Privacy Policy

Last updated: 17 October 2026

1. Introduction and Scope

We, Octagonware UG (haftungsbeschränkt) (“we”, “us”, “our”), take the protection of your personal data very seriously. In accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR), this Privacy Policy explains how we process personal data when you

  • visit our website www.octahub.eu,
  • use the Octahub platform via the dashboard (dashboard.octahub.eu) or the web app (app.octahub.eu), or
  • use our mobile app “Octahub” for iOS and Android

(together: the “Services”).

In this Privacy Policy, you will learn:

  • who is responsible for the processing,
  • what data we collect and how we collect it,
  • for which purposes and on which legal basis we process it,
  • whom we share the data with,
  • where the data is stored,
  • how long the data is retained,
  • how we protect the data,
  • how we handle data of minors,
  • what rights you have,
  • how we update this Privacy Policy.

2. Controller

The controller within the meaning of the GDPR is:

Octagonware UG (haftungsbeschränkt)
Franz-Xaver-Honold-Str. 6
76149 Karlsruhe, Germany
Email: info@octagonware.com
Phone: +49 15679 655958

A data protection officer has not been appointed, as there is no legal obligation to do so.

Data we process on behalf of organizations

Organizations (e.g. associations, schools or clubs) use Octahub to manage their members, groups, content and payments. Each organization is the controller for the data of its members. We process this data solely on its behalf and according to its instructions in accordance with Art. 28 GDPR; a data processing agreement is concluded with each organization. If you are a member and have questions about this data or wish to exercise your rights, please contact your organization first.

3. What Data We Collect and How

We distinguish between two types of data:

  • Non-personal data: information that does not allow us to identify a specific individual, in particular technical and aggregated usage information.
  • Personal data: information that identifies or could reasonably be used to identify an individual, such as names, email addresses, addresses, phone numbers or IP addresses. If we combine personal and non-personal data, we treat the combined data as personal data for as long as it remains combined.

3.1 Visiting our website

When you access our website, our web server processes technically necessary data transmitted by your browser: IP address, date and time of access, page requested, amount of data transferred, previously visited page (referrer), and browser type and operating system. We need this data to deliver the website and to ensure its security (legal basis: Art. 6(1)(f) GDPR). Where this data is stored for security purposes, we delete or anonymize it after 14 days at the latest.

Our website does not set cookies, does not use any analytics, tracking or marketing services, and does not embed third-party content. Fonts are loaded from our own server.

3.2 Contact form and contact by email

If you contact us via the contact form, we process the information you provide (name, email address, organization, number of members, topic, message) as well as the language, the page from which you sent the request, and the time. Mandatory fields are marked; without this information, we cannot process your request.

Your request is transmitted in encrypted form to our automation system n8n, stored there and transferred to our customer relationship management system (CRM) Twenty. We operate both systems ourselves on servers of Hetzner Online GmbH in Germany. We are notified of new requests by email via Microsoft 365. If you contact us by email, we process your email address and the content of your message accordingly.

The legal bases are Art. 6(1)(b) GDPR where your request aims at concluding a contract, the consent you give in the form (Art. 6(1)(a) GDPR), and our legitimate interest in answering requests and maintaining business contacts (Art. 6(1)(f) GDPR).

We store your request and your contact details in our CRM until you object to the storage, withdraw your consent, or the purpose no longer applies. Statutory retention obligations remain unaffected.

3.3 Using the platform and the app

When you use the platform or the app, we process in particular:

  • access and account data (e.g. name, email address, login credentials),
  • membership and profile data (e.g. organization, groups, roles, membership plan),
  • progress data (e.g. achievements, gradings, certificates, unlocked content),
  • content uploaded by organizations or users (e.g. videos, PDFs, images),
  • payment and subscription data (e.g. selected plan, payment status),
  • technical access data (e.g. IP address, browser or device identifier), which we store for security purposes for a maximum of 14 days and then delete or anonymize.

For audience measurement in the dashboard, we use Umami, which we operate ourselves on servers of Hetzner Online GmbH in Germany. Umami does not set cookies and, according to its developer, does not store personal data; the usage data collected (e.g. pages viewed, browser, device type, country) is anonymized (legal basis: Art. 6(1)(f) GDPR; legitimate interest in improving our Services).

3.4 Payments

Paid memberships and offers are processed via the payment service providers Stripe (Stripe Payments Europe, Limited, Ireland) and PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg). For this purpose, we transmit the data required for the payment to the provider you choose (Art. 6(1)(b) GDPR). The privacy notices of the respective payment service provider also apply.

3.5 Downloading the app

When you download the app via the Apple App Store or Google Play, the data required for this (e.g. your store account) is processed by Apple or Google under their own responsibility. We have no influence on this processing.

3.6 Group chat (optional)

Organizations can enable a group chat in the app for individual groups. If the chat is enabled, we process the message content, the sender, the recipients (group, or individual member for direct messages) and the time. Messages in a group are visible to the members of that group; direct messages are only visible to the sender and the recipient. As with other member data, the respective organization is the controller; we process chat data on its behalf (see section 2).

Retention period of chat messages: chat messages are retained for one year after they are sent and then deleted.

Encryption: chat messages are transmitted in encrypted form (TLS) but are not end-to-end encrypted. They are stored on our servers and are therefore technically accessible to us as the operator.

3.7 Push notifications

The app can send you push notifications, e.g. for new chat messages from members of your group or announcements from your organization. To send them, we use the Expo Push Service, which forwards notifications to Google Firebase Cloud Messaging (Android) or the Apple Push Notification Service (iOS). To deliver them, a device-specific identifier (push token) and the content of the notification are transmitted to these services. You only receive push notifications if you have allowed them on your device; you can disable them there at any time (legal basis: Art. 6(1)(b) GDPR).

4. Why We Process This Data

We process your data for the following purposes:

  • to provide and operate our Services;
  • to further develop, customize, and improve our Services;
  • to respond to your feedback, requests, and inquiries and to provide support;
  • to analyze usage and demand patterns in anonymized or aggregated form;
  • for other internal, statistical, and research purposes, using anonymized data where possible;
  • to enhance our data security and fraud prevention capabilities;
  • to investigate violations, enforce our terms, and comply with legal obligations and orders of authorities;
  • to send you news and information related to our Services. We only send promotional emails if you have consented or if this is permitted under Section 7(3) of the German Act against Unfair Competition (UWG). You can object at any time via the unsubscribe link in the email or by contacting us.

5. Legal Bases

We process personal data on the following legal bases:

  • Art. 6(1)(a) GDPR (consent), e.g. via the contact form or for promotional emails;
  • Art. 6(1)(b) GDPR (contract or pre-contractual measures), e.g. to provide the platform, the app and support;
  • Art. 6(1)(c) GDPR (legal obligation), e.g. retention obligations under commercial and tax law;
  • Art. 6(1)(f) GDPR (legitimate interests). Our legitimate interests are secure and stable operation, answering inquiries, maintaining business contacts, and improving our Services. We only process data on this basis where your interests and fundamental rights do not override them.

6. Who We Share This Data With

To operate our Services, we use service providers that process data on our behalf (processors under Art. 28 GDPR) and are contractually bound to data protection:

  • Hetzner Online GmbH, Germany (hosting of the website, platform, n8n, CRM Twenty and Umami; storage of uploaded files in Hetzner Object Storage; data center in Nuremberg)
  • Mittwald CM Service GmbH & Co. KG, Germany (email services)
  • Microsoft Ireland Operations Limited, Ireland (Microsoft 365, email)
  • Mailgun Technologies, Inc., USA (sending system emails, e.g. invitations)
  • Google (Firebase Cloud Messaging, delivery of push notifications on Android devices)
  • Apple (Apple Push Notification Service, delivery of push notifications on iOS devices)
  • Expo (650 Industries, Inc., USA; Expo Push Service, forwarding push notifications to Firebase and Apple)
  • New Relic, Inc., USA (logging and error analysis, anonymized, no IP addresses stored)

For payment processing, we transmit data to Stripe and PayPal (see section 3.4).

Beyond that, we only disclose data where necessary

(i) to investigate, detect, prevent, or address illegal activities or misconduct;

(ii) to establish, exercise, or defend our rights;

(iii) to protect our rights, property, or the safety of our users or the public;

(iv) in the event of a change of control at our company or an affiliate (e.g., merger, acquisition, or sale of substantially all assets), insofar as this is permitted under data protection law;

(v) to comply with legal obligations or orders of authorities.

We may share non-personal data at our discretion.

Cookies and Similar Technologies

For more information, please see our Cookie Policy.

Advertising Partners/Networks

We do not share your email address or other personal data with advertising companies or advertising networks without your consent.

7. Where We Store the Data

We generally store personal data on servers in Germany. Some of the service providers listed in section 6 are based in the USA or may transfer data there. Data is only transferred to countries outside the European Economic Area (EEA) if the requirements of Art. 44 et seq. GDPR are met, in particular on the basis of the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework (Art. 45 GDPR), insofar as the recipient is certified under it, or on the basis of EU standard contractual clauses (Art. 46(2)(c) GDPR). We put appropriate contractual arrangements in place to ensure that recipients implement adequate safeguards and comply with applicable laws.

8. How Long We Retain Data

We retain personal data only for as long as necessary for the purposes stated, in particular to provide our Services, comply with our legal and contractual obligations, resolve disputes, and enforce our agreements. Specifically:

  • technical access data: a maximum of 14 days;
  • contact requests: until you object, withdraw your consent, or the purpose no longer applies (see section 3.2);
  • content on the platform: until deleted by the organization or until the end of the contract; it is then deleted unless statutory retention obligations apply;
  • chat messages: one year after sending, then deleted;
  • contract and billing data: for the duration of the statutory retention periods, in particular under commercial and tax law.

We correct, complete, or delete inaccurate or incomplete data.

9. How We Protect the Data

We protect your data against loss, manipulation, and unauthorized access through technical and organizational measures. These include, in particular, encrypted transmission (HTTPS/TLS), access controls, and regular security updates.

Despite these measures, no transmission or storage on the internet can be completely secure. We therefore encourage you to use strong passwords. Since email and instant messaging are not considered secure communication methods, please do not send us particularly sensitive information via these channels.

10. Minors

Octahub is used by organizations; the app itself contains no content. The respective organization alone decides which content (e.g. videos, images and documents) it provides in the app and to which members it issues access. It therefore also decides whether and from what age minors are given access, and is responsible for obtaining, where required by applicable law, the consent of parents or legal guardians and for selecting age-appropriate content. We do not set a minimum age of our own. If you are a parent or legal guardian and have questions about your child’s data, please contact the organization (see section 2) or us.

11. Your Rights

Under the GDPR, you have the following rights:

  • access to the data stored about you (Art. 15 GDPR);
  • rectification of inaccurate data (Art. 16 GDPR);
  • erasure of your data (Art. 17 GDPR);
  • restriction of processing (Art. 18 GDPR);
  • receiving the data you provided in a structured, commonly used, and machine-readable format (Art. 20 GDPR);
  • withdrawal of consent with effect for the future (Art. 7(3) GDPR); the lawfulness of processing carried out before the withdrawal remains unaffected;
  • lodging a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany, www.baden-wuerttemberg.datenschutz.de.

Right to object (Art. 21 GDPR): You have the right to object at any time, on grounds relating to your particular situation, to the processing of your data based on Art. 6(1)(f) GDPR. Where your data is processed for direct marketing, you may object at any time without giving reasons.

These rights apply within the limits set by law; for example, a statutory retention obligation may prevent erasure (Art. 17(3) GDPR). To exercise your rights, simply send a message to info@octagonware.com.

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

12. California Consumer Privacy Act (CCPA) Rights

If you are a California resident using the Services, you may have the right under the California Consumer Privacy Act (CCPA) to request access to and deletion of your personal data. To exercise these rights, please contact us using the information below.

We do not sell users’ personal data for CCPA purposes.

13. Updates or Changes to This Privacy Policy

We update this Privacy Policy when our Services or the legal situation change. The version published on this page applies; the date of the last update is shown above. We will also inform you of material changes on our website.

14. Contact

If you have any questions about the Services or the data we process about you, please contact us at:

Octagonware UG (haftungsbeschränkt)
Franz-Xaver-Honold-Str. 6
76149 Karlsruhe, Germany
Email: info@octagonware.com