Privacy Policy
Customer Support Ticket System — CONR Community
Prepared under Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”)
| Controller | Visions Umsetzung S.L. |
| Registered address | Calle Lisboa 3, Bloque 1, Planta 1, Puerta 4, Urb. La Marina, 03177 San Fulgencio, Alicante, Spain |
| Contact e-mail | support@visions-umsetzung.com |
| Privacy contact | privacy@visions-umsetzung.com |
| System covered | Customer Support Ticket System, version 3.8.2 |
| Hosting provider | All-Inkl.com |
| Effective date | 16 September 2026 |
| Last reviewed | 18 September 2026 |
1. Introduction and Scope
This Privacy Policy explains how Visions Umsetzung S.L. (“Visions Umsetzung”, “we”, “us” or “our”) processes the personal data of members of the CONR community who submit, receive, or are otherwise referenced in support enquiries handled through the Customer Support Ticket System (the “System”).
The System is software supplied by Visions Umsetzung and, for this deployment, operated and administered by Visions Umsetzung on behalf of the CONR community. Unlike the standard deployment model described in the System’s technical documentation — under which each operator installs and runs the System on its own infrastructure and thereby acts as controller — Visions Umsetzung has, in this instance, taken on the operational role. Visions Umsetzung hosts the System on infrastructure it has contracted, monitors it technically on an ongoing basis, holds the System’s owner-level account, administers user roles and permissions, and determines and applies the retention periods described in Section 7. The day-to-day handling of individual enquiries is carried out by the CONR community’s own support staff, who work inside the System in the agent role, within the permissions set by Visions Umsetzung and under this Policy. Visions Umsetzung is accordingly the controller, within the meaning of Article 4(7) GDPR, for the personal data processed through this System.
The System is hosted by All-Inkl.com under a data processing agreement concluded between Visions Umsetzung and All-Inkl.com pursuant to Article 28 GDPR. CONR Solutions LTD does not host the System and is not a party to that hosting or processing arrangement.
This Policy applies to individuals who contact CONR’s community support function through the ticket system, and to any individual whose personal data appears within a ticket (for example, a person named in correspondence). It does not apply to CONR Solutions LTD’s wider website or other services, which may be covered by separate privacy notices.
2. Controller Identity and Contact Details
| Legal name | Visions Umsetzung S.L. |
| Registered address | Calle Lisboa 3, Bloque 1, Planta 1, Puerta 4, Urb. La Marina, 03177 San Fulgencio, Alicante, Spain |
| General contact | support@visions-umsetzung.com |
| Privacy / data protection contact | privacy@visions-umsetzung.com |
Visions Umsetzung is established in Spain. As the processing described in this Policy is carried out by an establishment within the European Union, the appointment of a representative under Article 27 GDPR does not apply to Visions Umsetzung in respect of this processing.
3. What Personal Data We Process
The System processes personal data of two groups: individuals who submit support enquiries (“enquirers”) and, in an administrative capacity, the staff who handle those enquiries. This Policy is addressed to enquirers; staff processing is noted for completeness and transparency.
3.1 Data of enquirers (CONR community members)
| Category | Data elements | Purpose |
|---|---|---|
| Contact details | Form of address, title, name, e-mail address | Identifying the enquirer and responding to the enquiry |
| Enquiry content | Subject line, message text, language, priority, department | Understanding and handling the matter raised |
| Attachments | Files in JPG, PNG, GIF, WebP or PDF format, up to 5 MB each | Supporting documentation for the enquiry |
| Case history | Replies, internal notes, status changes | Traceability of how the matter was handled |
| IP address | IP address of the connection used to submit the form | Protection against automated bulk submissions |
| Timestamps | Dates the ticket was created, changed, closed or deleted | Recording deadlines and providing an evidential record |
The System determines file type from the file’s actual content rather than its extension, and rejects file types outside those listed. Attachments are stored under randomly generated file names.
3.2 Data of the staff working in the System
Separately, the System processes data about the individuals who work in it — the Visions Umsetzung personnel who administer and monitor it, and the CONR support staff who handle enquiries. This covers account and role information, sign-in credentials (stored only as a cryptographic hash), and records of who accessed or changed a ticket and when. This is noted here for transparency; it is not the primary subject of this Policy, which concerns the community members whose enquiries are handled.
4. Purposes and Legal Bases for Processing
| Purpose | Processing activity | Legal basis (Art. 6(1) GDPR) |
|---|---|---|
| Handling support enquiries | Receiving, assigning, answering and documenting enquiries submitted through the System | Art. 6(1)(b) — performance of a contract or steps requested prior to entering into one, and/or Art. 6(1)(f) — legitimate interest in providing community support |
| Maintaining a case history | Recording replies, internal notes and status changes for each ticket | Art. 6(1)(f) — legitimate interest in accountable, traceable handling of enquiries |
| Security and abuse prevention | Storing the IP address of form submissions to limit automated bulk submissions | Art. 6(1)(f) — legitimate interest in protecting the System from abuse |
| Accountability and audit | Logging who accessed or changed a ticket, and separately logging security-relevant events | Art. 6(1)(c) — compliance with the accountability obligation under Art. 5(2) GDPR, together with Art. 6(1)(f) |
| Responding to legal obligations | Retaining records where required to establish, exercise or defend legal claims, or to respond to lawful requests from authorities | Art. 6(1)(c) — compliance with a legal obligation |
Where we rely on legitimate interests under Article 6(1)(f), that interest is our need to operate a functioning, secure and accountable support channel for the CONR community. We have considered that this interest does not override the interests or fundamental rights and freedoms of enquirers, given the limited and proportionate nature of the data collected and the access controls described in Section 9.
Special category data (Article 9 GDPR) is not intentionally collected through the System. If a data subject includes special category data in the free text of an enquiry (for example, health information), that data is processed only to the extent necessary to handle the enquiry, on the basis of Article 9(2)(e) GDPR or, where applicable, another Article 9(2) basis; this is assessed case by case.
5. Recipients of Personal Data
- Visions Umsetzung personnel who administer and monitor the System, and the CONR support staff who handle enquiries in it — in each case only within the role-based access controls described in Section 9.
- All-Inkl.com, as the hosting provider on whose infrastructure the System and its database are operated. All-Inkl.com acts as a processor on the basis of a data processing agreement concluded with Visions Umsetzung under Article 28 GDPR. CONR Solutions LTD has no direct hosting relationship with All-Inkl.com. A copy of that agreement is not published, but is made available on request to the competent supervisory authority and, at the controller’s discretion, to a data subject with a legitimate interest in reviewing the safeguards that apply to their data.
- The operator of any outgoing mail service used to send confirmations and replies, where such a service is used rather than a self-hosted mail server.
- Any provider engaged for external backup storage, where the backup function is enabled, subject to encryption as described in Section 9.
- Public authorities, regulators or courts, where disclosure is required by law.
Visions Umsetzung, as software supplier of the underlying System, does not itself access ticket content by default; in this deployment, however, Visions Umsetzung also hosts and administers the System, and therefore does have access in that operational capacity, as described in Section 1.
6. International Data Transfers
The System is hosted by All-Inkl.com under a data processing agreement concluded directly between Visions Umsetzung and All-Inkl.com pursuant to Article 28 GDPR. The location of All-Inkl.com’s server(s) used for this installation is Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. Where personal data is transferred to a location outside the EEA, such a transfer will only take place on the basis of an adequacy decision under Article 45 GDPR, or subject to appropriate safeguards under Article 46 GDPR (such as the European Commission’s Standard Contractual Clauses), together with any supplementary measures required following the CJEU’s ruling in Schrems II.
7. Retention Period
We keep a separate retention period for each purpose. The System applies these periods automatically; the figures below are the ones currently set.
| Purpose | Retention period | Trigger point and notes |
|---|---|---|
| Handling support enquiries and the case history (ticket, message, replies, internal notes, attachments) | 12 months in active handling | From closure of the ticket. The ticket first spends 30 days in an internal recycle bin, from which it can be restored. It is then taken out of day-to-day handling and kept with restricted processing, as described in the last row of this table. Reopening a ticket restarts the period. |
| Security and abuse prevention (IP address of the submission) | 6 months | From receipt of the enquiry. The IP address is removed from the ticket on its own schedule, independently of, and earlier than, the enquiry itself. It is not carried over into restricted retention. |
| Accountability and audit — ticket access log | Same period as the enquiry it documents | The access log forms part of the case history and is deleted together with it. |
| Accountability and audit — security log (permanent deletions, account and role changes, backups) | 5 years | From the date of the logged event. This log deliberately outlives an individual enquiry; it records ticket numbers only, never subject lines or e-mail addresses. |
| Establishing, exercising or defending legal claims, and responding to lawful requests from authorities | 5 years | From closure of the ticket. Once an enquiry leaves day-to-day handling it is kept with restricted processing: blocked for further handling, not shown in ticket lists, searches or notifications, and readable only by company management and the persons responsible for compliance, with every access logged. It is deleted automatically at the end of this period. Where an individual case is still needed beyond it — a pending dispute, an official request or an audit — it is marked as such in the System and kept until that reason ceases to apply. |
The period for restricted retention reflects the time within which claims arising from the underlying transaction can realistically still be raised. It is not used for any purpose other than those stated in this Policy.
Automatic database backups are overwritten after 14 days; until then they may still contain data that has been deleted from the live System.
8. Rights of Data Subjects
| Right | What it means | How it is supported by the System |
|---|---|---|
| Right of access (Art. 15) | To obtain confirmation of whether we process your data, and a copy of it | An export by e-mail address can be produced, containing the relevant tickets, message history, handling history, attachments, any retained cases and an explanation of the files included |
| Right to rectification (Art. 16) | To have inaccurate personal data corrected | Core ticket data can be corrected by administrators; every change is recorded in the ticket history |
| Right to erasure (Art. 17) | To have personal data deleted in certain circumstances | A two-stage process: tickets are first moved to a recycle bin, then permanently deleted (an irreversible step reserved for the account holding the highest level of access). Deletion removes the ticket, messages, history and attachment files. A retained case can likewise be deleted where no retention obligation applies |
| Right to restriction of processing (Art. 18) | To have processing limited rather than data deleted outright | Moving a ticket to the recycle bin takes it out of day-to-day handling while preserving it. After the operational period, retained cases are held in restricted form: blocked for handling, readable only by company management and compliance, and every access is logged |
| Right to data portability (Art. 20) | To receive data in a structured, commonly used, machine-readable format | Supported through the same export function used for access requests |
| Right to object (Art. 21) | To object to processing based on legitimate interests | Assessed on a case-by-case basis by the controller upon request |
| Right to withdraw consent (Art. 7(3)) | Where processing is based on consent, to withdraw it at any time | Applicable only where a specific processing activity is consent-based (none is by default in this System for enquirers) |
| Right to lodge a complaint (Art. 77) | To complain to a supervisory authority | See Section 12 |
Because permanent deletion of a ticket is, by design, irreversible and cannot be undone by anyone — including Visions Umsetzung — once carried out, we will take reasonable steps to verify a request before acting on it. When a ticket is deleted in response to an erasure request, the System’s security log deliberately records only the ticket number and not the subject line or e-mail address, precisely so that the log itself does not undo the erasure.
9. Security Measures
- Role-based access control across four defined roles (owner, super admin, agent, and a read-only compliance/auditor role), each with clearly bounded permissions.
- Staff passwords are stored solely as a bcrypt hash and cannot be recovered in clear text, even with direct database access.
- Optional two-factor authentication using one-time codes, which can be made mandatory for all administrative staff.
- Session identifiers that cannot be read by scripts, are restricted to their own origin, and are transmitted only over encrypted connections where those are in use.
- Protection against cross-site request forgery for all changing actions in the administrative area.
- Encrypted credential storage (AES-256-GCM) for any mailbox, sending, or backup credentials configured within the System.
- Encrypted, password-protected backup archives (AES-256), where the backup function is used.
- A complete, exportable audit history recording who accessed or changed each ticket and when, including read-only access.
- A separate security log recording operational events (permanent deletions, account changes, and similar) that must remain evidentially available beyond the life of any individual ticket.
- Retained cases are blocked for day-to-day processing: they are removed from the ticket list, search and notifications, cannot be answered or changed, and are readable only by company management and the persons responsible for compliance. Every access is logged.
- Defence against automated bulk submissions through the public enquiry form, including a hidden honeypot field, per-IP-address submission limits, and an optional arithmetic challenge.
- No loading of fonts, scripts, or other resources from third-party servers when System pages are displayed, in either the public or administrative areas.
Ticket content itself is stored unencrypted within the System’s database; there is no field-level encryption of message content. Protection of that content therefore depends on the access controls above, the security of the server on which the System is hosted, and the hosting arrangements with All-Inkl.com.
10. Automated Decision-Making and Profiling
We do not use the System to carry out automated decision-making, including profiling, that produces legal effects concerning individuals or similarly significantly affects them, within the meaning of Article 22 GDPR.
11. Source of Personal Data
In the ordinary course of using the System, personal data is provided directly by the individual submitting the enquiry. Where an enquiry is received by e-mail and automatically converted into a ticket, the data originates from the sender of that e-mail. Where a message references or is submitted on behalf of a third party, personal data about that third party may also be processed as part of the enquiry’s content.
12. Right to Lodge a Complaint
If you consider that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or the place of the alleged infringement. As Visions Umsetzung is established in Spain, the competent supervisory authority for Visions Umsetzung is:
| Authority | Agencia Española de Protección de Datos (AEPD) |
| Address | C/ Jorge Juan, 6, 28001 Madrid, Spain |
| Website | www.aepd.es |
This does not affect your right to lodge a complaint with the supervisory authority in your own Member State of residence, if different.
13. Changes to this Policy
We may update this Policy from time to time, including to reflect changes in the System, in the arrangement between Visions Umsetzung and the CONR community, and/or in applicable law. The version in force is indicated by the “Last reviewed” date above. Material changes will be brought to the attention of the CONR community through the ordinary channels used for community communications.
14. Contact
| General contact | support@visions-umsetzung.com |
| Privacy contact | privacy@visions-umsetzung.com |
| Postal address | Calle Lisboa 3, Bloque 1, Planta 1, Puerta 4, Urb. La Marina, 03177 San Fulgencio, Alicante, Spain |
This Privacy Policy is a legal transparency document addressed to data subjects. It is distinct from, and does not replace, the System’s technical and organisational documentation, any internal record of processing activities (Art. 30 GDPR), or any data processing agreement between Visions Umsetzung and third parties such as its hosting provider.