Privacy

1. Data Controller

Wenske Cyber Solutions GmbH

Bastian Wenske

Heidelberger Straße 15

12059 Berlin

Germany

Email: [email protected]

Phone: +49 30 417 277 82

2. Overview

The customer portal is where employees of our customers find runbooks and file support requests. We process your sign-in details from Microsoft Entra ID, whatever you write into a request, and technical operating logs.

The portal sets no analytics or advertising cookies and loads no scripts, fonts or images from third-party servers. The only cookie is your sign-in session.

3. Signing in with Microsoft Entra ID

You sign in with your organisation's work account. Microsoft Entra ID provides us with:

• your name
• your sign-in address (user principal name)
• your organisation's directory id (tenant id)
• for WCS employees, membership of the group that governs internal access

There is no separate password for this portal and we store none. The directory id decides which data you see — it is the boundary between organisations.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract with your employer).

4. Session cookie

After you sign in we set an encrypted cookie that identifies your session. It is strictly necessary, is not used for analytics, and expires when you sign out and when the session lifetime ends.

Legal basis: Sec. 25(2)(2) TDDDG and Art. 6(1)(b) GDPR.

5. Your requests

For each request we store the subject, the description, the message history, your name and sign-in address, timestamps, the status and — for orders — the approval decision with the person and the moment it was made.

Please write only what is needed to work on the request. Special categories of personal data under Art. 9 GDPR, such as health data, do not belong in a support ticket.

Legal basis: Art. 6(1)(b) GDPR.

6. Processors

We use the following processors to run the portal:

• Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland — sign-in (Entra ID), hosting on Azure and email through Microsoft 365.
• Notion Labs, Inc., 2300 Harrison St, San Francisco, CA 94110, USA — storage of requests and runbooks.
• Slack Technologies Limited, Salesforce Tower, 60 R801, North Dock, Dublin 1, Ireland — internal notification of WCS about new requests.

The internal notification carries only the request number, the customer, the request type, the subject and the link into the portal — no free text from your request.

Transfers to the United States are based on the European Commission's standard contractual clauses.

7. Log data

Running the portal on Azure produces technical logs holding the time, the address requested, the status code and a correlation id. Our application logs deliberately contain no names and no content from requests.

Legal basis: Art. 6(1)(f) GDPR (stable and secure operation).

8. Retention

Requests and their history are kept for the duration of the business relationship with your organisation and deleted afterwards, unless a statutory retention period applies. Technical logs are deleted after 30 days at the latest.

9. Your rights

Under the GDPR you have the following rights:

• Access (Art. 15 GDPR): you may request information about the data we hold about you.
• Rectification (Art. 16 GDPR): you may have inaccurate data corrected.
• Erasure (Art. 17 GDPR): you may request that your data be deleted.
• Restriction (Art. 18 GDPR): you may request that processing be restricted.
• Objection (Art. 21 GDPR): you may object to the processing of your data.
• Portability (Art. 20 GDPR): you may receive your data in a structured, common format.

To exercise your rights, please write to [email protected].

10. Supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit

Friedrichstr. 219

10969 Berlin

https://www.datenschutz-berlin.de