After your consent, Microsoft Clarity helps us analyze usage and usability.

External content

Google Maps, OpenStreetMap maps and YouTube are only loaded after your approval.

Website hosting

For the hosting of our website we use a provider on whose server our website is stored and made available for retrieval on the Internet. The provider may process all data transmitted via the browser used by you that are generated when using our Internet pages. This includes in particular your IP address, which the provider requires in order to be able to deliver our online offer to the browser you are using, as well as all entries made by you via our website. In addition, the provider used by us can

Collected Server Logs
  • the date and time of access to our website
  • Access status (HTTP status)
  • the type of browser you use as well as its version
  • the operating system you use

gather. The above-mentioned data is stored as log files on the servers of our provider. This is necessary to ensure the stability and security of the operation of our website.

TrafficPlex GmbH (lima-city)

Konsul-Smidt-Str. 90, 28217 Bremen, Germany
Visit website

E-mail shipping

Besides the hosting of our website, we also ship via our provider, i.e. the mail server (e-mail transmission/reception/storage) is also hosted by this provider. For this purpose, our provider processes the e-mail addresses of the recipients and senders as well as other data (meta-communication data such as time, IP address, etc.) arising from e-mail communication and the content of the respective e-mails. We use the universally applicable transmission protocol Transport Layer Security (TLS) for the secure transmission of e-mail content.

TLS Encryption SSL Protection Secure SMTP

Web analytics with Microsoft Clarity

We use Microsoft Clarity to better understand how our website is used, which navigation paths are taken, and where technical issues may occur. The Clarity script is loaded with consent denied by default. Analytics cookies and the actual analytics functionality are only activated after your consent.

Data processed
  • Usage and interaction data, such as page views, clicks, scroll behavior, and dwell time
  • Device and browser information, such as device type, screen size, browser type, and operating system
  • Technically required communication data such as shortened IP address, referrer information, and timestamps
  • Content from heatmaps and session replays in pseudonymized form
Scope and purpose
  • Analysis of usage, reach, error sources, and usability of our public pages and portals
  • Session replays and heatmaps help us identify drop-offs, display issues, and heavily used areas
  • Microsoft processes the data as our service provider for the provision of Clarity; we do not activate Microsoft Ads
  • You can revoke your consent at any time for the future via Cookie settings

Information about the Clarity cookies set by Microsoft, their retention periods, and further privacy details can be found in Microsoft's privacy statement.

View Microsoft's privacy statement

Contacting

If you contact us via e-mail, social media, telephone, fax, post, our contact form or otherwise and provide us with personal data such as your name, telephone number or e-mail address or provide further information about yourself or your request, we will process this data to answer your request within the scope of the pre-contractual or contractual relationship existing between us.

  • Communication and answering contact requests, office and organizational procedures
  • Fulfilment of contract and pre-contractual inquiries, Art. 6 para. 1 lit. b GDPR, legitimate interest, Art. 6 para. 1 lit. f GDPR

Registration, login and user account

You have the opportunity to register on our online-medium to create a user account. For this purpose, it is necessary to enter personal data resulting from the input mask. The data required includes in particular your name, your e-mail address and a password. This data is stored and processed by us in order to set up a user account for you and to enable (repeated) sign in. The data can be changed or deleted by you at any time. The data will not be passed on to third parties unless this is necessary for the technical and organizational processing of the existing user contract between us.

You may optionally use Google or Apple to sign in or register. In that case, we receive a unique user identifier, your verified email address, and - if provided by the provider - your name. Apple may provide a private relay address instead of your real email address. We do not store OAuth access or refresh tokens permanently.

Moreover, we would like to bring to your attention that we will delete the data collected during registration as well as the content data stored in the account as soon as you delete your account, unless there are contrary legal obligations to keep records. We therefore ask you, insofar as you wish or need to access the content data stored in your account even after deletion of your account, to save this data elsewhere before deleting the account.

Entries and requests on plan-it-now.com

plan it now (plan-it-now.com) is a brand of SavePaperwork. Besides the booking pages of businesses that use our software, plan it now shows entries for other businesses, built from public data: for companies as well as for sole traders and partnerships. Anyone can report an entry, and a business can have its entry corrected or removed, or take it over. This section is our privacy information for the people these entries concern (Art. 14 GDPR). The same text appears on the page “Where the data comes from” on plan-it-now.com.

Entries currently come from these countries: Austria, Belgium, France, Germany, Italy, Netherlands, Poland, Spain, Switzerland, Türkiye, United Kingdom.

Controller: the operator of SavePaperwork. You will find the name and contact details in our imprint. For any question about these entries, including your rights, please write to the e-mail address given there with the subject “Data protection”.

Entries

An entry names a business, its trade and its address. Where one person or a partnership runs the business, these details relate to people and are personal data; the same applies where a company name contains the name of a person. This information therefore covers every entry, whatever the legal form of the business.

Source: the Places data of the Overture Maps Foundation (overturemaps.org), a publicly accessible dataset under open licences that passes on data from providers such as Meta, Microsoft, Foursquare and AllThePlaces. Each entry names its provider and the date that provider gives for its details. Categories of data: name of the business, trade, address with map position, provider and its date. For a company whose name carries a legal form in which no person is personally liable, the entry also shows a phone number from the source. From sole traders and partnerships we take over no phone number; their entry shows one only if the owner has entered it or expressly confirmed it. Internally we also keep the identifiers of the entry in the source, the legal form we read from the name and keys derived from name and postcode.

Some entries do not come from Overture but from the business's own website: from the legal notice that a business has to publish by law, or from the business and contact details it publishes there. From those pages we take the business name, the legal form where the name carries one, the trade and the address, and for a business with a legal form in which no person is personally liable also a phone number, mobile numbers included. We retrieve those pages once a month. For a sole trader the business name can be the person's own name. Other names of people on the page, for example of owners, managing directors or those responsible for the content, and e-mail addresses are discarded while the page is read; we do not store them, unless a name is part of the business name itself. The source of these details is the business's own website, a publicly accessible source (Art. 14 para. 2 lit. f GDPR). To find a business's website, we also use public directories and map services. We work out the map position from the address with OpenStreetMap data.

Purposes: people should be able to find and reach a business, and we run plan it now as an overview of local businesses. Legal basis: Art. 6 para. 1 lit. f GDPR. Our legitimate interests are these: we want as many people as possible to find plan it now, and we want businesses to get to know our booking software through their entry, which offers them to take it over free of charge; a business that uses our software gets a booking page. People looking for a business have an interest in finding its address, and a business has an interest in being found where its details are public anyway. We have weighed these interests against yours and limit an entry to what is needed: no phone number of a sole trader or partnership without the owner's own consent, no e-mail address, no website, no photos, no reviews and no list or search on this site that contains the entry.

Recipients: anyone who opens an entry, including search engines, to which our sitemap announces entries; our hosting and e-mail provider in Germany, which processes the data on our behalf; and, for entries taken from a business's own website, komoot's geocoding service Photon. It receives only the address, without a name, so that we can work out the map position. If someone plans a route from an entry, their browser passes the name and address of the business to the map service. We do not sell the data and pass it on to no one else. We do not transfer it to countries outside the EU or the EEA.

We do not write to each business individually. The entries concern several hundred thousand businesses in several countries, the source changes every month and some of its details are years old, so many letters would reach businesses that no longer exist. That effort would be out of proportion to the effect of an entry: it shows only details that are public anyway, and any business can have it removed at any time. We therefore publish this information instead and have documented our assessment (Art. 14 para. 5 lit. b GDPR).

Storage period: an entry stays online only as long as the source lists the business. If we have not been able to update our data for 45 days, it goes offline by itself. If a business has its entry removed or objects to it, we delete the entry. We then keep only keys derived from its identifiers in the source and from its name with postcode, so that a later release of the source does not bring it back, and we keep these keys for as long as the removal stands. We cannot change the public source data itself. We skip every entry whose key is blocked when we build our monthly working copy and again when we import it; working copies made before the removal are replaced within the next two monthly updates. Copies in our backups and in those of our hosting provider are no longer used and are overwritten as the backups are regularly rotated.

Your rights: you can ask us whether and which data about you we process (Art. 15 GDPR), have incorrect data corrected (Art. 16 GDPR), and have data erased (Art. 17 GDPR) or its processing restricted (Art. 18 GDPR). On an entry, use “Is this your business?”; for anything else, write to the e-mail address in our imprint. We usually handle a request within 7 days and always within one month. You can also complain to a data protection supervisory authority, in particular in the EU member state where you live or work or where you consider the infringement to have taken place (Art. 77 GDPR).

The supervisory authority responsible for us is Bayerisches Landesamt für Datenschutzaufsicht (BayLDA). In the EU countries from which our entries come, you can also turn to these supervisory authorities:

Right to object

You can object at any time to the entry about your business (Art. 21 GDPR). You do not have to give reasons: we remove the entry, usually within 7 days, and keep it from coming back. Use “Is this your business?” on the entry and choose “Remove”, or write to the e-mail address in our imprint with the link to the entry.

We assign each entry to one of our trades automatically and read its legal form from the name; the legal form only decides whether an entry shows a phone number from the source. We take no decision based solely on automated processing that has legal effects on you or similarly significantly affects you (Art. 22 GDPR), and we do not build profiles.

Reporting an entry

When you report an entry, we process the reason you choose, your optional text and, if you give one, the link to another entry. We do not ask for your name or e-mail address and store no IP address with the report; our server uses your IP address only briefly, to limit repeated reports. Legal basis: Art. 6 para. 1 lit. f GDPR, our interest in correct entries. We delete the report 90 days after we have handled it. Copies in our backups and in those of our hosting provider are no longer used and are overwritten as the backups are regularly rotated.

Requests from a business (“Is this your business?”)

When you send a request, we process your e-mail address, the entry concerned, what you ask for, the changes you propose and your statement that the business is yours or that you act for it. We send a confirmation link to the address, look at the confirmed request and send you the result at the same address. Legal basis: Art. 6 para. 1 lit. f GDPR, our interest in changing an entry only at the request of the business; where you exercise a right under the GDPR, Art. 6 para. 1 lit. c GDPR in conjunction with Art. 12 GDPR. If the business is run by one person or a partnership, its entry shows a phone number only if the owner enters it or expressly confirms it. We store that consent with its date and time (Art. 6 para. 1 lit. a GDPR). It can be withdrawn at any time; the entry then shows no phone number. After a withdrawal we delete the number at once. As proof of the consent we keep, on the basis of Art. 6 para. 1 lit. c GDPR in conjunction with Art. 7 para. 1 GDPR, only a record of when it was given and when it was withdrawn. We delete that record 3 years after the end of the year in which the consent was withdrawn. An unconfirmed request is deleted 72 hours after it was sent. We delete your e-mail address 30 days, and the rest of the request 90 days, after we have handled it. If you take an entry over, we keep two things for as long as you maintain the entry, so that we recognise a later request from you: a key derived from your e-mail address, and the domain of that address. The domain also shows whether your address matched the business's website when you took the entry over. We do not keep the address itself. Copies in our backups and in those of our hosting provider are no longer used and are overwritten as the backups are regularly rotated.

We protect both forms with ALTCHA, a method against automated submissions that runs in your browser and on our server without any third-party service. The notice that a new report or request has arrived reaches us without any personal data.

If you are in the United Kingdom: the UK GDPR and the Data Protection Act 2018 apply as well, with the same articles and the same rights as described above. If you want to complain about how we handle data about you, please write to us first at the e-mail address in our imprint; we acknowledge your complaint within 30 days and tell you the outcome. You can also complain to the Information Commissioner's Office (ico.org.uk).

Security arrangements

Furthermore, we take technical and organizational security arrangements according to the latest state of the technology in order to ensure compliance with the regulations of the data protection laws and to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or against unauthorized access by unauthorized individuals.

Up-to-date and amendment of this privacy policy

This privacy policy is currently valid and reflects the status of October 2026. Due to changes in legal or regulatory requirements, it may become necessary to amend this privacy policy.

Registration origin

With your analytics consent, our own analysis records the referring host and transitions between our brand domains. The signed spw_registration_journey cookie lasts up to 30 days from the first recorded visit. On registration, the observed route is stored with your account until the account is deleted. We do not store full referring URLs or search terms. You can withdraw consent in the cookie settings; this stops further collection and removes the cookie on that domain.