# Privacy Policy
**Pursuant to Art. 13, 14 GDPR | Last updated: 12 October 2026 | Version 1.3**

**Notice:** This Privacy Policy provides comprehensive information about how we collect, process, and use personal data in connection with the use of the platform **esc/ctrl** (accessible at escctrl.wmit.work and escctrl.de). It applies to all users (artists using the Artist App, managers & team members using the Client Center), visitors, and prospective users of this platform and fulfills the legal requirements of the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and the Telecommunications Telemedia Data Protection Act (TTDSG).

## Table of Contents
1. Controller
2. Data Protection Officer
3. Competent Supervisory Authority
4. Principles of Data Processing
5. Categories of Personal Data Processed
6. Purposes and Legal Bases of Data Processing
7. Registration and User Account (Firebase Authentication)
8. Onboarding, Artist Profile & Client Center (Managers & Team Members)
9. AI-Powered Features (Gemini 2.5 API / Google AI Studio)
10. Support Ticket System, Customer Support & Bug Reports
11. News Section, Product Updates & Announcements
12. Download Section, Asset Management & Self-Service GDPR Data Export (CSV / JSON)
13. Analytics & Social Media Data (OAuth Connections)
14. Web Scraping Service (Apify)
15. Google Drive Integration
16. Lead Generation and Email Verification
17. Newsletter (Mailchimp)
18. Payment Processing (PayPal) & Statutory Tax Retention (§ 147 AO / § 257 HGB)
19. Hosting and Infrastructure (Google Cloud / Firebase / GoDaddy)
20. Cookies, Web Analytics and Local Storage
21. Contact
22. Disclosure of Data to Third Parties
23. Data Transfers to Third Countries
24. Retention Periods, Account Deletion & Statutory Storage Obligations
25. Your Rights as a Data Subject (incl. Access & Self-Service Export)
26. Data Security
27. Amendments to this Privacy Policy
28. Right to Lodge a Complaint with the Supervisory Authority

## 1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws as well as other data protection provisions is:

**Operator / Company:** wemakeITwork  
**Name:** Malte Schröder  
**Postal Address:** CAYA Postbox 890308, 96035 Bamberg, Germany  
**Registered Office:** Planufer 92b, 10967 Berlin, Germany  
**Phone:** +49 30 16 63 95 84  
**Email:** support@wmit.work  
**Platform URL:** [https://escctrl.wmit.work](https://escctrl.wmit.work) · [https://escctrl.de](https://escctrl.de)  
**Studio Website:** https://nyr.studio  

The platform **esc/ctrl** is operated by wemakeITwork, sole trader Malte Schröder, a sole proprietorship based in Berlin, Germany. For all data protection enquiries, please contact us directly by email or phone at any time.

## 2. Data Protection Officer
The appointment of a Data Protection Officer (DPO) is currently not mandatory for our business pursuant to Art. 37 GDPR in conjunction with § 38 BDSG, as we regularly employ fewer than 20 persons engaged in the automated processing of personal data as a sole proprietorship. We nevertheless take data protection very seriously and are available at all times for any data protection-related enquiries (see Section 1).

## 3. Competent Supervisory Authority
The competent data protection supervisory authority for our business is:

**Authority:** Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit)  
**Postal Address:** Friedrichstr. 219, 10969 Berlin, Germany  
**Visitor Entrance:** Puttkamer Straße 16–18 (5th Floor), Berlin  
**Phone:** +49 30 138 89 0  
**Email:** mailbox@datenschutz-berlin.de  
**Website:** [https://www.datenschutz-berlin.de](https://www.datenschutz-berlin.de)

## 4. Principles of Data Processing
We process personal data in strict compliance with the principles set out in Art. 5 GDPR:
* **Lawfulness, fairness and transparency:** Data is processed only on the basis of a valid legal ground and in a comprehensible manner.
* **Purpose limitation:** Data is collected for specified, explicit and legitimate purposes and not processed in a manner incompatible with those purposes.
* **Data minimisation:** Only the data necessary for the respective purpose is processed.
* **Accuracy:** Data is kept factually accurate and up to date; inaccurate data is deleted or corrected without delay.
* **Storage limitation:** Data is not retained for longer than necessary for the respective purpose.
* **Integrity and confidentiality:** Data is protected against unauthorised access, loss or destruction by appropriate technical and organisational measures.
* **Accountability:** As controller, we are able to demonstrate compliance with all of the above principles.

## 5. Categories of Personal Data Processed
Depending on the features used, the following categories of personal data may be processed in connection with the use of esc/ctrl:
* **Master data:** Name, email address, password (encrypted), user ID, profile picture URL
* **Artist profile data (Artist App):** Artist name, genre, biography, target audience, release dates, monthly listener goal
* **Client Center & Manager data:** Manager name, agency/label name, managed artist IDs, invited team members' email addresses, assigned role permissions
* **Social media & streaming data:** Profile URLs and public metrics from Spotify, YouTube, Instagram, Facebook, TikTok, Apple Music, Amazon Music, Deezer, SoundCloud
* **OAuth tokens:** Access tokens for connected third-party platforms (stored in encrypted form), refresh tokens
* **AI interaction data:** Chat messages, requests and generated responses within the Gemini 2.5 AI assistants
* **Planning and project data:** Release plans, roadmaps, moodboards, Kanban tasks, calendar entries, tour plans
* **Support & feedback data:** Support tickets, issue descriptions, attachment files, resolution status
* **Download & export logs:** Generated GDPR data exports (CSV/JSON), downloaded asset packages, download timestamps
* **Usage & news data:** IP address, browser/device information, login timestamps, session data, article views in the news section
* **Communication data:** Emails in the context of lead generation, verification processes, and customer support enquiries
* **Google Drive export:** The title and text of a document that you explicitly choose to export from esc/ctrl
* **Payment & billing data:** Billing address, VAT ID, transaction ID, and subscription tiers (payments processed via PayPal; we do not store credit card details ourselves)

## 6. Purposes and Legal Bases of Data Processing
We process your personal data on the basis of the following legal grounds under the GDPR:
* **Art. 6(1)(a) GDPR – Consent:** Processing activities for which you have given your explicit consent (e.g. newsletter subscription, connection of third-party platforms, use of opt-in AI features)
* **Art. 6(1)(b) GDPR – Performance of a contract:** Processing necessary for the performance of the user agreement (provision of the platform for Artist App and Client Center users), registration, support handling, and delivery of contracted services
* **Art. 6(1)(c) GDPR – Legal obligation:** Processing required by applicable legal provisions (in particular statutory retention obligations under tax and commercial law pursuant to § 147 AO / § 257 HGB and access rights under Art. 15, 20 GDPR)
* **Art. 6(1)(f) GDPR – Legitimate interests:** Processing in pursuit of our legitimate interests (e.g. operation and IT security of the platform, abuse prevention, resolving technical bugs via the support system, providing the news section)

## 7. Registration and User Account (Firebase Authentication)
Registration is required to use esc/ctrl. Authentication is handled via **Google Firebase Authentication** (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA), a separate service within Google’s infrastructure. Our Firestore database region does not determine where Firebase Authentication processes data; exclusively German or European processing is not guaranteed for this service.

### Sign-in Options
You can register and sign in via two methods:
* **Email & Password:** You provide an email address and a self-chosen password. The password is stored by Firebase in encrypted form. We never have access to your plaintext password.
* **Google Sign-In (OAuth 2.0):** You sign in with your existing Google account. This transfers your Google account data (name, email address, profile picture) to Firebase. Authentication is conducted via an OAuth 2.0 token flow.

The following data is processed during registration and stored in **Google Firestore** (NoSQL database, region: **europe-west10, Berlin, Germany**): User ID (UID), email address, display name, profile picture URL (for Google sign-in), account creation date, last sign-in timestamp, and IP address at the time of registration.

**Legal basis:** Art. 6(1)(b) GDPR (performance of a contract). Google/Firebase's privacy policy is available at [https://firebase.google.com/support/privacy](https://firebase.google.com/support/privacy) and [https://policies.google.com/privacy](https://policies.google.com/privacy).

## 8. Onboarding, Artist Profile & Client Center (Managers & Team Members)
After registration, you may use the platform as an individual artist (Artist App) or as a manager/agency/team (Client Center):

### a) Artist App & Artist Profile
When creating an artist profile, data is stored in Google Firestore (collection *artistProfiles*):
* **Required fields:** Artist name, genre
* **Optional fields:** Biography, target audience, focus goals, release dates (album, single, music video), tour dates, monthly listener goal, social media links
* **Growth Roadmaps:** Automatically or manually generated strategy roadmaps (collection *growthRoadmaps*)

### b) Client Center (Manager & Team Management)
For managers, labels, and agencies, the **Client Center** provides enhanced collaboration and management features. Data is stored in Google Firestore (collections *managerProfiles*, *teamMembers*):
* **Manager master data:** Manager/agency name, specialization, contact information
* **Managed artists:** Linking artist IDs to the manager account to grant access to dashboard views and roadmaps
* **Team member management:** Inviting team members by email, assigning roles and permissions (Admin, Manager, Member). Invited members receive notifications to activate their access

**Legal basis:** Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in efficient collaboration across management and team structures).

## 9. AI-Powered Features (Gemini 2.5 API / Google AI Studio)
esc/ctrl continuously utilizes current AI models from the **Google Gemini 2.5 Series** (e.g. 'gemini-2.5-pro' and 'gemini-2.5-flash' by Google DeepMind / Google LLC), provided via **Google AI Studio**, for the following core capabilities:
* **AI Assistant (Copilot):** Chat-based assistant answering questions regarding release strategy, marketing, and content creation
* **Growth Roadmap & Content Generator:** AI-assisted generation of custom growth roadmaps and social posting schedules
* **Release & Tour Planner:** AI-driven optimization of release timelines and tour schedules

**Data Processing & Security Measures:** When using AI features, your artist profile (name, genre, goals, release dates), chat prompts, and context data are transmitted server-side via our secure Node server ('server.ts') to the Google Gemini API. All inputs pass through server-side prompt injection protection and are encapsulated in XML structures.
* **No Model Training:** Pursuant to commercial API terms of Google AI Studio, submitted prompts and data are **not** used to train public Google AI models.
* **Fallback Architecture:** The system primarily uses 'gemini-2.5-pro' and 'gemini-2.5-flash' with automated fallback mechanisms to ensure high availability.

**Legal basis:** Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(a) GDPR (consent for optional usage). Further information on data processing by Google AI: [https://ai.google.dev/gemini-api/terms](https://ai.google.dev/gemini-api/terms).

## 10. Support Ticket System, Customer Support & Bug Reports
To handle technical enquiries, bug reports, and user feedback, we operate an integrated **Support Ticket System** (collections *supportTickets*, *feedback* in Firestore).

**Data collected:**
* User ID, name, email address
* Enquiry category (e.g. Authentication, API Error, Billing, Feature Request)
* Subject, detailed issue description, priority
* Optional: Uploaded screenshots or attachment files
* Ticket status, timestamps, communication logs with support staff

**Purpose & Retention:** Processing your support request, resolving technical bugs, and maintaining platform stability. After ticket closure, support records are retained for the duration of the standard statutory limitation period (§ 195 German Civil Code - BGB: 3 years to the end of the calendar year) to handle any follow-up questions. **Legal basis:** Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in platform stability and effective support).

## 11. News Section, Product Updates & Announcements
On our platform, we provide a publicly and internally accessible **News Section** ('/news'). Here, we publish platform updates, new features, music industry best practices, and system announcements.

**Data Processing in the News Section:**
* When viewing news articles, anonymized view counters are updated in Firestore to measure content relevance.
* If you are a logged-in user, we process your session ID to mark articles you have already read.
* If you subscribe to product updates via the news section, your email address is processed in accordance with Section 17 (Newsletter).

**Legal basis:** Art. 6(1)(f) GDPR (legitimate interest in transparent information sharing regarding platform features).

## 12. Download Section, Asset Management & Self-Service GDPR Data Export (CSV / JSON)
esc/ctrl offers comprehensive download tools for both content assets and your personal data:

### a) Download of Templates & Asset Packages
In the download section ('/downloads'), you can download pre-formatted checklists, release guides, branding assets, and contract templates. Download timestamps and anonymized counters are recorded to optimize our content offerings. **Legal basis:** Art. 6(1)(f) GDPR.

### b) Self-Service GDPR Data Export (CSV / JSON) under Art. 15 & 20 GDPR
You can download a full export of all your stored data (profile, manager master data, billing address, roadmaps, calendar events, activity logs) at any time from your account settings ('Settings.tsx') in standard **CSV format** (including UTF-8 BOM for Microsoft Excel and Apple Numbers) as well as **JSON format**.
* **Export Content:** Master personal data, artist/manager profiles, billing & tax records, connected platforms, roadmaps, calendar entries, and retention certificates.
* **Transparency & Portability:** This self-service export fulfills your data subject rights to access (Art. 15 GDPR) and data portability (Art. 20 GDPR).

**Legal basis:** Art. 6(1)(c) GDPR (compliance with legal obligations to uphold data subject rights).

## 13. Analytics & Social Media Data (OAuth Connections)
A central feature of esc/ctrl is the aggregation of streaming and social media metrics from various platforms:

### a) OAuth 2.0 Connections
You can connect your accounts on the following platforms directly via standardized **OAuth 2.0 protocol**:
* **Spotify:** Read access to profile, email, top tracks, playlists. Scopes: 'user-read-private', 'user-read-email', 'user-top-read', 'playlist-read-private', 'playlist-read-collaborative'
* **Google / YouTube:** Read access to YouTube channel and Analytics. Scopes: 'userinfo.profile', 'userinfo.email', 'youtube.readonly', 'analytics.readonly'
* **Facebook / Instagram:** Read access to Pages and Instagram Business Insights. Scopes: 'email', 'public_profile', 'pages_show_list', 'pages_read_engagement', 'instagram_basic', 'instagram_manage_insights'
* **TikTok:** Read access to basic user info and video stats. Scopes: 'user.info.basic', 'video.list', 'video.stats'

OAuth access tokens and refresh tokens are stored in encrypted form in Google Firestore (collections *oauthConnections* / *userConnections*). The tokens are used automatically by a server-side polling service (*oauthPoller*) to refresh metrics regularly. You can revoke a connection at any time in Settings; tokens will be deleted immediately upon revocation.

### b) Web Scraping Fallback (Apify)
For platforms without OAuth support (e.g. Deezer), public profile pages are retrieved via **Apify** (see Section 14). Only publicly available metrics are processed. **Legal basis:** Art. 6(1)(a) GDPR (OAuth) and Art. 6(1)(b)/(f) GDPR.

## 14. Web Scraping Service (Apify)
For fallback data queries, we use **Apify** (Apify Technologies s.r.o., Václavské nám. 808/66, 110 00 Prague, Czech Republic). Public profile URLs and your user ID are processed. If you provide a custom Apify token, it is stored in encrypted form in Firestore. Apify processes data in accordance with its privacy policy: [https://apify.com/privacy-policy](https://apify.com/privacy-policy). **Legal basis:** Art. 6(1)(b) and (f) GDPR.

## 15. Google Drive Integration
esc/ctrl offers an optional **Google Drive export** for documents created in the AI Copilot and results from the Smart Tools. Google authorization with the `https://www.googleapis.com/auth/drive.file` permission starts only when you select “Google Drive” for a document. After you grant access, your browser sends the displayed document title and text to Google through the Google Drive API and creates a new **.txt file** in your Drive. No destination folder is currently selected.

This export does not list existing Drive files or read the content or metadata of other files. It does not request full access to your Drive or establish persistent server-side Drive access. The exported file stays in your Google Drive until you delete it there; deleting your esc/ctrl account does not automatically remove it. You can revoke the Google permission in your Google account. **Legal basis:** Art. 6(1)(a) GDPR (consent). Google Privacy Policy: [https://policies.google.com/privacy](https://policies.google.com/privacy).

## 16. Lead Generation and Email Verification
On the public landing page, visitors can request the *Release Strategy Guide* by entering their **name and email address**. Data collection uses a secure double opt-in procedure:
* **Step 1:** Input in form
* **Step 2:** Stored as unverified lead in Firestore (collection *leads*) and confirmation email sent
* **Step 3:** Clicking the confirmation link verifies the lead and enables the guide download

**Legal basis:** Art. 6(1)(a) GDPR (consent).

## 17. Newsletter (Mailchimp)
For sending platform updates, industry news, and offers, we use **Mailchimp** (The Rocket Science Group LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA).
* **Data processed:** Email address, first name, last name
* **Opt-in & Unsubscribe:** Double opt-in process. Unsubscribe anytime via link in any email or by contacting support@wmit.work
* **Third country transfer:** Certified under the EU-US Data Privacy Framework and EU Standard Contractual Clauses (SCCs). Info: [https://mailchimp.com/legal/privacy/](https://mailchimp.com/legal/privacy/)

**Legal basis:** Art. 6(1)(a) GDPR.

## 18. Payment Processing (PayPal) & Statutory Tax Retention (§ 147 AO / § 257 HGB)
Payments for paid subscriptions (Basic, Pro, Business) are processed via **PayPal (Europe) S.à r.l. et Cie, S.C.A.**, 22-24 Boulevard Royal, L-2449 Luxembourg.
* **Data processed:** Name, email address, billing address, VAT ID, transaction ID, subscription plan. We do **not** store payment card or bank details ourselves.
* **Statutory Retention Obligation:** Invoices, payment receipts, and tax-relevant transaction records are subject to an **8-year statutory retention period** under § 147(3) sentence 1 German Tax Code (AO) and § 257(4) German Commercial Code (HGB). Even upon account deletion, these accounting records remain stored in a separate, access-protected archive pursuant to **Art. 17(3)(b) GDPR**.

PayPal Privacy Statement: [https://www.paypal.com/de/webapps/mpp/ua/privacy-full](https://www.paypal.com/de/webapps/mpp/ua/privacy-full). **Legal basis:** Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(c) GDPR (legal obligation).

## 19. Hosting and Infrastructure (Google Cloud / Firebase / GoDaddy)
* **Google Cloud Run:** The application’s production server runs in **us-west1 (Oregon, USA)**. Requests to this server are therefore processed in the USA.
* **Google Firestore:** The production database is stored in **europe-west10 (Berlin, Germany)**.
* **Google Cloud Storage / Firebase Storage:** The storage bucket used for Vault files is located in **US-WEST1 (Oregon, USA)**. Uploaded files are stored there.
* **Google Firebase Authentication:** Sign-in is processed by a separate Google service. It is not bound to the Firestore database region; exclusively German or European processing is not guaranteed.

* **GoDaddy LLC:** Domain registration (*wmit.work*) and DNS management. Info: [https://www.godaddy.com/en/legal/agreements/privacy-policy](https://www.godaddy.com/en/legal/agreements/privacy-policy).

A Data Processing Agreement (DPA) pursuant to Art. 28 GDPR is in place. Firebase information: [https://firebase.google.com/support/privacy](https://firebase.google.com/support/privacy).

**Legal basis:** Art. 6(1)(b) and (f) GDPR.

## 20. Cookies, Web Analytics and Local Storage (TDDDG & GDPR)
esc/ctrl uses cookies and similar storage technologies (such as local storage) in full compliance with § 25 TDDDG and the GDPR.

### a) Technology Categories
* **Strictly Necessary / Essential (§ 25(2) No. 2 TDDDG, Art. 6(1)(f) GDPR):**
  * *Firebase Auth Tokens & Session Cookies:* Encrypted tokens for secure authentication and authorization of your user session.
  * *OAuth State Token:* Temporary protection against Cross-Site Request Forgery (CSRF) during API platform connections (expiry: 10 minutes).
  * *Consent Storage ('cookie_consent'):* Retains your chosen cookie preferences and audit timestamp for up to 12 months.
  * *Theme & Interface Preferences:* Preserves your light/dark mode preference.
* **Statistics & Reach Measurement (§ 25(1) TDDDG, Art. 6(1)(a) GDPR – Opt-in):**
  * *Google Analytics 4 (GA4):* Google Ireland Limited / Google LLC.
  * *Collection:* Anonymized page impressions, duration, device/browser category, aggregated navigation flows. IP addresses are anonymized.
  * *Google Consent Mode v2:* We support Google Consent Mode v2; signals ('analytics_storage', 'ad_storage', 'ad_user_data', 'ad_personalization') remain blocked ('denied') by default and are only enabled upon your explicit voluntary consent.
* **Marketing & Campaign Conversions (§ 25(1) TDDDG, Art. 6(1)(a) GDPR – Opt-in):**
  * Measures conversion effectiveness of platform announcements and targeted release resources.

### b) Revocation and Subsequent Modification (Art. 7(3) GDPR)
You can **revoke or adjust your consent** for individual or all optional cookie categories **at any time with future effect**. Simply click on the **"Cookie Settings"** link in the footer of any page or the action button in this section. The legality of processing carried out prior to revocation remains unaffected.

## 21. Contact
When contacting us via email or contact form, your details (name, email address, message text) are processed to handle your enquiry. **Legal basis:** Art. 6(1)(f) GDPR or Art. 6(1)(b) GDPR.

## 22. Disclosure of Data to Third Parties
Data is disclosed to third parties exclusively:
* To audited data processors under Art. 28 GDPR (Google Cloud/Firebase, Mailchimp, Apify, PayPal)
* To connected third-party platforms at your explicit request (OAuth)
* In case of statutory or official obligations
* **No Sales:** We never sell personal data to third parties.

## 23. Data Transfers to Third Countries
Where service providers process data outside the EEA (e.g. Google, Mailchimp, GoDaddy in the USA), an adequate level of data protection is guaranteed via:
* Certification under the **EU-US Data Privacy Framework**
* Execution of **EU Standard Contractual Clauses (SCCs)** pursuant to Art. 46(2)(c) GDPR

The production infrastructure spans the USA (application server and Vault file storage) and Germany (Firestore database). Processing therefore does not take place exclusively within the EU; individual locations are listed in Section 19.

## 24. Retention Periods, Account Deletion & Statutory Storage Obligations

### a) How account deletion works
You start the deletion of your account yourself in the settings. Re-authentication is required to confirm your identity.

* **14-day period:** After your request, your account remains active for 14 days. During this time you may revoke the deletion at any time and without giving reasons. Each time you sign in, we show you the deletion date and the option to revoke.
* **Taking your data with you:** Until the period expires, you can download your data as JSON and CSV files (Art. 20 GDPR).
* **Final deletion:** Once the 14 days have elapsed, your data is deleted automatically and irreversibly. Signing in with your previous credentials is no longer possible thereafter.
* **Active subscription:** If a paid subscription is active, deletion is only possible after you have cancelled it. This prevents further charges being taken after deletion.

### b) What is deleted
Once the period expires, the following are removed completely and irreversibly: your user account (Firebase Authentication), your artist or management profile, releases, playbooks, tasks, calendar entries, files and tool results, analytics and social media data, chat histories and messages, support tickets and bug reports, as well as all connections to linked platforms. Your account is also removed from any organisations you were linked to via the Client Center.

### c) What is retained for statutory reasons
Pursuant to **Art. 17(3)(b) GDPR** in conjunction with **§ 147(3) sentence 1 AO** and **§ 257(4) HGB**, we are required to retain accounting-relevant records. The following are therefore not deleted:

* Email address, date of registration and date of account deletion
* Billing address
* Subscription and payment history including invoice numbers

Upon deletion, this data is transferred to a **separate archive** that is isolated from the platform's live operation and accessed solely in fulfilment of tax or commercial law obligations. It is **no longer** processed for platform use, analytics or advertising purposes. After the retention period of **8 years**, calculated from the end of the respective calendar year, this data is deleted as well.

### d) Further retention periods
* **Server Logs:** Erased automatically after a maximum of 7 days.
* **Newsletter subscriptions and enquiries submitted via our contact and lead forms:** Stored independently of any account deletion on the basis of the consent given in each case, and revocable separately at any time (see sections 16 and 17).

## 25. Your Rights as a Data Subject (incl. Access & Self-Service Export)
You have the following rights under the GDPR:
* **Art. 15 GDPR – Right of Access:** Right to obtain confirmation and a copy of stored data concerning you.
* **Art. 16 GDPR – Right to Rectification:** Right to correct inaccurate data.
* **Art. 17 GDPR – Right to Erasure:** Right to have your account deleted. You can start the process yourself in the settings at any time; section 24 describes the exact procedure and the statutory exceptions.
* **Art. 18 GDPR – Right to Restriction of Processing.**
* **Art. 20 GDPR – Right to Data Portability:** Right to receive your data in a structured, standard format (use our self-service **CSV / JSON export feature** in settings).
* **Art. 21 GDPR – Right to Object** against processing under Art. 6(1)(f) GDPR.
* **Art. 7(3) GDPR – Right to Withdraw Consent.**

Exercise your rights by emailing **support@wmit.work** (Subject: Data Protection). Requests are processed within 30 days.

## 26. Data Security
We implement state-of-the-art technical and organizational measures (TOMs): HTTPS/TLS 1.3 encryption, encrypted Firestore storage for tokens/keys, Firebase Auth with bcrypt password hashing, prompt injection filtering for AI queries. The locations of the production infrastructure are listed in Section 19.

## 27. Amendments to this Privacy Policy
We reserve the right to amend this Privacy Policy to reflect new features or legal updates. Registered users will be notified of material changes.

## 28. Right to Lodge a Complaint with the Supervisory Authority
You have the right to lodge a complaint with the competent supervisory authority: **Berlin Commissioner for Data Protection and Freedom of Information** (Puttkamer Straße 16–18, 10969 Berlin, [https://www.datenschutz-berlin.de](https://www.datenschutz-berlin.de)).

---
**Date of this Privacy Policy:** 10 October 2026 | **Version:** 1.2 | **Platform:** esc/ctrl (escctrl.wmit.work and escctrl.de) | **Operator:** wemakeITwork, Malte Schröder, Berlin  
Contact for data protection enquiries: support@wmit.work