Privacy notice

1. Controller

NG IT-Projekte, proprietor Nikolas Gottschalk, Sonnenhof 150, 53119 Bonn, Germany. Email: kontakt@1stlevel.tech.

No data protection officer has been appointed because the statutory conditions for designation are not currently met. Please send privacy requests to the email address above.

2. Allocation of roles

NG IT-Projekte is the controller for account, contract, billing, security and service communication data. The customer is generally the controller for ticket content and personal data entered into 1stlevel; NG IT-Projekte processes that data on the customer’s behalf under the Data Processing Agreement.

Customers must give their requesters and staff the information required for their own processing and use the configurable privacy notice in the support form where necessary.

3. Data and purposes

• Account data: company name, name, email address, password hash, role, language, and the version and time of contractual acceptance for setup, authentication and contract performance.
• Support data: sender and recipient details, subject, messages, internal notes, attachments, status, assignment and timestamps to provide the ticket system on the customer’s behalf.
• Billing data: billing address, country, VAT ID and Stripe references for billing, payments and bookkeeping. Full card details are processed directly by Stripe and are not stored on our systems.
• Technical data: IP address, timestamps, browser and device details, session and security events, and server logs where required for delivery, abuse prevention, troubleshooting and security.
• Integration data: API token hashes, webhook destinations and delivery status, and email metadata used to perform customer-configured functions.
• Contact data: name, email address, subject and message for responding to requests submitted through the public contact form.
• DSA notice data: content concerned or exact location, reasons for the alleged illegality, accuracy statement and, optionally, name and email address for assessing and handling a notice.

4. Legal bases

We process contract, contact and account data to take pre-contract steps and perform the contract (Art. 6(1)(b) GDPR), billing and transaction data for contract performance and statutory record-keeping (Art. 6(1)(b) and (c) GDPR), and technical security, delivery and abuse data for our legitimate interests in secure, stable and economic operation and in preventing and investigating misuse (Art. 6(1)(f) GDPR).

We process contact-form information to answer pre-contractual or contractual requests under Art. 6(1)(b) GDPR and, in other cases, for our legitimate interest in handling business communications under Art. 6(1)(f) GDPR.

We process notices of allegedly illegal content to comply with Arts. 16 and 17 DSA under Art. 6(1)(c) GDPR and to assess, prevent and document unlawful use under Art. 6(1)(f) GDPR.

Where we process ticket data on behalf of a customer, that customer determines the applicable legal basis. 1stlevel is not responsible for the lawfulness of the customer’s collection.

5. Hosting, storage and email

The application, PostgreSQL database, queue, sessions and private object storage run through Laravel Cloud (Laravel Holdings Inc., USA) in the Frankfurt region. Laravel Cloud uses further infrastructure providers, particularly Amazon Web Services. Laravel’s Data Processing Agreement applies; possible third-country access is protected by the safeguards stated there, particularly EU Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.

Hostinger International Ltd., Cyprus, including the affiliates and sub-processors named in its Data Processing Addendum, is used for inbound and outbound email. Messages and metadata also pass through the email infrastructure of the customer and the relevant senders or recipients. Data-processing agreements are in place with providers used as processors.

Information about the safeguards used and a copy of the applicable data-protection clauses may be requested at kontakt@1stlevel.tech. Trade secrets and security-sensitive details may be redacted.

6. Stripe and VAT IDs

We use Stripe Payments Europe, Limited, Ireland, for checkout, subscriptions, payments and invoices. Depending on the activity, Stripe acts as a processor and as an independent controller, particularly for payment execution, fraud prevention and legal obligations. Stripe’s Data Processing Agreement and privacy information apply. Third-country transfers may rely on the EU-US Data Privacy Framework and/or EU Standard Contractual Clauses.

An EU VAT ID is first checked locally for format and country consistency. Before a Stripe purchase using a VAT ID, it is validated through the European Commission’s VIES service; the VAT ID, country and request details required as evidence are processed for this purpose. If VIES cannot provide a reliable result, the purchase is not treated as tax-confirmed.

7. Customer-selected recipients

Where a customer configures webhooks, API access, email forwarding or other integrations, the selected data is sent to recipients chosen by that customer. The customer is responsible for selection, legal basis and safeguards for those recipients.

8. Cookies and analytics

We use only technically necessary cookies or similar storage for sign-in, sessions, CSRF protection and an expressly selected persistent login. Session and CSRF storage is generally limited to the session or configured inactivity period; persistent login ends on sign-out, session revocation or expiry of the technical token. This storage is strictly necessary to provide the functions expressly requested by the user (section 25(2)(2) TDDDG).

The public support form is served without an ambient session. We use no advertising, profiling or analytics cookies and therefore currently require no consent banner.

9. Retention and deletion

Accounts and support content are stored for the contract term. After a trial or paid term ends, the account remains read-only for no more than 60 days so the customer can export data or reactivate it. An administrator may trigger immediate account deletion in account settings.

Before final tenant deletion, a private access-controlled deletion export is made as protection against operator error. This complete export is automatically removed after 30 days. Infrastructure backups are used only for restoration and overwritten under the provider’s cycles. Billing records are kept separately, generally for eight years from the end of the year in which they arose; longer retention may be legally required in an individual case.

Application, server and security logs are stored only as long as required for operations, troubleshooting and abuse protection. The exact period depends on the infrastructure plan and technical log type; Laravel Cloud provides short fixed retention windows by plan. Extracts required for a specific security or legal matter may be retained separately until it is resolved and applicable limitation periods expire.

Contact requests are deleted once finally resolved unless contractual, statutory or evidentiary reasons require further retention. Purely general requests are normally removed no later than six months after resolution; contract- or law-related correspondence may be retained until statutory retention and limitation periods expire.

Notices under Art. 16 DSA and the related decision are normally erased twelve months after the procedure is closed. Where needed for an official or judicial proceeding, defence against claims or a statutory evidence duty, they remain restricted until that matter ends or the relevant period expires.

10. Data subject rights

Subject to the GDPR, individuals have rights of access, rectification, erasure, restriction and portability. They may object, on grounds relating to their particular situation, to processing based on Art. 6(1)(f) GDPR. Consent may be withdrawn prospectively at any time without affecting the lawfulness of earlier processing. Requests about ticket content should first be directed to the relevant 1stlevel customer as controller; we assist that customer.

Complaints may be lodged with a data protection authority. The authority responsible for our establishment is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

Requests may be sent informally to kontakt@1stlevel.tech. We generally respond within one month; for complex or numerous requests, Art. 12(3) GDPR allows an extension of up to two further months. We will explain any extension and its reasons within the first month.

11. Required information and automated decisions

Account and billing data marked as required is necessary to enter into and perform the contract. Without it, an account or paid subscription cannot be provided. We do not conduct profiling or solely automated decision-making producing legal or similarly significant effects.

12. Data sources and changes

We receive account data from the registering person and invited users. Billing data comes from the customer and Stripe. Ticket and communication data enters the service directly through forms and email or through customer forwarding and input. Where we process this data solely as a processor, the relevant customer is responsible for notices under Arts. 13 and 14 GDPR.

We update this privacy notice when processing, providers or law change. The version published on this page with its stated date applies; existing customers will also be informed appropriately of material changes.