Privacy Policy
Ce document est publié uniquement en anglais. Le texte anglais fait foi.
This privacy policy explains how comci technology UG (haftungsbeschränkt) ("Pingsured", "we", "us") processes personal data in connection with the Pingsured monitoring platform (the "Service") and your rights under the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).
We have written this policy in plain language. If anything is unclear, please contact us — see "Contact" at the end.
1. Who we are
The controller responsible for processing your personal data under Article 4 GDPR is:
comci technology UG (haftungsbeschränkt) Dreieichstr. 53 63128 Dietzenbach Germany
Registered with the Amtsgericht Offenbach under HRB 59238; VAT ID DE464319421.
For privacy-related questions or to exercise any of the rights described in section 9, contact privacy@pingsured.eu.
We are not required to designate a Data Protection Officer under Article 37 GDPR or §38 BDSG given our size and the nature of our processing. If that changes, we will update this policy accordingly.
2. What this notice covers
This notice covers personal data we process in two roles:
- As a controller — data we collect about you when you visit our public website or status page, sign up for an account, or use the Service as an authenticated user (your account profile, login activity, billing records, etc.).
- As a processor — data your monitored systems return when we run checks on your behalf, and the users and notification recipients you configure. We process this data under your control and according to our Data Processing Agreement (https://pingsured.eu/legal/dpa); details specific to processor activity are governed by that document.
The sections below describe our controller activity unless otherwise stated.
3. The personal data we process
We deliberately collect the minimum data needed to provide the Service.
| Category | What it includes |
|---|---|
| Identity data | An internal user identifier we assign to you, your display name |
| Contact data | Your email address (used for service emails, login, alarm delivery) |
| Account data | Your customer-membership role, subscription tier, language preference, and the website page and campaign an account was signed up from, and whether from a mobile or a desktop device |
| Service-configuration data | The monitoring tasks and notification preferences you create |
| Result data | What your monitored endpoints return — processed as a processor (see DPA) |
| Operational data | Login timestamps, IP addresses for security and abuse prevention, server access logs |
| Website visit data | The page you view on our public website, the domain of the site that referred you, the campaign named in the link you followed, whether your device is a mobile or a desktop one, and a daily rotated pseudonymous visitor ID (see section 5) |
| Acceptance records | Which version of the Terms and DPA your account accepted, when, and from where |
| Communication data | Emails or messages you send us when contacting support |
| Status-page subscriptions | Your email address if you subscribe to notifications from our own status page |
| Billing data | Where applicable, the company name, address, VAT ID (or, outside the EU, a business registration number if you give one), and payment record |
We do not collect special categories of data (Article 9 GDPR — health, religion, etc.) and we do not knowingly process data of children under 16.
Where this data comes from
Most of the data above we collect directly from you when you interact with the Service — when you sign up, configure tasks, contact support, or simply use the platform. Some data may reach us indirectly: for example, if an admin at your organisation invites you to a customer account or sets up a task on your behalf, the contact data on the invitation comes from them, not from you.
In that case, we apply this notice to the data the same way as if you had provided it directly. You retain the rights described in section 9 against us as the controller; how the data was originally collected from you is your employer's responsibility under their own privacy notice.
4. Why we use your data, and our legal basis
The single biggest purpose, "operating your account and providing the Service," is broad on purpose: it covers the everyday activity that flows from the contract you've entered into, including running the monitoring checks you configure, computing alarm states, and storing the configuration and result data you create. The remaining rows below are activities that sit alongside the core service — security, audit, support, statutory compliance, and product communication — and have their own lawful bases because the legal analysis is different.
| Purpose | Categories used | Legal basis |
|---|---|---|
| Operating your account and providing the Service (running checks, computing alarms, storing results, sending operational and alarm notifications) | Identity, contact, account, service-config | Article 6(1)(b) GDPR — performance of the contract |
| Billing and invoicing | Billing, identity, contact | Article 6(1)(b) GDPR — performance of the contract |
| Security, abuse prevention, and platform integrity (e.g. login logs, server access logs) | Operational, identity | Article 6(1)(f) GDPR — our legitimate interest in operating a platform that is secure, reliable, and resistant to abuse for the benefit of all customers |
| Measuring how our public website is used — how many people visit, how long pages are read, and which pages and campaigns lead to sign-ups | Website visit data, account | Article 6(1)(f) GDPR — our legitimate interest in understanding which of our pages and campaigns bring customers, measured without cookies and without identifying anyone |
| Recording acceptance of the Terms of Service and the Data Processing Agreement | Acceptance records, identity | Article 6(1)(f) GDPR — our legitimate interest in maintaining an evidentiary record of when each customer accepted which version of the contract |
| Responding to support requests | Communication, identity, contact | Article 6(1)(b) GDPR — performance of the contract; and Article 6(1)(f) — our legitimate interest in handling correspondence that may go beyond strict contract performance, such as feature feedback or pre-contract enquiries |
| Sending status-page notifications you have subscribed to | Status-page subscriptions | Article 6(1)(a) GDPR — your consent, given when you subscribe and withdrawable by unsubscribing at any time |
| Promoting our own products and tier upgrades to existing customers (e.g. an "upgrade for finer-grained intervals" prompt embedded in an alarm-recovery email) | Contact, account, service-config | Article 6(1)(f) GDPR + §7(3) UWG — our legitimate interest in informing existing customers about features and tier upgrades likely to be relevant to their use of the Service; opt-out available at any time |
| Complying with statutory obligations (tax, accounting) | Billing | Article 6(1)(c) GDPR — legal obligation |
We do not sell your data, do not share it with advertisers or data brokers, do not profile you, and do not subject you to automated decision-making with legal or similarly significant effects. Article 22 GDPR therefore does not apply.
Your right to object to direct marketing. Under Article 21(2) GDPR you have an unconditional right to object to the use of your personal data for direct marketing purposes. Once you object, we stop sending promotional messages immediately, with no balancing test on our side. You can object at any time through your account notification preferences or by emailing privacy@pingsured.eu. Operational alerts (alarm delivery, billing, account-security messages) are not affected.
Whether you have to provide this data
The personal data described in section 3 is what we need to operate the contract — your account, your authentication state, the configuration you create, and a contact channel for operational notifications. Providing it is a contractual requirement: if you don't provide it (or you withdraw it later for fields we need on an ongoing basis), we cannot establish your account or continue providing the Service. Billing data is additionally a statutory requirement for invoicing and tax compliance. There is no consequence beyond the inability to use the Service — we don't fine, penalise, or otherwise sanction non-provision.
5. Cookies and similar technologies
We use only first-party cookies, and only to do something you asked for:
ory_kratos_session— set by our sign-in system when you sign in, and strictly necessary for using the Service while signed in. It ends 14 days after your last activity, or when you sign out.csrf_token_…— set when a sign-in or account form is shown, and strictly necessary to protect that form against cross-site request forgery.pingsured_locale— a one-year functional cookie that remembers your language, so the Service keeps rendering in it.pingsured_signup— set when you follow a sign-up link that names a plan, so that the plan you chose is still known after you confirm your email address. It lasts at most seven days and is removed once your account is created.pingsured_invitation— set when you open an invitation to join an account, so the sign-up form can fill in the address the invitation was sent to. It lasts one day.pingsured_notice— a one-minute cookie that lets the sign-in page confirm that your new password has been set.
Each of these is either strictly necessary for a service you requested or set only at your explicit request within the meaning of §25(2) no. 2 TDDDG, and is therefore exempt from the consent requirement under §25(1) TDDDG.
We do not set analytics, advertising, or third-party tracking cookies, and we do not embed third-party trackers on the Service, our website, or our status page.
Visit statistics without cookies
When you load a page of our public website, we count the visit on our own servers. We record the page, the domain of the site that referred you, the campaign named in the link you followed, the language and pricing presentation shown, whether your device is a mobile or a desktop one, and whether the request came from an automated client. The device is recorded as one of those two words only; your browser's identification string is read to tell them apart and is not stored.
To count visitors rather than page loads, we compute a pseudonymous visitor ID from your IP address and your browser's identification string together with a random value that we generate each day, keep only in memory, and destroy at the end of the day (UTC). The ID tells us that two page views on the same day came from the same browser — which is how we know how long a page was read and which pages people pass through on their way to the sign-up form — but it does not tell us who you are, and once the day's random value is destroyed nobody, including us, can link an ID back to an IP address. Your IP address and browser identification are not stored. At the end of each day the IDs are replaced by totals and deleted; the totals do not relate to any person.
Nothing is stored on or read from your device for this. If your browser sends a Do Not Track or Global Privacy Control signal, we count the page view without computing a visitor ID. You can also object at any time under Article 21 GDPR (section 9).
The visitor ID is never linked to your account, even if you sign up on the same day. If you sign up, your account records only which page and campaign your sign-up link came from, and whether you followed it on a mobile or a desktop device.
6. Service providers and legal disclosures
Service providers acting on our behalf
To operate the Service we rely on a small set of service providers who process data on our behalf — under our instructions, bound by data-processing agreements, and required to maintain appropriate technical and organisational security measures. They do not have independent rights to the data and may not use it for their own purposes. We disclose them here by category (role + region of processing). Those that also process data on your behalf under the Data Processing Agreement (https://pingsured.eu/legal/dpa) are named at https://pingsured.eu/legal/subprocessors, and updated there as our supplier roster changes. Our accounting software is not among them: it holds only our own billing records, never data we process on your behalf.
| Service-provider category | Region of processing |
|---|---|
| Hosting and infrastructure (platform, backups) | EU/EEA |
| Web hosting (public website, status page) | EU/EEA |
| Transactional email delivery | EU/EEA |
| Distributed monitoring-agent compute | Customer-selected per task — see section 7 |
| Accounting software (invoices, bookkeeping) | EU/EEA |
What is a material change to this notice (section 11): adding a new service-provider category, or moving a category to a different region (e.g. bringing a non-EU provider into a category that was EU-only). Swapping the named provider within an unchanged category and region — for example, replacing one EU-based transactional email provider with another EU-based one — is not a material change to this privacy notice. Where that provider acts on your behalf, the change is notified to customers through the DPA's subprocessor-change mechanism instead, with the right to object as required by Article 28(2) GDPR.
Payment provider
Payments are processed by Mollie B.V., Amsterdam, Netherlands. You enter your card details on Mollie's own payment form, so they never reach us; we receive a reference to the payment method and a masked label (for example the card brand and last four digits). Mollie processes payment data as an independent controller, not on our behalf: to carry out the payment, to prevent fraud, and to meet its own legal obligations as a licensed payment institution, such as anti-money-laundering checks. Mollie's privacy statement (https://www.mollie.com/privacy) describes that processing.
Legal disclosures
Where we are legally required to disclose data, we may do so to public authorities — for example tax authorities (statutory record keeping, and verifying an EU business customer's VAT ID with the Federal Central Tax Office under §18e UStG), courts (court orders), or law-enforcement bodies acting under valid legal authority. We scrutinise such requests for proper legal basis and push back on requests that fall short, escalating to court if appropriate.
Beyond the recipients named in this section, we do not share personal data, and we never sell it.
7. International data transfers
The personal data this notice is about — your account, identity, contact, acceptance, and billing data — is stored and processed exclusively within the European Union, on infrastructure physically located in the EU. We may shift between EU/EEA data-centre locations as our hosting provider's footprint changes; that does not constitute an international transfer under Chapter V GDPR. We do not transfer that data to recipients outside the EU/EEA.
The Service does, however, run distributed monitoring agents that execute the checks you configure. Agents are deployed in multiple regions worldwide, including locations outside the EU/EEA, so that customers can monitor their systems from points close to their end users. The geographic region of each agent is selected by you per task; if you only choose EU regions, your monitoring data never leaves the EU.
When you configure a task to run in a non-EU region, the task configuration we transmit to the executing agent (URL, headers, and any credentials you configured) and the response your monitored endpoint returns are processed by the agent in that region. Agents hold no persistent data and transmit results back to our systems in the EU. Our agents outside the EU/EEA are currently operated by our EU-established hosting provider on its own infrastructure abroad, which is not a transfer to a third-country recipient within the meaning of Chapter V GDPR; we nevertheless apply appropriate security measures under Article 32 GDPR to those agents. Should we engage a provider established outside the EU/EEA, we will do so only on the basis of an adequacy decision or the standard contractual clauses adopted by the European Commission, as set out in the Data Processing Agreement.
This processing is processor activity governed by the Data Processing Agreement (https://pingsured.eu/legal/dpa), not this notice.
8. Data security and retention
We protect your data with technical and organisational measures appropriate to the risk, including encryption in transit (TLS), encryption at rest, role-based access control, network segmentation, and audit logging. Inside the platform, identifying attributes (email, name) are stored separately from the pseudonymous internal identifier used in operational tables, so that any single table or log line is harder to re-identify in isolation (Article 5(1)(c)/(e), data minimisation and integrity by design). We restrict access to personal data to those of our staff who need it for their role.
We retain personal data only as long as needed for the purpose it was collected for, plus any statutory retention period.
| Category | Retention |
|---|---|
| Account, identity, contact data | While the account exists, including while it is suspended: up to 30 days for an account that never paid and up to 180 days for one that did, unless you delete it sooner or ask us to restore it; then deleted after the post-termination period set out in the DPA (excluding records we must retain by law) |
| Service-configuration data | Same as account data |
| Result data (HTTP responses, etc.) | Per the data-retention horizon of your subscription tier, and in any case as set out in the DPA |
| Notification deliveries | 90 days |
| Website server access logs | Up to 14 days |
| Visitor IDs (visit statistics) | Until the end of the day (UTC) on which they were computed; the day's random value is destroyed at the same time |
| Login and security logs | Up to 12 months |
| Audit trail of record changes | 24 months from the change, on a rolling basis |
| Acceptance records | Ten years after the end of the calendar year in which the contract ended, or in which the last record about it was made, if later (the longest period in which a claim arising from the contract can still be raised) |
| Status-page subscriptions | Until you unsubscribe |
| Payment-method reference, and the email address we send payment reminders to | While the account exists, and after it is closed or deleted only for as long as an amount owed is still being collected (at most 14 days after a collection first failed or a payment was reversed). The address an invoice or a payment reminder was sent to is also kept as evidence of its delivery, together with the record of that delivery, for as long as our records of the contract and billing are kept (see "Acceptance records" and "Billing and accounting records") |
| Billing and accounting records | As long as German tax and commercial law requires (§147 AO, §257 HGB), currently up to ten years after the end of the calendar year |
| Backups | Overwritten within 90 days in the ordinary course of backup rotation; data in backups expires automatically |
If you ask us to delete your data, we comply unless a statutory retention obligation requires us to keep specific records, or an amount you owe is still being collected — in which case we restrict processing of those records to the minimum needed for the legal obligation.
9. Your rights
Under the GDPR you have the following rights, which you can exercise at any time by emailing privacy@pingsured.eu:
- Right of access (Art. 15) — get a copy of the personal data we hold about you, together with information about how we process it.
- Right to rectification (Art. 16) — ask us to correct inaccurate or incomplete data.
- Right to erasure (Art. 17) — ask us to delete your data where we no longer need it for the purpose collected, subject to statutory retention.
- Right to restriction (Art. 18) — ask us to limit how we process your data while a question (e.g., accuracy) is being resolved.
- Right to data portability (Art. 20) — receive your data in a structured, machine-readable format, or have us transmit it to another controller where technically feasible.
- Right to object (Art. 21) — object to processing we carry out on the basis of legitimate interest. We will reassess and either stop processing or explain the compelling grounds we believe override your objection. For direct marketing (Art. 21(2)) the right is unconditional: we stop on receipt with no balancing test — see the callout in section 4.
- Right to withdraw consent — where we rely on consent (currently only for status-page notifications), you can withdraw it at any time without affecting the lawfulness of processing already carried out.
We respond to requests without undue delay and in any case within one month (Art. 12(3)). Where a request is particularly complex or we receive many requests, we may extend this by up to two further months, telling you why within the first month.
To verify the request comes from you we may ask for confirmation through the email address registered on the account. If the request comes from a third party (e.g., your lawyer) we may request additional verification.
10. Right to complain
You may complain to a data-protection supervisory authority. The competent authority for our establishment is:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI) Postfach 3163 65021 Wiesbaden Germany Email: poststelle@datenschutz.hessen.de Web: https://datenschutz.hessen.de
You may also lodge a complaint with the supervisory authority in the EU Member State of your habitual residence, place of work, or place of the alleged infringement (Art. 77 GDPR).
11. Changes to this notice
We may update this notice from time to time. Material changes are notified by email to account owners; the change-log section at the bottom of this document records every published version.
The active version is always available at https://pingsured.eu/legal/privacy. Specific versions are addressable at https://pingsured.eu/legal/privacy/vX.Y. You may exercise the rights in section 9 if you disagree with any aspect of how we process your data.
12. Contact
For privacy questions or to exercise any of the rights above:
For all other contact information see the Imprint at https://pingsured.eu/legal/impressum.
Change log
v1.0 (2026-09-15) — initial
Initial publication, together with Terms of Service v1.0 and Data Processing Agreement v1.0.