Privacy policy

This privacy policy applies to Innovapps Customer Portal, our portal for service requests. Our website www.innovapps.de is covered by the privacy policy published there.

Privacy policy of www.innovapps.de

Controller

The controller responsible for data processing is:

Tobias Derucki
Adolfsallee 41
65185 Wiesbaden
Email: info@innovapps.de

You can find further details in our imprint.

Data protection officer

Ulrich Heun
Adolfsallee 41
65185 Wiesbaden
Phone: +49 611 988588-0
Email: datenschutz@innovapps.de

Hosting and access data

The portal runs on a server in Germany. With every request, the server processes, as technically necessary, your IP address, the date and time, the address requested and information about your browser, in order to deliver the page and to ensure secure operation (Art. 6(1)(f) GDPR). The connection is encrypted with TLS.

Signing in with a Microsoft account

When you sign in with your Microsoft account, we redirect you to Microsoft (Microsoft Ireland Operations Limited). Microsoft sends us a token with your name, your email address, an ID of your account, the ID of your organization's directory and whether Microsoft has verified your email address. We use it to check whether you belong to our staff or are a customer on our customer list with requests in Jira. We store your name, your email address and, for our staff, the account ID and role in encrypted form in your sign-in cookie. In our database, we write only your name (staff) or your email address (customers) to the log with each successful sign-in (see "Logs"). The legal basis is Art. 6(1)(b) and (f) GDPR.

Signing in with an emailed code

Members and organizers without a Microsoft account can sign in with a code. You enter your email address, and we check whether it belongs to a member on our customer list who has portal access and belongs to an organization. If so, we send an 8-digit code to that address, valid for 5 minutes and for one use. Whether or not the address belongs to a member, the page answers the same, so it does not reveal who is on the list. We keep the code only as a check value in the working memory of the application, never in the database; it is deleted when it is used, expires or the application restarts. To limit misuse, we also keep per email address, in the working memory and for at most 24 hours, the times at which codes were requested and the number of wrong entries. The email that carries the code is sent through our mail server and recorded in our mail log with the code masked. A successful sign-in gives the same sign-in cookie as the Microsoft sign-in, which contains your email address and role. The legal basis is Art. 6(1)(b) and (f) GDPR.

Customer list

Our customer list stores, for each member, the email address, the role (member or organizer), whether portal access is switched on, the time of the last sign-in and the organizations the member belongs to. Our staff maintain it, and the organizers of an organization can add, remove and switch off members of their own organization; staff and organizers see the time of the last sign-in in the member list, and staff also on the Overview. We delete your entry as soon as you no longer need access.

Service requests and Jira

We store and process your requests, with their subject, description and attachments, in Jira, a service of Atlassian Pty Ltd (Sydney, Australia) and its affiliates, including in the USA. When you create a request, the portal sends it to Jira through our service account: the subject, the description and the attachments, together with your email address, which we enter in the request's customer field so that you can see the request in the portal, and state at the top of the description so that our staff can see who submitted it. Our server forwards attachments to Jira without storing them permanently. When you download an attachment of a request, our server fetches it from Jira and passes it on to your browser, likewise without storing it. Comments written in the portal also go to Jira through our service account, together with any files attached to them, which our server forwards to Jira without storing them permanently, as for a request (members and organizers of customer organizations can attach files only where an administrator has allowed it for their organization): at the top of each comment we state who wrote it, for customers their email address and for our staff their name and email address, and we store this with the comment so that the portal can show who wrote it and let that person edit it. Our staff read requests and write comments in the portal, likewise through our service account; our staff see internal notes unless an administrator has turned that off, and members of customer organizations see them only if an administrator has allowed it (by default they do not). The portal shows you your requests with their status, comments and the names and profile pictures of the people involved.

Our server fetches profile pictures from Atlassian or Gravatar (Automattic Inc., USA) and delivers them itself; your browser does not connect to these providers.

Atlassian processes the data on our behalf. Transfers to third countries are based on the standard contractual clauses of the European Commission and, where the recipients are certified, on the adequacy decision for the USA (EU-U.S. Data Privacy Framework). The legal basis is Art. 6(1)(b) GDPR. We store the data in Jira for as long as this is necessary to process your request and statutory retention periods require it.

Email notifications

When a request of your organization changes in Jira (a new request, the organization or the watchers are set, or the status changes), the portal sends an email to the organizers of the organization and to the request's watchers who are members with portal access. Jira tells our server of the change (webhook), and our server also asks Jira for recent changes at regular intervals through our service account. The email contains the request's key, summary, organizations and status and a link to the portal; it is sent through our mail server and recorded in our mail log. So that each email goes out only once, we store an identifier of the change, without personal data, for 30 days. Changes made through the portal send no email. The legal basis is Art. 6(1)(b) and (f) GDPR.

Logs

We log technical errors in our database to ensure operation (Art. 6(1)(f) GDPR). In individual cases, these entries may contain an email address, for example when a mail server refuses delivery. When staff change the portal's settings, we also log the change together with the staff member's name. We also log each successful sign-in, with the email address of the member or the name of the staff member. We also log, without any content, which requests members create, comment on or change in the portal, which members organizers add or remove and to whom they give or take portal access, which requests staff create for members and which status, priority and watcher changes they make in the portal, and which status changes our team makes in the ticket system; these entries name the people involved by email address or name. Members see the entries about the requests of their own organizations under Recent activity on the Overview; otherwise only our developers have access to them.

We delete these entries after one year.

Cookies and local storage

We use only cookies and storage technologies that are strictly necessary. They are needed for the use of the portal that you have expressly requested and therefore do not require consent under Section 25(2) no. 2 TDDDG; the subsequent processing is based on Art. 6(1)(b) and (f) GDPR. We do not use analytics, tracking or marketing cookies and do not embed any content from third parties.

innovapps.auth (when large, split into innovapps.authC1, innovapps.authC2 etc.)

Keeps you signed in and contains the sign-in data mentioned above in encrypted form. Deleted when you close the browser and valid for at most 8 hours.

.AspNetCore.Correlation.*

Protects the sign-in via Microsoft against forgery. Deleted after sign-in, at the latest after 15 minutes.

.AspNetCore.OpenIdConnect.Nonce.*

Ties Microsoft's answer to your sign-in attempt. Deleted after sign-in, at the latest after 15 minutes.

.AspNetCore.Antiforgery.*

Protects forms against forged requests (cross-site request forgery). Deleted when you close the browser.

.AspNetCore.Mvc.CookieTempDataProvider

Carries one-time notices after a form is submitted. Deleted once read, at the latest when you close the browser.

lang (your browser's local storage)

Remembers the language you chose. Stored only when you switch the language, and kept until you clear your browser data.

theme (your browser's local storage)

Remembers the theme you chose. Stored only when you switch the theme, and kept until you clear your browser data.

admin-nav (your browser's local storage)

Remembers that you folded the side navigation of the admin pages into icons. Stored only when you fold it, removed when you unfold it, and otherwise kept until you clear your browser data.

requests-view (your browser's local storage)

Remembers the filters, grouping, sort, columns and page size you chose for the request list, but not your search. Stored when you change them, removed when you reset the view or return to the defaults, and otherwise kept until you clear your browser data.

Your rights

As a data subject, you have the following rights:

• under Art. 15 GDPR, the right to request information about your personal data processed by us to the extent set out there;
• under Art. 16 GDPR, the right to request without undue delay the rectification of inaccurate personal data or the completion of your personal data stored by us;
• under Art. 17 GDPR, the right to request the erasure of your personal data stored by us, unless further processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims;
• under Art. 18 GDPR, the right to request the restriction of the processing of your personal data where you contest the accuracy of the data, the processing is unlawful but you oppose its erasure, we no longer need the data but you need it for the establishment, exercise or defence of legal claims, or you have objected to the processing under Art. 21 GDPR;
• under Art. 20 GDPR, the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format or to request its transmission to another controller;
• under Art. 77 GDPR, the right to lodge a complaint with a supervisory authority. As a rule, you can contact the supervisory authority of your usual place of residence or work or of our registered office for this purpose. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information, Gustav-Stresemann-Ring 1, 65189 Wiesbaden.

Right to object

Where we process personal data as explained above to safeguard our legitimate interests, which prevail in a balancing of interests, you may object to this processing with effect for the future on grounds arising from your particular situation. Once you have exercised your right to object, we will no longer process your personal data for these purposes unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Contact

If you have questions about the processing of your personal data, for information, rectification, restriction or erasure, or to object, please contact info@innovapps.de or our data protection officer at datenschutz@innovapps.de.

As of October 2026