Privacy Notice

Last updated: 30 August 2026.

1. Controller

Invent-IT, Marcus Ripkens, Am Sportplatz 23, 41844 Wegberg, Germany. Email: marcus@ripkens.eu. This notice covers the Portal at groundplate.org and our licence server. It does not cover Groundplate instances you self-host — there, you are the controller for your own users' data.

2. What we process, why, and on what legal basis

• Account and licensing data — email, name, company and, if provided, VAT ID; the licences you hold; the domain and instance identifier a licence is bound to; activation and renewal events. Purpose: providing the service and issuing/verifying licences. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
• Licence verification ("phone home") — a licensed instance periodically sends its domain, instance identifier and product version to renew its licence. We deliberately collect only what the binding requires; no usage statistics, and nothing for free self-hosted instances beyond what an activation needs. Legal basis: Art. 6(1)(b) and our legitimate interest in preventing unlicensed use, Art. 6(1)(f) GDPR.
• Server logs — including IP address and request metadata, kept short-term for security and operation. Legal basis: Art. 6(1)(f) GDPR.
• Support communication — the content you send us. Legal basis: Art. 6(1)(b)/(f) GDPR.

3. Payments

Payments are handled by Paddle.com Market Limited (United Kingdom) as Merchant of Record. Paddle is the seller of record and an independent controller for the payment and tax data it collects; we receive only the information needed to fulfil and account for your order. See Paddle's own privacy policy. The United Kingdom is covered by an EU adequacy decision.

4. Hosting and recipients

The Portal and licence server are hosted in Germany with IONOS SE, Montabaur. Data (database and files) is stored on servers located in the EU. We do not sell your data. Recipients are limited to our hosting provider (as processor) and Paddle (for payments), plus authorities where legally required.

5. International transfers

Processing takes place within the EU, except for the payment relationship with Paddle (UK, adequacy decision in place). We do not otherwise transfer personal data to third countries.

6. Retention

We keep account and licensing data for the life of your account and as long as required for contractual and statutory (e.g. tax) obligations, then delete or anonymise it. Logs are kept only briefly.

7. Cookies

The Portal uses a single strictly necessary session cookie to keep you signed in. We use no tracking or advertising cookies.

8. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21) under the GDPR. To exercise them, contact marcus@ripkens.eu. You also have the right to lodge a complaint with a supervisory authority — for us, the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW).