Privacy policy

This privacy policy is also published in German (Datenschutzerklärung).

1. Controller

The controller responsible for data processing on this website is:

2. Summary

This website sets no cookies, uses no analytics or tracking services of third parties and loads no content from third parties; fonts and all other files are served from our own web server. We only process personal data when you visit the website (server logs, including our status page and our free tools), when you contact us through a form, by email or by telephone, when you arrange a video call or book a call with us, when you work with us as a referral partner, and when we contact you as a business prospect, including the links in our e-mails (Section 8). Orders are placed in our application; its privacy notice describes how we process order and payment data.

The application BitHive Reporting Desk at app.bithive-it.com has its own privacy notice, published under Legal documents.

3. Hosting and server logs

This website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, on servers in Germany. STRATO processes the data described in this section on our behalf as a processor (Art. 28 GDPR); the data processing agreement is part of our contract with STRATO.

When you open a page, the web server records each request in a log file (server log). Each entry contains: the IP address of the requesting device; the date and time of the request; the request line (method, requested address including any parameters, protocol); the HTTP status code; the amount of data transferred; the address of the page from which you came (referrer), if your browser sends it; and the browser identification (user agent), which contains information on your browser and operating system.

We need these data to deliver the website and to keep it stable and secure, for example to detect and investigate errors and attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is delivering the website and operating it in a stable and secure way.

STRATO deletes the server logs after about six weeks, and error logs after a shorter period. We do not download the logs, do not combine them with other data and do not use them to identify or profile visitors. Only to investigate a specific security incident do we download the logs concerned, and we keep them until the investigation is complete.

4. Encryption

Traffic between your browser and our server is encrypted with TLS, indicated by “https://” in the address bar.

5. Forms, email and telephone

When you contact us through a form on this website (contact, account or partner request) or by email, we process your name, email address, optionally your company, and the content of your message in order to answer your request. The content of form submissions is not stored on the web server; it is sent directly as an email to our mailbox hosted by STRATO.

If you ask to become a referral partner, we use your details to check the request and, if we agree, to prepare the referral agreement with your company (Art. 6(1)(f) GDPR – our interest in answering and setting up business partnerships). If no agreement follows, we delete the request under the same rules as other requests in this section.

When you request a trial, you also state the country of your company. We use it to check whether we sell BitHive Reporting Desk to companies in that country. The legal basis is Art. 6(1)(b) GDPR. If we do not yet sell there, you can instead ask us to email you once when we offer BitHive Reporting Desk in your country (waiting list). For this we process your email address, the country you state and the time of your request. Like other form messages, the entry reaches our mailbox and is not stored on the web server. We use it only for that one email. The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by sending the waiting-list form. You can withdraw it at any time with effect for the future by writing to contact@bithive-it.com. We delete the entry after that email, or at the latest 12 months after your request, whichever comes first, or earlier if you withdraw your consent.

For account requests we accept only business e-mail addresses. For all messages we check that the domain of the address you enter can receive e-mails. To protect the forms against spam and abuse, we limit the number of messages per e-mail address and per IP address within 24 hours. For this purpose, the web server keeps keyed hash values of your IP address and of the e-mail address you enter, together with the times of your submissions, and deletes them within 48 hours. The values cannot be traced back to you without the key, and they are not combined with other data. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting the forms and our mailbox against abuse.

The legal basis is Art. 6(1)(b) GDPR where your request concerns entering into or performing a contract, and Art. 6(1)(f) GDPR otherwise. Our legitimate interest is answering requests addressed to us.

We delete your request once it has been fully handled, unless statutory retention obligations – in particular under German commercial and tax law for business correspondence – require us to keep it. In that case we delete it when the retention period ends.

If you call us, our telephone provider easybell GmbH, Berlin, transmits your telephone number (unless you suppress it) and the time of the call to us, and we process what you tell us in order to deal with your request. We use these data only to deal with your call (Art. 6 (1) (b) GDPR where your request concerns entering into or performing a contract, Art. 6 (1) (f) GDPR otherwise; our legitimate interest is answering requests addressed to us). We delete the entries in our call lists once your request has been dealt with, unless statutory retention obligations apply. easybell processes connection data as a telecommunications provider under its own responsibility; it deletes the call lists in our telephone account after six months at the latest.

6. Video calls (Google Meet)

If we arrange a video call with you, it takes place on Google Meet. We enter the appointment (your name, your e-mail address and the time) in the calendar of our Google account, which also creates the Meet link and sends you the invitation. When you join, Google processes your name or the display name you enter, your email address if you join with a Google account, your IP address and device information, and, for the duration of the call, audio, video and any screen content you choose to share. We do not record calls.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes these data as an independent controller under its own privacy policy (policies.google.com/privacy (opens in a new tab)); we do not determine how Google uses them. According to Google, data may be transferred to Google LLC in the USA on the basis of Google's certification under the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and of the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

The legal basis for entering the appointment in our calendar and for holding the call is Art. 6(1)(b) GDPR, as the call serves to prepare a possible contract, and Art. 6(1)(f) GDPR otherwise; our legitimate interest is holding the call we have arranged with you. We delete the calendar entry once it is no longer needed for the call and its follow-up. If you prefer not to use Google Meet, tell us when we arrange the call and we will call you by telephone instead.

7. Status page

Information on the availability of BitHive Reporting Desk and on planned maintenance is published on our status page at bithive-it.com/status. It is part of this website: Section 3 applies, and it sets no cookies and loads no third-party content.

Free tools (deadline pages and SBOM check): What you enter on these pages, and any file you select, is processed only in your browser and is not transmitted to us. When you open a tool, your browser loads the page and, for the SBOM check, the vulnerability dataset from our web server; this processes the access data described in Section 3.

8. Business contacts and outreach

We contact companies by letter, at events and, in some countries outside the EU (the United Kingdom, the United States, Canada and Australia), by e-mail. For this we use business contact details that the company itself has published (company name, address, role or department, business e-mail address and, where the company publishes it, the name of the contact person), the page and date where we found them, and the dates of our e-mails and any replies, opt-outs and bounces. At events, we use the details people give us themselves. Purpose: offering our service to businesses; legal basis: our legitimate interest in doing so (Art. 6(1)(f) GDPR and, for recipients in the United Kingdom, the UK GDPR). We send these e-mails from the domain bithive-it.net through our mailbox at Heinlein Hosting GmbH (mailbox.org), Berlin, Germany. The contact data and our send records are stored on our server at Hetzner Online GmbH, Germany. Both act as our processors. We never buy or guess addresses and use no tracking pixels. Apart from the unsubscribe link, which identifies only the address to be removed, the links in our e-mails carry no personal identifier, and clicks on them are counted only as totals per link and day (see "Counting link clicks"). We read and answer replies ourselves. After our short series of e-mails, recipients in the United Kingdom and the United States may receive up to six issues of our monthly newsletter, each with a link to stop it. We delete the data of contacts who do not respond six months after the last e-mail we send them (our series and at most six newsletter issues). If you reply, we keep our correspondence as long as the conversation lasts and delete it 12 months after our last exchange, unless commercial or tax law requires us to keep it longer. We keep a record of the source and the dates of our messages for three years to answer complaints, and a list of addresses that asked us to stop for as long as we send such e-mails, so that we never write to them again. You can object at any time: reply "no", use the link in the e-mail, or write to contact@bithive-it.com or contact@bithive-it.net; we then stop at once.

Right to object to direct marketing: you may object at any time, without giving reasons, to the use of your data for direct marketing (Art. 21(2) and (3) GDPR). An informal message to contact@bithive-it.com is sufficient; we will then no longer use your data for this purpose.

Referral partners: if your company is a referral partner of BitHive, we process the names and business contact details of your representatives, the partner agreement, statements and invoices to perform the agreement and to meet our accounting duties (Art. 6(1)(b), (c) and (f) GDPR). Invoices are kept for eight years and the agreement and statements for six years from the end of the calendar year (§ 147 AO, § 257 HGB). Other data are deleted when they are no longer needed.

Counting link clicks

Links in our outreach e-mails lead through our redirect address go.bithive-it.net. Each of these links names only the campaign (in an e-mail series also the step) and the page it leads to, and it is the same for everyone who receives it. When you click, our server in Germany adds one to that day's total for the link and forwards you to the page the link names: a page of our website or of our application, our booking page at Calendly (see "Booking a call"), or our company page on LinkedIn, where LinkedIn's own privacy policy applies. The counter stores only totals per link and day, with no IP address and no link to recipient lists. We delete the daily totals after 24 months. The redirect sets no cookies, and these e-mails contain no tracking pixels and request no read receipts. The only personalised link is the unsubscribe link, which is also in the e-mail header for one-click unsubscribing. It contains a code for your address so that you can unsubscribe with one click. We use this code only to carry out your unsubscribe request, never to count clicks.

Like any web server, the redirect server receives your IP address and browser information in order to answer your request, but it keeps no record of individual requests: it writes no access log and stores no IP address, and the unsubscribe code appears in no log. Our hosting provider, Hetzner Online GmbH, Germany, runs the server and stores its backups in Germany on our behalf. Of the click data, the database and its backups hold only the totals; the database's recovery records, which the backups keep for up to five weeks, also show when a total changed, without any IP address and without any link to a recipient.

Legal basis: Art. 6(1)(f) GDPR (and, where it applies, the UK GDPR). Our legitimate interests are the secure operation of our servers and an aggregated view of how readers reach our website and which content they find useful, so that we can improve our website and the information we send.

Your right to object: you can object to the counting at any time, free of charge. Write to contact@bithive-it.com or contact@bithive-it.net, or reply "no counting" to one of our e-mails, and we will then send you links that are not counted.

Booking a call

If you book a call with us, you do so on a booking page of Calendly LLC (USA), which processes your name, e-mail address, company and the chosen time for us as our processor. Calendly is certified under the EU-U.S. Data Privacy Framework; the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR). Legal basis: steps prior to a contract at your request, otherwise our legitimate interest in arranging the call (Art. 6(1)(b) and (f) GDPR). We delete the booking data six months after the call unless a business relationship follows. On Calendly's page, Calendly's own privacy notice applies to its cookies.

9. Links to other websites

This website contains plain links, for example to our LinkedIn company page. No data is sent to the provider unless you click the link. After clicking, the provider’s own privacy policy applies.

10. Your rights

You have the following rights regarding personal data concerning you:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)

Right to object under Art. 21 GDPR

Where we process data on the basis of Art. 6(1)(f) GDPR, you may object to this processing at any time on grounds relating to your particular situation. You may object to direct marketing at any time without giving reasons (Section 8). An informal message to contact@bithive-it.com is sufficient.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority competent for us is the Berlin Commissioner for Data Protection and Freedom of Information (www.datenschutz-berlin.de (opens in a new tab)).

11. Obligation to provide data, automated decisions

You are not obliged to provide personal data. Without your contact details, however, we cannot answer your request. No automated decision-making, including profiling, takes place.

Last updated: October 2026