1. Controller
Schierle Siyaya GmbH
Rampenstraße 2, 41472 Neuss
Phone: +49 2131 7768 468
E-mail: info@schierle-siyaya.com
2. What Siyaya Share is
Siyaya Share is the project portal of Schierle Siyaya GmbH for exchanging documents with customers and suppliers. Access is by invitation only. This policy covers the portal at siyaya-share.com; the website schierle-siyaya.com has its own privacy policy.
3. Data we process
Account data
E-mail address, name, company, optionally a phone number, the password (stored only as a salted hash), language and display preference, platform role and project roles. Purpose: providing access and showing who you are to the members of your projects. Legal basis: Art. 6(1)(b) GDPR (performance of the business relationship with you or your company) and Art. 6(1)(f) GDPR (our legitimate interest in working together securely).
Two-factor authentication
Signing in requires a one-time code from an authenticator app (TOTP) for every account. For this, Supabase stores a secret key per account, from which your app derives the codes, and records when a code was confirmed; the app itself runs on your device and sends us nothing. Administrators can see whether 2FA is set up and can remove the key (for example after losing a phone). Legal basis: Art. 6(1)(f) GDPR and Art. 32 GDPR (security of processing).
Project content
Files and their versions, folders, notes, dates and to-dos that members of a project add. Only the members of that project and the administrators of Schierle Siyaya GmbH can access them. Legal basis: Art. 6(1)(b) and (f) GDPR.
Change and access log
To make the exchange of documents traceable we log, with time and person: sign-ins, opening a project, uploads, downloads and opening files, and every change to folders, files, members, notes, dates and to-dos. Members of a project see its changes; owners and administrators additionally see accesses. We do not store IP addresses in this log. Legal basis: Art. 6(1)(f) GDPR (traceability of document exchange, IT security, evidence in the business relationship).
Technical data
When the portal is accessed, our hosting providers process technical connection data (e.g. IP address, time, browser) in server logs to deliver the service and to defend against attacks. Legal basis: Art. 6(1)(f) GDPR.
4. Recipients and processors
- Supabase (Supabase Inc., USA) — database, sign-in and file storage, hosted in the EU (Frankfurt am Main, Germany).
- Vercel (Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA) — hosting of the web application; server functions run in the EU region Frankfurt (fra1).
- Resend (Resend Inc., USA), if used — sending invitation and password e-mails via its EU region (Ireland).
We have concluded data processing agreements (Art. 28 GDPR) with these providers. Where data may be transferred to the USA, the transfer is based on the EU Standard Contractual Clauses and/or the provider's certification under the EU-US Data Privacy Framework.
5. Cookies and local storage
The portal sets only technically necessary cookies: the sign-in session (Supabase, sb-…) and your language choice (share-lang, 1 year). Your light/dark choice is kept in your browser's local storage. There is no tracking, no analytics and no advertising. Fonts are delivered by the portal itself; no connection to Google Fonts is made. Legal basis: § 25(2) no. 2 TDDDG.
6. Retention
Account data is kept as long as you have access to the portal and deleted when the account is closed, unless statutory retention obligations apply. Project content is deleted when its project is deleted. Log entries are kept for as long as they are needed as evidence of the document exchange, as a rule for up to three years after the end of the project.
7. Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). Contact us at info@schierle-siyaya.com. You also have the right to lodge a complaint with a supervisory authority, for example the one responsible for us:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Postfach 20 04 44, 40102 Düsseldorf
www.ldi.nrw.de