Privacy notice

Everplate is operated from Germany and used across Europe. This notice explains what personal data we process, why, on what legal basis, who we share it with, where it is stored, how long we keep it and what rights you have. We apply the EU General Data Protection Regulation, the German Federal Data Protection Act (BDSG) and the German Telecommunications and Digital Services Data Protection Act (TDDDG, formerly the TTDSG).

If anything here is unclear, write to hello@everplate.io and a person will read it.

1. Who is responsible

The controller within the meaning of Article 4(7) GDPR is:
Laddro Digital UG (haftungsbeschränkt)
Belziger Str. 69-71
10823 Berlin, Germany
HRB 285589 B, Amtsgericht Charlottenburg
Managing Director: Oussama Bentaib
Email: hello@everplate.io

We have not appointed a Data Protection Officer. Our processing does not meet the threshold in Article 37 GDPR or § 38 BDSG. If it does, we will appoint one and say so here.

2. Where this notice applies

• The marketing website at everplate.io, the pages you are reading now.
• The application at app.everplate.io, where customers create an account, subscribe, upload documentation and publish it.
• The published pages that a QR code on a machine resolves to, and the files downloaded from them.

3. Scanning a QR code on a machine

Anyone standing in front of a machine can reach its documentation. There is no account, no sign in and no registration of any kind, and that is deliberate: an operator who needs a safety instruction must not be asked to identify themselves first.

The page a scan lands on:

• sets no cookie and writes nothing to your device;
• contains no analytics, no tracking pixel and no script at all;
• loads nothing from any third party, no fonts, no libraries, no images from elsewhere;
• carries no identifier for you. The address encodes the machine version, never the person looking at it, so two people scanning the same plate are indistinguishable to us.

Because nothing is stored on or read from your device, § 25 TDDDG requires no consent and no cookie banner appears.

It is still an ordinary web request. To send you the page and the files, our server necessarily receives your IP address, the address you requested and your browser's user agent, and those appear in hosting logs. We process them under Article 6(1)(f) GDPR, in our legitimate interest in delivering the documentation, keeping the service available and defending it against abuse. We do not combine them with anything else, we do not count or profile scans, and we do not report scan activity to the customer whose documentation you are reading.

4. Visiting this marketing website

This website is a set of static files. It has no forms, no login, no comment function and no newsletter. It sets no cookies, uses no analytics or A/B testing tool, embeds no social media buttons and loads no fonts or scripts from a third party. There is no cookie banner because there is nothing to consent to.

As in Section 3, our hosting provider receives the connection data needed to serve a page. Legal basis Article 6(1)(f) GDPR.

5. Your account

To create an Everplate account we ask for an email address, a password and your company name. The password is stored only as a cryptographic hash, never in readable form, and cannot be recovered by us or by anyone else. The company name becomes the name of the account and appears on invoices.

Signing in sets one cookie, everplate_session. It holds your session token, is marked HttpOnly and SameSite, is sent only over HTTPS in production, and expires within about an hour unless renewed. It is strictly necessary to operate a service you have asked for, so it is exempt from consent under § 25(2) No. 2 TDDDG.

Legal basis for account data: Article 6(1)(b) GDPR, performance of the contract you enter into with us.

6. Payment and the trial

Everplate has no free plan. Starting the 14 day trial requires a card, so payment data is collected at sign up rather than at the end of the trial.

Card details are entered directly into a payment form operated by Stripe Payments Europe, Ltd. and never reach our servers. We create a customer record at Stripe holding your company name and email address, and we store, on our side, the Stripe customer and subscription identifiers, the plan you chose, the subscription status and the date the trial ends. Stripe processes card data as an independent controller for its own compliance and fraud prevention purposes, under its own privacy policy.

Legal basis: Article 6(1)(b) GDPR for taking payment, and Article 6(1)(c) GDPR for keeping invoices and accounting records that German tax law requires.

7. The documentation you publish

When you upload manuals, declarations of conformity or declarations of incorporation, we host them for you. For that content you are the controller and we are the processor acting on your documented instructions under Article 28 GDPR. You decide what goes in, we decide nothing about it, and we do not open your files for any purpose other than storing, compiling and serving them.

Documentation of this kind routinely contains personal data about people who have never used Everplate. An EU Declaration of Conformity names and is signed by a particular person. Manuals name safety officers, technical authors and contact people. Once you publish, those names are on a publicly reachable page for as long as your obligation lasts, which under Regulation (EU) 2023/1230 is at least ten years after the machine was placed on the market.

That is a deliberate property of the product, not an accident, and it has a consequence you should plan for: published revisions are write-once. A correction is a new revision, and the superseded one stays retrievable with its original date and checksum, because a manual that can be silently rewritten is worthless as evidence. Erasing a name from a published revision is therefore not something we can do on request, and Article 17(3)(b) GDPR recognises exactly this situation, where processing is necessary to comply with a legal obligation. If you need a person removed from documentation, publish a corrected revision. If you believe something was published unlawfully, write to us and we will work through it with you.

If you are named in documentation published through Everplate and want to know who put it there, write to hello@everplate.io. We will tell you which customer controls that page and pass your request to them, as Article 14 GDPR requires of us as processor.

8. Publication records

Every publication writes an evidence record: which account and which signed in user published, when, which files, their sizes, their SHA-256 checksums, the languages offered, and, for a correction, what it corrects and why. That record is the point of the service. It is what lets a customer show a market surveillance authority in 2037 what was published in 2027, and it is retained for as long as the documentation it describes.

Legal basis: Article 6(1)(b) GDPR, and our and our customers' legitimate interest under Article 6(1)(f) GDPR in documentation that can be proven rather than asserted.

9. Processors we use

These providers process personal data on our behalf under a data processing agreement. There are no others. We use no analytics provider, no advertising network and no third party tracking of any kind, on any Everplate surface.

We do not sell personal data, we do not share it with advertisers, and we do not use your documentation to train any model.

10. Where data is stored, and transfers outside the EU

Our database, our API and the published files all rest in the European Union. Some of the providers above are established outside the EU or operate global infrastructure, so some processing can take place outside the European Economic Area. For those transfers we rely on the safeguards in Chapter V GDPR:

• the European Commission's Standard Contractual Clauses, Decision (EU) 2021/914, in the data processing agreement with each provider;
• certification under the EU-U.S. Data Privacy Framework, where the provider is certified;
• encryption in transit, encryption at rest and access control as supplementary measures.

Write to us if you want the detail of the safeguards applied to a particular transfer. Customers who need a signed data processing agreement of their own can ask for one.

11. Cookies and local storage

Everplate uses exactly one cookie, the session cookie described in Section 5, and only after you sign in. It is strictly necessary and exempt from consent under § 25(2) No. 2 TDDDG. Nothing is stored on the device of a visitor to this website or of anyone scanning a QR code, so § 25(1) TDDDG never applies to them and there is no consent banner anywhere on Everplate.

12. Security

Measures appropriate to the risk, in line with Article 32 GDPR:

• TLS enforced on every Everplate address.
• Encryption at rest for the database and for stored files.
• Passwords stored only as cryptographic hashes, never in readable form.
• Session tokens in HttpOnly cookies with the Secure and SameSite attributes in production.
• Published revisions protected against overwriting at three layers: the application refuses it, the object store refuses it, and the database refuses updates and deletes on published history.
• Secrets held in a managed secret store and never committed to source code.
• A documented incident procedure, including notification to the supervisory authority within 72 hours under Article 33 GDPR and to those affected under Article 34 GDPR where the risk requires it.

No system is perfectly secure. If you find a security problem, write to hello@everplate.io.

13. How long we keep things

There is no self service account deletion yet. Write to hello@everplate.io and we will close and delete the account, keeping only what tax law obliges us to keep. Published documentation is the deliberate exception described in Section 7: leaving is easy, but a machine in the field does not stop needing its manual because a subscription ended.

14. Your rights

Under the GDPR you have the right to:

• Access, Article 15. Ask for a copy of the data we hold about you.
• Rectification, Article 16. Ask us to correct anything wrong.
• Erasure, Article 17, subject to the limits in Section 7 and to records we are legally obliged to keep.
• Restriction, Article 18. Ask us to pause processing while something is checked.
• Portability, Article 20. Ask for the data you gave us in a structured, machine readable form. A full export of your documentation is available to customers at any time and stays free.
• Objection, Article 21. Object to processing based on legitimate interest.
• Withdraw consent, Article 7(3), without affecting anything done before you withdrew.
• Not be subject to automated decisions, Article 22. We make none. Nothing in Everplate profiles anyone or decides anything about a person automatically.
• Complain to a supervisory authority, in particular the Berlin Commissioner for Data Protection and Freedom of Information, or the authority where you live or work.

Write to hello@everplate.io to exercise any of these. We may need to confirm your identity first. We answer within one month as Article 12(3) GDPR requires, and tell you if a complex request needs longer.

15. Children

Everplate is a business service for importers, authorised representatives and manufacturers of professional machinery. It is not directed at children and we do not knowingly process their data.

16. Changes to this notice

We may update this notice, and the date at the top changes when we do. Where a change materially affects how we process personal data, we give customers at least 30 days' notice by email or inside the application before it takes effect.

17. Contact

Laddro Digital UG (haftungsbeschränkt)
Belziger Str. 69-71
10823 Berlin, Germany
Email: hello@everplate.io