Privacy policy

Translation. The German version is authoritative; this English text is for information. Draft, pending review by counsel.

This policy covers the sur.plus product application (app.surpluspurpose.com). The landing page (surpluspurpose.com) has its own privacy notice.

Controller

Florian Lechner, Landsberger Straße 57, 82266 Inning am Ammersee-Stegen, Germany. service@surpluspurpose.com. Once sur.plus UG (haftungsbeschränkt) is registered it takes his place and we will update this policy.

What we process

Demo workspace (/demo): no account, no tracking, no cookies. Sample data only; nothing you enter is persisted.

Customer workspace (after sign-in): account e-mail and workspace profile (role, organization), the operational data your organization enters (listings, needs, matches, messages, documents) and a security audit trail. Legal basis: performance of contract (Art. 6(1)(b) GDPR) and legitimate interest in platform security (Art. 6(1)(f) GDPR). Retention: for the term of the contract; exportable before closure and deleted 30 days after, subject to statutory retention duties.

Messages between the parties: chat threads on a match are stored so both sides can trace what was agreed. Legal basis: performance of contract (Art. 6(1)(b) GDPR). Retention: 24 months after the match closes, earlier on request where no evidentiary duty stands in the way. Either side can export the full thread at any time as a file, with timestamps and participants. This is meant for companies that may not conduct business communication solely on an external platform; on request we set up an automatic copy to an address you nominate.

Verification evidence: to verify recipients we process the documents submitted: exemption notice, register extract, proof of public or church-run status, or, for private individuals and small businesses, evidence of public-benefit activity such as project presences, references and prior impact. Legal basis: performance of contract or pre-contractual steps (Art. 6(1)(b) GDPR) and legitimate interest in protecting releasing companies and other recipients (Art. 6(1)(f) GDPR). Where your project involves special categories under Art. 9 GDPR, meaning religious, political or health-related work, we rely on your explicit consent (Art. 9(2)(a)) or on the data having manifestly been made public by you (Art. 9(2)(e)). Please submit only what the check requires. Retention: for the partnership if admitted, six months if rejected.

Verification fee: where a small business or private individual pays the one-off fee, we process the data needed for payment and invoicing. Legal basis: performance of contract (Art. 6(1)(b) GDPR) and legal obligation (Art. 6(1)(c) GDPR). Retention: invoicing data for ten years under commercial and tax law.

Completing a match: so the handover can happen, we pass your contact details to the other side, and for a paid transfer also the details needed for the invoice to the releasing company. That company is an independent controller for its further processing; this is a transfer, not processing on our behalf. Legal basis: performance of contract (Art. 6(1)(b) GDPR).

Cookies

The app uses strictly necessary cookies only: the Supabase authentication session, Cloudflare Turnstile for bot protection on sign-in and registration, and a flag for the chosen language. No analytics, no advertising, no third-party trackers, which is why there is no cookie banner (§ 25(2) TDDDG / Art. 6(1)(f) GDPR).

Processors and hosting

Content delivery, DNS and bot protection (Turnstile): Cloudflare. Hosting and server functions: Netlify. Database and authentication: Supabase, EU region (Frankfurt). E-mail delivery: Resend, EU region (Ireland). Data processing agreements are in place with these providers. Stripe is intended for payment processing; we will update this policy before the first payment is processed.

International transfers

Some providers are US companies or have US parent companies (Cloudflare, Inc.; Netlify, Inc.; Supabase, Inc.; Resend, Inc.), even where data sits in an EU region. Where personal data is transferred to the USA we rely on appropriate safeguards: EU Standard Contractual Clauses and, where available, the provider’s certification under the EU-US Data Privacy Framework. Finalising these is part of our pre-launch legal review.

Your rights

You have the rights of access, rectification, erasure, restriction, portability and objection (Art. 15–21 GDPR). Where processing rests on consent you may withdraw it at any time with effect for the future. You also have the right to lodge a complaint with a supervisory authority (for us: BayLDA, Ansbach). Contact us at service@surpluspurpose.com.

Version 2026-08 · pre-launch phase.