abalso This is a convenience translation. Only the German version is legally binding: Datenschutzerklärung. In the event of any discrepancy, the German wording prevails.
Privacy policy
Controller within the meaning of the GDPR
Eduard Mehrtens e.K.
Am Hagen 15
28790 Schwanewede
Germany
Email: info@abalso.de
The essentials up front
Your backed-up data does not reach us. Abalso Backup transfers backups solely to the destinations you choose yourself – your hard drive, your NAS, your own cloud storage. There is only one exception: if you have booked storage space with us (abalso Storage), the backups reside on our server, encrypted if you wish, without us knowing the password.
The app performs no telemetry and requires no sign-in. It connects to our servers only for clearly named purposes – for updates, licence checking and the functions you expressly trigger. All of these connections are listed individually below.
1. Use of this website
1.1 Hosting and server log files
This website and our licence system (lizenz.abalso.de) run on servers in Germany. When a page is called up, technically necessary data (IP address, date and time, resource requested, browser type transmitted) is processed for delivery and to fend off attacks. The legal basis is Art. 6(1)(f) GDPR (secure and trouble-free operation). The log data is not merged with other data sources and is not evaluated to analyse usage behaviour.
We ourselves embed no analytics or tracking services. Fonts, style sheets and graphics are delivered exclusively from our own server – no fonts or libraries are loaded from third-party servers. The only exception is the three pages named under 1.2: there the Paddle checkout script is loaded, which in turn loads an analytics service belonging to Paddle. Details under 1.2.
1.2 Purchase processing through Paddle
Purchases are handled by Paddle.com Market Ltd., Judd House, 18–29 Mora Street, London EC1V 8BT, United Kingdom, as the so-called merchant of record. In doing so Paddle is an independent controller for the payment processing; the parties to the purchase contract are you and Paddle.
On the pages home, pricing and storage the Paddle checkout script (cdn.paddle.com) is loaded when the page is called up, so that the buy button works immediately. For technical reasons your IP address is transmitted to Paddle in the process; in this context Paddle may store information on your device or read it out. The legal basis is Art. 6(1)(f) GDPR (providing a working purchase option). On all other pages – including this privacy policy, the licence terms and the legal notice – no Paddle script is loaded.
The Paddle script itself automatically loads a further service from the Paddle group (public.profitwell.com, “ProfitWell”), which Paddle uses to evaluate purchases and abandoned purchases. Your IP address and the page called up are transmitted to that service too. According to our own measurement, merely calling up the page sets no cookies and stores no data in your browser’s storage; to that extent there is no storing or reading of information on your device within the meaning of § 25 TDDDG. Processing by Paddle companies outside the EU, in particular in the United States, is not ruled out; the details and the safeguards for such transfers follow from Paddle’s privacy policy. You can prevent both services from loading by not calling up the pages named or by blocking scripts from cdn.paddle.com and public.profitwell.com in your browser; the remaining pages and the software download are unaffected.
For the purchase itself, Paddle processes the data you enter there (name, email address, billing and payment data, country for VAT purposes). We ourselves do not receive full payment data from Paddle, only the details needed to issue the licence, in particular the email address, the product and the order reference. Further details are set out in Paddle’s privacy policy; for the United Kingdom an adequacy decision of the EU Commission is in place.
1.3 Referral programme and cookies
If you reach our website via a personal referral link (backup.abalso.de/?ref=…), we ask you by way of a notice whether we may set a cookie for this. Without your consent no such cookie is set and no referral is stored.
If you consent, we store two first-party cookies on your device:
- abalso_ref – contains the referral code and attributes a later purchase to the referring person. Storage period: 90 days.
- abalso_ref_consent – stores your yes/no decision so that you are not asked again. Storage period: 180 days.
The cookies apply to the domain abalso.de including the subdomain backup.abalso.de. No cross-site tracking and no profiling takes place; only the referral code is stored. The legal basis for storage on your device is your consent (§ 25(1) TDDDG), and for the subsequent processing Art. 6(1)(a) GDPR. Consent is voluntary and not required in order to use the website; you can withdraw it at any time with effect for the future by deleting the cookies named in your browser.
If you complete a purchase, the referral code is transmitted to Paddle in order to attribute your order, and the attribution is then stored with us.
1.4 Licence management in the browser
On the manage licence page you can view your licence and release devices. To sign in you enter your email address and receive a one-time sign-in link; alternatively the app opens the page with your licence key and installation ID. Processed in this context are your email address, the licence key, the installation IDs of your devices and a session identifier. The legal basis is Art. 6(1)(b) GDPR (performance of the licence contract).
1.5 Language setting
If you choose a language at the top of the page or call up an address with the addition ?lang=…, we store your choice in a first-party cookie abalso_lang. It contains only the two-letter language code (such as fr) – no identifier and no further details. Storage period: 180 days. The cookie applies to abalso.de including the subdomains backup.abalso.de and download.backup.abalso.de, so that your language is retained when you move to the download page.
No consent is required for this: the cookie merely implements the display setting you chose yourself and is therefore strictly necessary for the service you expressly requested (§ 25(2) no. 2 TDDDG). It is neither evaluated nor merged with other data. You can delete the cookie in your browser at any time; the page will then follow your browser’s language setting again.
2. Data processing in the “Abalso Backup” app
2.1 Principle
The app requires no sign-in and sends no telemetry. A licence account kept under your email address exists only if you have purchased a licence (see section 1.4); none is created for free use with local backup destinations. No file, folder or mailbox content is transmitted to us. The connections the app makes to our servers are listed exhaustively in the following sections.
2.2 Installation ID
On first use the app generates a random installation ID (UUID) on your device. It contains no hardware identifiers and allows no conclusions about your device; it serves solely to attribute licences to devices. Neither device name nor serial number, MAC address or similar identifiers are collected or transmitted.
2.3 Update check
The app regularly asks our update server (update.backup.abalso.de) for new versions. Only the technically necessary details are transmitted: IP address, file requested and installed app version. The legal basis is Art. 6(1)(f) GDPR (provision of secure software updates).
2.4 Registration
You may voluntarily register with your email address in order to receive support and offers. Transmitted to our licence system are: email address, installation ID, app version, operating system platform (e.g. “darwin” or “win32”), language code and the confirmation of your consent. The legal basis is Art. 6(1)(a) GDPR; registration is not required in order to use the app and can be withdrawn at any time.
2.5 Licence check, activation and trial period
If a licence key is stored or you activate a licence, the app checks it with our licence system. Transmitted are the installation ID, the licence key (or, on activation, the email address and PIN from the purchase confirmation), the platform and the app version. For this the server stores which installation IDs occupy a licence, when they were last in contact and what storage space the licence includes. The same applies to starting a free trial period and to releasing a device. The legal bases are Art. 6(1)(b) GDPR (performance of the licence contract) and Art. 6(1)(f) GDPR (protection against unauthorised multiple use).
2.6 Referral code
For the referral programme the app retrieves your personal referral code from our licence system using the installation ID. No further data is transmitted in the process.
2.7 Messages to support
If you send a message or a suggestion from the app, we receive the text you wrote together with the subject and topic area and – where given or registered – your email address. The installation ID, app version, platform and language code are attached for technical reasons so that we can place the matter. The legal basis is Art. 6(1)(b) or (f) GDPR (handling your enquiry).
2.8 abalso Storage (booked storage space)
If you have booked storage space with us, the data you back up there resides on our servers in Germany. We process it solely in order to provide the storage space and do not inspect its contents. Where encryption is enabled, the data is already encrypted on your device before transfer – knowledge of its content is then technically impossible for us. The legal basis is Art. 6(1)(b) GDPR. Section 2 of the licence agreement governs blocking, retrieval and deletion at the end of the contract.
2.9 Checking restricted backup destinations
If you set up a backup destination on a server belonging to a provider with its own conditions, the app determines the associated domain name. This determination takes place on your device via the usual name resolution of your network. Only where it has to be checked whether a release exists for that domain do we transmit the domain name and your installation ID to our licence system – never credentials, paths or file names. The legal basis is Art. 6(1)(f) GDPR (compliance with contractual arrangements with infrastructure providers).
2.10 Mail archive as well as contacts and calendars
If you use the archiving of mailboxes (IMAP) or of contacts and calendars (CardDAV/CalDAV), the app connects directly from your device to the provider you have specified. No transfer takes place via our servers, and we receive neither credentials nor content. The messages and entries retrieved are written into your chosen backup destination like all other data. The search index of the mail archive resides encrypted on your device.
2.11 Credentials and encryption
Credentials for your backup destinations and mailboxes are stored protected in your operating system’s keychain (macOS Keychain or Windows Credential Manager) and leave your device only to sign in to the respective destination. Where encryption is enabled, your data is encrypted with AES-256 before transfer; the password remains exclusively with you. We have no access to it at any time and cannot recover it.
2.12 Logs on your device
The app keeps several logs which are stored exclusively locally on your device and are not transmitted to us:
- Error and diagnostic log – only where the debug log has been switched on expressly; it switches itself off again after 24 hours at the latest.
- Log of full restores – time, data state, scope and result of your restores, as evidence of your checks under section 4 of the licence agreement.
- Log of deletions and changes – deleted jobs or snapshots, changed sources, filters, destinations and schedules.
These logs reach us only if you send them yourself – for example via the “export diagnostic package” function, with which you can save a file and send it to us at your own discretion. No automatic transmission takes place.
3. Recipients and processors
Your data is passed on to third parties only to the extent described below:
- Hosting provider for the website, update server and licence system – server location Germany, acting as a processor under Art. 28 GDPR.
- Paddle.com Market Ltd. (United Kingdom) and companies affiliated with it, for purchase processing and its evaluation (including ProfitWell) – as independent controllers, see section 1.2.
In so far as a transfer to third countries takes place in the course of purchase processing, Paddle is responsible for it and for the safeguards required (section 1.2). Beyond that we transfer no personal data to third countries. We do not pass on your backed-up data under any circumstances.
4. Storage periods
- Server log files: deleted after 30 days at the latest.
- Registration: until you withdraw your consent.
- Licence and device data: for the duration of the licence contract and thereafter in so far as commercial and tax retention periods require it.
- Support messages: until the matter has been finally dealt with, and beyond that in so far as retention periods exist.
- abalso Storage: for the duration of the storage contract; thereafter in accordance with section 2 of the licence agreement.
5. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on Art. 6(1)(f) GDPR (Art. 21). You may withdraw consent you have given at any time with effect for the future; the lawfulness of the processing carried out until then remains unaffected.
To do so please contact info@abalso.de. You also have the right to lodge a complaint with a data protection supervisory authority, for example with the State Commissioner for Data Protection of Lower Saxony, who is competent for us.