Trust through
Transparency.

No customer content flows into external AI services. All AI functions in Unifyr run on EU-hosted models or are operated by instructed processors.

• No tracking without active cookie consent
• No cross-site tracking – data is not linked across products
• No sharing with advertising networks or third parties
• No personal user profiles
• IP anonymization active in analytics & pixel
• Data remains exclusively within EU jurisdiction
• Opt-out possible at any time via cookie settings
• Inbox data visible only to the respective website operator

The following data categories are under no circumstances entered into external cloud AI services (Claude.ai, ChatGPT, Higgsfield or others):

Measures that prevent data processing systems from being used by unauthorized persons.

• Password policy: minimum length 12 characters, upper/lowercase letters, special characters, numbers
• Two-factor authentication (2FA) for all administrative access and cloud services
• Automatic screen lock after 5 minutes of inactivity
• Automatic session timeout for all web applications
• Password manager mandatory for all employees (no reuse)
• Immediate account deactivation upon employee departure
• Regular review of active user accounts (quarterly)
• VPN mandatory for access to internal systems from home office

Ensuring that authorized users of a data processing system can only access the data covered by their access authorization.

• Role-based access control (RBAC) in all product systems
• Principle of least privilege – each employee receives only the rights necessary for their role
• Separation of development, test, and production environments
• No direct database access for end users – exclusively via API layer
• Database access only for administrators with documented justification
• Logging of all privileged access (audit log)
• Regular review of access rights (annually, immediately upon role change)

Ensuring that personal data cannot be read, copied, altered, or removed without authorization during electronic transmission or transport.

• Transmission exclusively over encrypted connections (HTTPS/TLS 1.2+)
• HSTS (HTTP Strict Transport Security) on all product domains
• No sending of personal data via unencrypted e-mail
• File transfers exclusively via secured, authenticated channels
• No transfer of personal data to insecure third countries
• Logging of data disclosures to sub-processors
• API communication exclusively via authenticated endpoints (Bearer Token / API Key)

Ensuring that it can subsequently be checked and determined whether and by whom personal data has been entered, modified, or removed from data processing systems.

• Complete audit log for all data changes in product systems (Wellpoint, GeoTrack)
• Timestamps for creation, modification, and deletion of all records
• Immutable log files (append-only logs)
• User ID is stored with every data change
• Form validation and input sanitizing to protect against manipulation
• Logs retained for at least 90 days

Ensuring that personal data processed on behalf of the controller can only be processed in accordance with the controller's instructions.

• DPA (Data Processing Agreement) with all sub-processors pursuant to Art. 28 GDPR
• Written instructions to all processors before processing begins
• Regular review of sub-processors (at least annually)
• Register of all sub-processors used is kept up to date
• Sub-processors may not engage further sub-processors without authorization
• Contractual obligation of all employees to confidentiality (§ 6 DSG)
• Data protection training for all employees with access to personal data

Ensuring that personal data is protected against accidental destruction or loss.

• Daily automatic backups of all databases (encrypted, EU-internal)
• Backup retention: 30 days rolling
• Redundant server infrastructure (Hetzner: multiple locations)
• UPS (uninterruptible power supply) and emergency generators at data center locations
• 99.9% availability SLA at ALL-INKL, guaranteed uptime at Hetzner
• 24/7 monitoring of all production systems with automatic alerting
• Disaster recovery plan documented and tested annually
• Recovery Time Objective (RTO) < 4 hours for critical systems
• Recovery Point Objective (RPO) < 24 hours

Ensuring that data collected for different purposes can be processed separately.

• Logical tenant separation: customer data from different clients is stored in isolation
• Strict separation of development, test, and production data
• No use of real data in test/development environments
• Separate databases per product (Wellpoint, GeoTrack, etc. do not share a database)
• Marketing data and operational customer data in separate systems
• Accounting data (Finanzbuchhaltung Monuth KG) separated from operational CRM data

• Dedicated data protection officer / contact person designated internally
• Incident response contact: datenschutz@pcm-group.at
• Register of all data protection breaches maintained internally

• Data protection considered from the beginning of product development (Privacy by Design)
• Most privacy-friendly settings by default (Privacy by Default)
• Data Minimization: collect only data strictly necessary for the purpose
• Storage limitation: deletion concepts defined for all data categories
• Cookie consent required before tracking (no pre-ticking)
• New features checked for data protection compliance before launch
• Data Protection Impact Assessment (DPIA) for high-risk processing

Pursuant to Art. 5 EU AI Act, the following AI practices are prohibited. PCM Group confirms that none of these systems are in use:

• AI-generated text drafts are labeled as such internally and reviewed by a human before sending
• No use of AI chatbots that pretend to be human
• No deepfakes or AI-generated media without labeling
• Users are informed when AI systems are used in the product context
• AI-supported decision assistance is communicated as such – final decision always rests with the human

• All AI systems are used as assistive tools – no autonomous decision-making without human approval
• AI outputs are reviewed by an employee before use
• No AI system has direct write access to production databases
• Kill switch: all AI services can be deactivated immediately
• No AI system makes decisions that have legal or significant financial consequences for individuals