Privacy Policy for my.irs.systems

1. Controller

IRS Systementwicklung GmbH
Pfaffenthanner Weg 5, 93179 Brennberg, Germany
Phone +49 (0) 9484 9500-0 · info@irs.systems

For questions about data protection, contact datenschutz@irs.systems. Our data protection officer is Daniel Steffen, NOVINET GmbH & Co. KG, datenschutzbeauftragter@novidata.de.

2. Hosting and infrastructure

The portal is operated on Vercel Inc. (USA); its application functions run in the Frankfurt am Main data centre. Database, file storage and sign-in are provided by Supabase Inc., hosted on Amazon Web Services in Frankfurt. We send emails through Amazon Simple Email Service and deliver public downloads through Amazon CloudFront at file.irs.systems (Amazon Web Services EMEA SARL, Frankfurt region).

On every request, Vercel processes the connection data that is technically required: IP address, date and time, the requested address, referrer, and browser and operating system. Our application itself does not store IP addresses. We keep application logs (errors and, in the internal applications, requests with the user ID) for 30 days.

The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR); where you use the portal as part of a business relationship, Art. 6(1)(b) GDPR. We have data processing agreements with the service providers under Art. 28 GDPR.

3. Cookies and browser storage

We only use cookies and storage entries that are strictly necessary for the portal to work – no advertising or tracking cookies and no third-party cookies. These need no consent (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG); further processing is based on Art. 6(1)(b) or (f) GDPR.

4. Statistics (only with consent)

If you choose “Accept” in the cookie notice, we use Vercel Web Analytics and Vercel Speed Insights (Vercel Inc., USA) to see which pages are used and how fast they load. Neither service sets cookies. For each page view they record: time, the requested address, referrer, approximate location (derived from the IP address), operating system, browser and device type; Speed Insights also records load-time measurements and the connection type. Visitors are told apart only by a hash of the request, which is discarded after 24 hours – you are not recognised beyond that period or across other websites. We only see aggregated reports.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Without consent the scripts are not loaded. You can withdraw your consent at any time via “Cookie settings” in the page footer.

5. User account and sign-in

Most applications require an account. For this we process your email address, your password (stored only as a hash), optionally your name, and the times of registration and sign-in. To register and to reset your password, we send you a confirmation code by email. Our sign-in service Supabase logs sign-in events, including the IP address, to detect abuse.

Alternatively, you can sign in with your Microsoft account. You are then redirected to Microsoft (Microsoft Ireland Operations Limited), and we receive your email address and the basic details Microsoft passes on, such as your name.

The legal basis is Art. 6(1)(b) GDPR. Your account remains until you ask us to delete it – an informal email to datenschutz@irs.systems is enough.

6. Applications in the portal

Depending on the application you use, we process in particular:

• Content you enter or upload – such as requests, comments and files – with your user ID
• Data on your orders, products, licences and certificates
• Device and measurement data, for example when activating a licence or from IoT devices
• Usage data such as downloads, bookings and payments
• Your email address, to notify you about transactions

The legal basis is Art. 6(1)(b) GDPR (contract or business relationship), supplemented by Art. 6(1)(f) GDPR (traceability and protection against abuse). We delete the data as soon as it is no longer needed for its purpose; where fixed periods apply, for example for shared files, the application states them. We keep data on business transactions for as long as commercial and tax law requires (up to ten years).

7. Public forms

These forms can be used without signing in.

Visitor registration

At reception we record your first and last name, company, optionally your contact person, your signature and your confirmation of the visitor policy. Your contact person receives an email with your name, company and arrival time. The purpose is safety on our premises and proof of the safety briefing; the legal basis is Art. 6(1)(f) GDPR. The data is deleted after 30 days.

End User Statement

Purchase order number, company and address of customer and end user, part numbers, intended use and field of application, first and last name of the signatory, your contact person at IRS, and the signature. The details are sent by email to our administration. The purpose is compliance with export control obligations, including Art. 12g of Regulation (EU) No 833/2014; the legal basis is Art. 6(1)(c) and (b) GDPR. We keep the statement for as long as statutory retention and documentation obligations require.

Accident report and first-aid record

Name of the injured or ill person, time, place and course of events, witnesses, first-aid measures and first aiders. This is health data. The report is sent by email to the people responsible for occupational safety in our company. The purpose is the mandatory record of first aid given (Section 24(6) DGUV Regulation 1) and checking whether the accident must be reported to the statutory accident insurer (Berufsgenossenschaft). The legal basis is Art. 6(1)(c) GDPR and, for the health data, Art. 9(2)(b) GDPR in conjunction with Section 22(1) no. 1(a) of the German Federal Data Protection Act (BDSG). The record is kept for five years.

8. Sending emails

We send notifications from the applications and forms – such as download links or status messages – through Amazon Simple Email Service (Frankfurt), and confirmation codes for account and password through our sign-in service Supabase. Recipient addresses appear in our application logs (30 days).

9. AI features

Some features use language models from Anthropic, OpenAI or Google, which we access through the Vercel AI Gateway (Vercel Inc., USA). Your input, the data from the application needed for the answer and a pseudonymous user ID are sent to the provider; data may be transferred to the USA in the process.

The legal basis is Art. 6(1)(b) or (f) GDPR. There is no automated decision-making within the meaning of Art. 22 GDPR.

10. Internal applications for employees

The applications under /internal are open only to employees of IRS Systementwicklung GmbH. They process employee, customer, supplier and project data to carry out the employment relationship and our business processes (Art. 6(1)(b), (c) and (f) GDPR, Section 26 BDSG). In addition:

• Changes to data are recorded in a change log with user, time, and old and new value, and kept for several years so that business transactions remain traceable.
• Input to the AI agent, its answers and the tools it used are logged with reference to the person; authorised persons can view these logs for auditing and to improve the system. The application points this out.
• Further services are connected for individual tasks, such as HR management, device security, translations and AI features.
• When displaying PDF files, your browser loads a program library from unpkg.com; your IP address is transmitted to that service in the process.

For more information on how employee data is processed, contact the HR department or datenschutz@irs.systems.

11. Recipients and transfers to third countries

We pass personal data to service providers who process it on our behalf – above all those listed below – and to authorities where we are legally obliged to do so.

Even where data is processed in Frankfurt, access from the USA cannot be ruled out for companies based there. We base transfers to the USA on the EU-US Data Privacy Framework (Art. 45 GDPR) where the recipient is certified under it, and otherwise on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

12. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21). You can withdraw consent at any time with effect for the future – for statistics via “Cookie settings” in the page footer. To do so, contact datenschutz@irs.systems.

You can also lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany.

We update this privacy policy when the portal changes. The version published here applies.