Coreby OffGROUND

Legal

Privacy Policy

for the Core website and sign-up

Version 1.0 · Status: October 2026 (Stand: Oktober 2026)

Only the German text is legally binding. This English version is a convenience translation.

This policy applies to the Core sales website, the waiting list and the sign-up with payment. You are responsible for the data you store in your own Core. OFFGROUND processes it there on your behalf (see the DPA).

1 Controller

OFFGROUND, Inh. Danijel Radulovic, Sallerweg 22, 81476 München, Germany

Email: info@offground.solutions

Telephone: +49 89 904 236 600

2 Visiting the website

When you open the website, our server automatically processes: your IP address, date and time, the address requested, the status code, the amount of data transferred, the referring page, and details of your browser and operating system (server log files). We need this to deliver and secure the website (Art. 6 (1)(f) GDPR). We keep the log files for 30 days and delete them afterwards.

The website is hosted by Contabo GmbH (Germany) on servers in the European Union. The website loads fonts and all other files from our own server. No servers of Google or other third parties are contacted.

3 Cookies, statistics and recordings only with your consent

Without consent, the website sets only what it needs: your language choice and your answer to the cookie question. The law allows this without consent (§ 25 (2) TDDDG). We keep your answer for six months and ask again after that, or when something about the statistics changes.

Everything else loads only after your yes. In the cookie notice "Accept all" and "Necessary only" are equally easy to choose. A click on "Cookie settings" in the footer of the website changes your choice at any time. A withdrawal applies from then on; processing up to then remains lawful. The legal basis is your consent (Art. 6 (1)(a) GDPR, § 25 (1) TDDDG).

Statistics (Matomo). We count with Matomo, which runs on our own server in the EU (stats.core-hq.app). The Matomo script is loaded only after your yes; before that your browser sends nothing to it. Nothing goes to third parties. We measure page views, clicks on buttons and links, how far a page is read and the last section reached, the chosen language, and whether a visit led to the sign-up page. Your IP address is shortened before it is stored. A browser setting "Do Not Track" is respected: such visits are not counted. There is no user ID and no tracking across other websites. Matomo sets cookies that last at most 13 months. We delete the raw data of individual visits after 6 months and keep only anonymous totals. The legal basis is your consent (§ 25 (1) TDDDG and Art. 6 (1)(a) GDPR). You can withdraw it at any time with "Cookie settings" in the footer; from then on nothing is counted and Matomo's cookies are removed.

Marketing (Meta Pixel). We advertise with Meta (Facebook, Instagram). If you agree to marketing, the website loads the pixel of Meta Platforms Ireland Ltd. and tells Meta that you visited our site, which pages you look at, and whether you continue to the sign-up page. Meta also processes this data in the USA and as its own controller, secured by standard contractual clauses. Without your yes nothing loads and nothing is sent. You can withdraw marketing at any time under "Cookie settings" in the footer; afterwards the website removes the pixel cookies and sends nothing more.

Recordings (session recording). We do not record visits at the moment. If we introduce this, it will happen only with a separate, second yes, and this policy will say how before it starts.

4 Waiting list

If Core is not yet offered in your country, you can enter your email address, your country and your language. We write to you as soon as Core is available there. The legal basis is your consent (Art. 6 (1)(a) GDPR). You can withdraw it at any time, informally, to the email address above. We then delete the entry, at the latest after 12 months.

5 Sign-up, payment and contract

What we collect. At sign-up you or your business provide: name, where applicable company, email address, address (currently the countries of the European Union), where applicable VAT ID, whether you buy as a business or a private person, plan, number of users and language. Contract data is added afterwards: the time of your agreement to the terms, the DPA and, where applicable, to the start of the service, invoices, payment status, the address of your Core installation, the number of users and the admins' email addresses.

What for. We need the data to conclude and perform the contract: provide the installation, bill, inform you about trial, payment, pause, cancellation and deletion, give support (Art. 6 (1)(b) GDPR). Legal obligations such as tax and commercial law are added (Art. 6 (1)(c) GDPR).

Payment provider Stripe. You enter your payment method directly with Stripe Payments Europe, Ltd., Ireland. Your payment data never reaches us. Stripe processes data on our behalf, and Stripe Tax also calculates VAT and checks your VAT ID. For its own purposes, such as fraud prevention and legal obligations, Stripe is itself the controller. Data may reach the USA in this process. Stripe uses standard contractual clauses and further safeguards for this. More is in Stripe's privacy policy (stripe.com/privacy).

Unfinished sign-ups. If you do not finish the sign-up, we remind you once by email after about one hour. After 24 hours we delete the details and the customer record at Stripe.

Emails. We send you only emails that belong to the contract: welcome, reminder before the trial ends, payment problems, pause, payment received, cancellation, notices before your data is deleted. Our mail host webgo (Germany) sends them on our behalf (sender domain offground.biz).

6 Demo and booking

Demo installation. Under "Open demo" you enter a demo installation of Core. It contains sample data only, no real customers' data. Your visit runs over our servers: as with every page view, our server processes the details from section 2 (IP address, time, browser type). The demo is reset after one hour; everything you created in it is deleted then. The legal basis is Art. 6 (1)(b) GDPR (steps toward a contract) and Art. 6 (1)(f) GDPR (running and securing the website).

Booking an appointment. If you book a walkthrough, the booking page asks for your name and your email address and stores them with the chosen time in our own Core. We need them to keep the appointment and reach you (Art. 6 (1)(b) GDPR). If no contract is concluded, we delete this data after the appointment, at the latest after six months.

7 Who receives your data

We pass on data only as far as necessary: to our hosting provider Contabo GmbH (Germany; data centres in the EU), to Stripe, to webgo, to tax advisers and authorities where the law requires it. Contracts under Art. 28 GDPR exist with all service providers acting on our behalf. We do not sell data. The only advertising we run is our own for Core; the Meta pixel described in section 3 loads only with your consent.

8 How long we keep data

  • Server log files: 30 days
  • Matomo raw data of single visits: 6 months; Matomo cookies: at most 13 months
  • Meta pixel cookies: until withdrawal; the website removes them afterwards
  • Answer to the cookie question: six months
  • Waiting list: until withdrawal or until we have written to you that Core is available in your country, at most 12 months
  • Unfinished sign-ups: 24 hours
  • Contract, invoice and payment data: as long as tax and commercial law require, up to 10 years, then we delete it
  • Support communication: 6 years from the end of the calendar year in which the request was closed (business letters, § 147 AO); then it is deleted

We delete the content of your Core after the contract ends as described in the terms and the DPA.

9 Third countries

We process your data in the EU. A transfer to a third country takes place only with the service providers named in sections 3, 5 and 6, as far as they process data there, and only with a safeguard under Art. 44 ff. GDPR, for example an adequacy decision or standard contractual clauses.

10 Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). Where we rely on your consent, you can withdraw it at any time with effect for the future (Art. 7 (3) GDPR). If processing rests on a legitimate interest, you can object to it on grounds relating to your situation.

Write to us at the email address above. You can also complain to a supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

11 Obligation to provide data, automated decisions

Without the details in section 5, we cannot conclude a contract. There is no automated individual decision-making or profiling.

12 Changes

We update this policy when something changes, for example a service provider. The version shown on the website when you open it applies.