Technology becomes Culture

Privacy Policy

How the Culturise backoffice (secure.culturise.tech) processes personal data under the GDPR.

1. Overview

This privacy policy explains which personal data we process when you use the Culturise backoffice portal, for which purposes, and which rights you have under the General Data Protection Regulation (GDPR / DSGVO).

2. Controller

The controller responsible for data processing on this portal is:

Culturise Consulting UG (haftungsbeschränkt)
Osterstraße 86-90, c/o Thorsten Thater, 20259 Hamburg, Germany
Phone: +49 40 24896967
Email: info@culturise.tech

3. Data we process

Depending on how you use the portal, we may process the following categories of data:

  • Account data: email address and display name of registered users.
  • Authentication data: passwords are stored only as one-way cryptographic hashes; we never store plaintext passwords.
  • Session and security data: PHP session identifiers and CSRF tokens required to keep you signed in and to protect forms.
  • License metadata managed in the portal (for example site URL, label, status, and hashed license tokens) when you use license management features.
  • Technical data that may appear in server logs (for example IP address, timestamp, requested URL, user agent) for security and reliable operation.

4. Purposes of processing

We process personal data to authenticate authorised Culturise team members, provide plugin downloads and license management, protect the portal against abuse (including rate limiting of login attempts), and keep the service secure and available.

5. Legal bases

Processing is based on the following provisions of Art. 6 GDPR:

  • Art. 6 (1) lit. b — performance of a contract or pre-contractual measures (providing access to the backoffice and related services).
  • Art. 6 (1) lit. f — legitimate interests in secure operation, fraud prevention, and IT security of the portal.
  • Art. 6 (1) lit. c — compliance with legal obligations where applicable (for example statutory retention requirements).

6. Cookies

This portal uses only technically necessary cookies. No marketing or analytics cookies are set by the backoffice itself.

  • culturise_portal — session cookie used to keep you signed in. It is HttpOnly, SameSite=Strict, and Secure when served over HTTPS. It expires when the browser session ends.
  • portal_lang — stores your preferred interface language (en, de, or pt_BR) for about one year.

You can delete cookies in your browser settings. Disabling the session cookie will prevent sign-in; disabling the language cookie only resets the language preference.

7. Fonts (third-party content)

This portal loads the Instrument Sans typeface from Google Fonts (fonts.googleapis.com / fonts.gstatic.com). Your browser may transmit your IP address and technical request data to Google when loading these fonts. Processing by Google is governed by Google’s privacy policy.

8. Retention

Account data is retained for as long as the user account is active and as long as needed to operate the portal. After an account is disabled or deleted, data is removed or anonymised unless longer retention is required by law. Session data is deleted when the session ends or expires. Server logs are kept only as long as needed for security and operations.

9. Security

We use HTTPS/TLS encryption in production, hashed passwords, CSRF protection on authenticated forms, hardened session cookies, and access controls limited to authorised users. No method of transmission or storage is completely secure; we continuously improve our safeguards.

10. Recipients and hosting

Personal data is processed on infrastructure operated for Culturise to host this portal. We do not sell personal data. Data is disclosed to third parties only where necessary to provide the service (for example hosting providers acting as processors), where required by law, or with your consent.

11. Your rights

Under the GDPR you have the following rights, subject to legal conditions:

  • Right of access (Art. 15)
  • Right to rectification (Art. 16)
  • Right to erasure (Art. 17)
  • Right to restriction of processing (Art. 18)
  • Right to data portability (Art. 20)
  • Right to object to processing based on legitimate interests (Art. 21)
  • Right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, workplace, or the place of the alleged infringement

12. Contact

For privacy requests regarding this portal, contact support@culturise.tech or info@culturise.tech.