Eviworx
DE Start free trial

Privacy Policy

Last updated: 2026-10-19 (customer and contract data, data backup)

1. Data Controller

Eviworx Software UG (haftungsbeschränkt)
Schillerstraße 96
63263 Neu-Isenburg
Germany
Email: info@eviworx.com

2. Purpose of Data Processing

This License Server validates Eviworx ITSM Software licenses. We only process data necessary for license management:

  • Customer and contract data: company, address, VAT ID, contact persons (name, email address, phone, role), contract number, term, cancellation, agreed services and prices (see 4.1)
  • Trial request data: company, contact person, email address, optional phone number, planned number of agents (see 4.4)
  • Technical data: Installation fingerprint (SHA-256 hash), IP address during heartbeat communication, timestamps
  • Usage data: Active agent count (anonymous number, no usernames)

Providing this data is required for using the software and license validation. Without this data, use of the software is not possible.

3. Legal Basis

Processing is based on:

  • Art. 6(1)(b) GDPR (contract performance) – to fulfill the software license agreement
  • Art. 6(1)(f) GDPR (legitimate interest) – to ensure technical operations, IT security, and abuse prevention

4. Stored Data in Detail

4.1 Customer and Contract Data

To perform the license agreement we process the customer's company, address, country, VAT ID and preferred language, the contract data (contract number, start, term, renewal, cancellation, agreed license type, services, prices and discounts) and the contact persons named by the customer with name, business email address, phone number and role (commercial, technical, advance notice before renewal). The role determines who receives notices about the contract, its renewal and the license. The legal basis is Art. 6(1)(b) GDPR; for the customer's contact persons Art. 6(1)(f) GDPR (communication with the contracting party).

Contract data is stored for the duration of the contractual relationship and in accordance with statutory retention obligations (up to 10 years under commercial and tax law). Contact persons are stored as long as they are responsible for the customer; we delete them earlier when the customer tells us or at your request.

4.2 Heartbeat Data

During automatic license checks (heartbeat), the following data is transmitted and stored:

  • IP address of the sending server
  • Installation fingerprint (cryptographic hash, not plain text)
  • Number of active software agents (count only, no names)
  • Timestamps and technical sequence numbers

Retention: Heartbeat logs are automatically deleted after no more than 90 days.

4.3 Activation Codes

During offline activation, the installation fingerprint and the generated activation code are stored. The activation code contains only license information (e.g., plan, limits, expiry date) and no personal data.

4.4 Trial Requests

When you request a trial on this website, we process your company, the name of the contact person, email address, optionally your phone number, the planned number of agents, your IP address and the time of the request. The purpose is to provide the trial license, to contact you about your request and to prevent abuse (one trial per company).

  • Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures at your request); abuse checks based on email domain and IP address: Art. 6(1)(f) GDPR
  • Email confirmation: we send a six-digit code and a confirmation link. No trial is created without confirmation.
  • Product news: only with your separate, voluntary consent (Art. 6(1)(a) GDPR), revocable at any time by email to info@eviworx.com.
  • Email delivery: via the mailbox lizenz@eviworx.com at IONOS SE (see 7, data processing agreement, processing within the EU).
  • Protection against automated requests (Cloudflare Turnstile): on the trial page only we use Turnstile by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Your IP address and technical characteristics of your browser are transmitted to Cloudflare to check whether the request comes from a human ("managed" mode: usually without a puzzle, a short confirmation if suspicious). Turnstile sets no cookies and serves no advertising or analytics purposes. The purpose is to protect the form against abuse, in particular against mass sending of confirmation emails to foreign addresses (Art. 6(1)(f) GDPR). Reading the browser characteristics is strictly necessary for this protection of the service you requested (Section 25(2) no. 2 TDDDG). A data processing agreement with Cloudflare is in place; the transfer to the USA is based on the EU-US Data Privacy Framework, under which Cloudflare is certified. More information: cloudflare.com/privacypolicy
  • One trial per installation: when a trial license is activated we store two technical identifiers of the helpdesk installation (installation ID and database identifier) as hash values only. They contain no contact details and are kept after your details are deleted, so that no second trial can be started on the same installation (Art. 6(1)(f) GDPR).
  • Retention: unconfirmed requests are deleted after 7 days, rejected requests after 30 days (except the email domain for abuse checks). If a trial ends without a contract, your personal details are deleted 12 months after its end. If a contract is concluded, the periods in 4.1 apply.

5. Cookies

This website uses only technically necessary cookies:

  • Session cookie (evx_lic_sid): For admin login and the flow of the activation and trial pages (protection against forged form requests), deleted when the browser is closed
  • Language cookie (lang): Stores the selected language (de/en), valid for 1 year

No tracking, analytics, or marketing cookies are used.

6. No Third-Party Sharing

Stored data is not shared with third parties.

There is:

  • no tracking
  • no analysis by external services
  • no transfer to third countries outside the EU – except the security check on the trial page (see 4.4)
  • no content loaded from third parties (no CDNs, no external fonts or scripts) – with the same exception

7. Hosting

This website and the mailbox lizenz@eviworx.com are operated by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany.

A data processing agreement pursuant to Art. 28 GDPR has been concluded with the hosting provider.

Processing takes place within the European Union (exception: security check on the trial page, see 4.4).

The encrypted data backup (see 8) is stored on a server operated by us at Microsoft Azure in the Frankfurt am Main data centre (region Germany West Central). The contracting party is Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland; a data processing agreement pursuant to Art. 28 GDPR is in place with Microsoft.

8. Data Security

Data transmission is encrypted using TLS/SSL.

Technical log data may be temporarily processed to ensure operations and detect abuse.

Data backup: the database of this License Server is backed up daily so that it can be restored after an outage or error (Art. 6(1)(f) GDPR). Each backup is encrypted on the License Server itself; the decryption key is held only by us and not by the hosting provider. We keep the backups of the last 30 days and one monthly backup for 12 months; in addition, Microsoft backs up the server for 30 days. Deleted data therefore remains in the backups for up to 14 months and is then removed automatically; backups are used for restoration only.

9. Your Rights

Under the GDPR, you have the following rights:

  • Right of access to your stored data (Art. 15 GDPR)
  • Right to rectification of inaccurate data (Art. 16 GDPR)
  • Right to erasure of your data (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object to processing (Art. 21 GDPR)

To exercise your rights, please contact: info@eviworx.com

10. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority.

The competent authority is:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Postfach 3163
65021 Wiesbaden
Germany
https://datenschutz.hessen.de

11. Automated Decision-Making

No automated decision-making within the meaning of Art. 22 GDPR takes place.