Justima

Login

Book a demo

Book a demo

Privacy Policy

Effective Date: 14 January 2026

1. Controller (Art. 13(1)(a) GDPR)

Justima GmbH
Innere Kanalstr. 15, 50823 Cologne, Germany
HRB 125023, Amtsgericht Köln (Local Court of Cologne)
Phone: +49 176 56845784
E-mail: info@justima.app

Represented by its managing directors:
Alexander Lilienbeck,
Christian Braun,
Gereon Abendroth

2. Data Protection Contact

E-mail: datenschutz@justima.app
Phone: +49 176 56845784

We have not appointed a Data Protection Officer, as there is currently no statutory obligation to do so. You may direct all data protection enquiries to the contact details above at any time.

3. Overview: Purposes, Legal Bases, Categories

We process personal data primarily for the following purposes:

  • Provision and operation of the website and our services (e.g. account, authentication)
  • Communication (support, enquiries)
  • Contract fulfilment (where you use our services under a contract)
  • IT security, abuse/error analysis
  • (Only with your consent) Reach measurement and statistics using Google Analytics 4 (GA4)

Legal bases (depending on the processing):

  • Art. 6(1)(b) GDPR – contract / pre-contractual measures
  • Art. 6(1)(c) GDPR – legal obligations
  • Art. 6(1)(f) GDPR – legitimate interest, e.g. security/operations
  • Art. 6(1)(a) GDPR – consent, e.g. analytics

In addition, for cookies/device access: § 25(1) TDDDG (consent), where not strictly necessary.

Typical data categories (depending on context):

  • Contact data (name, e-mail, phone number if applicable)
  • Account/contract data (login, contract status, plan/tier if applicable)
  • Usage and device data (e.g. IP address, timestamps, browser/device information, log data)
  • Content/inputs you create or upload within the product (if used)

4. Processing in Detail

Website visit, hosting, server log files

When you access our website, technically necessary data are processed in order to deliver the page and ensure security (e.g. IP address, date/time, page/URL accessed, referrer, browser/device information, error/log data if applicable).

  • Purpose: Operation of the website, delivery of content, IT security, error analysis
  • Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, stable operation)
  • Retention period: Log data are retained only for as long as necessary for security and error analysis; statutory or provider-specific retention periods may apply at hosting providers (see "Retention Period")

Service provider (processor):

Scalingo (Scalingo SAS, France)

  • Purpose: Hosting and operation of the website

Cloud infrastructure, platform, database

We use cloud infrastructure providers for the operation of our services, which supply platform, storage and database services.

Open Telekom Cloud (Telekom Deutschland GmbH, Germany) – Processor

  • Purpose: Cloud platform, data storage, backend infrastructure
  • Data processed: Application data, user data (as described in this Privacy Policy) stored/processed on the platform
  • Server location: Germany (EU)

Google Cloud (Google Cloud EMEA Limited, Ireland) – Processor

  • Purpose: Cloud platform, data storage, backend infrastructure, AI models
  • Data processed: Application data, user data (as described in this Privacy Policy) stored/processed on the platform
  • Server location: EU (West Europe Region)

4.2 Contact (e-mail, phone, form if applicable)

When you contact us, we process your information (e.g. name, e-mail, phone number, message content) in order to respond to your enquiry.

  • Purpose: Processing and responding to enquiries
  • Legal basis: Art. 6(1)(b) GDPR (pre-contractual/contractual) or Art. 6(1)(f) GDPR (general enquiries)
  • Retention period: Until completion of processing; beyond that only where statutory retention obligations exist or legal defence requires it

4.3 Registration, user account, authentication (Auth0)

A user account is required to access certain features. Registration and login are handled via Auth0 (Identity-as-a-Service by Okta, Inc.). We process, together with our processor, identification and account data (e.g. e-mail address, technical login/session information, name if applicable, roles/permissions, settings, security features such as MFA).

  • Purpose: Account creation, authentication (login, SSO/MFA if applicable), provision of features, abuse prevention and IT security
  • Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(f) GDPR (legitimate interest in secure operation and account security)
  • Retention period: Generally for the duration of the account; thereafter deletion/anonymisation, unless obligations or interests preclude this (the contractual data processing agreement applies accordingly to processing by the service provider)

Service provider (processor):

Auth0 / Okta (Okta Inc., 35 Shelbourne Road, Ballsbridge, Dublin 4, D04 A4E0, Ireland)

  • Purpose: Identity and access management; registration, login, Single Sign-On (SSO), Multi-Factor Authentication (MFA), session/token management
  • Data processed (typical): E-mail address, technical identifiers, authentication and session data, IP address, device/browser information, profile information depending on configuration

4.4 In-app content / inputs / uploads (if used)

Where you enter content into the product, upload files or configure settings, we process this data to provide the service (e.g. processing your inputs, storing settings, delivering results).

  • Purpose: Provision of product features, support, error analysis
  • Legal basis: Art. 6(1)(b) GDPR (contract)
  • Retention period: Generally for the duration of the account or as long as you store the content; deletion after account deletion, unless obligations or claims preclude this

4.5 Notifications via Gateway API (Denmark)

We use a Gateway API to send notifications from the application. This enables us to inform you about important events, updates or information.

  • Purpose: Sending notifications and messages from the application
  • Legal basis: Art. 6(1)(b) GDPR (contract) or Art. 6(1)(a) GDPR (consent, where you have actively selected notification options)
  • Data processed: E-mail address and/or phone number (where selected for notifications)
  • Retention period: For the duration of your account or until you change your notification settings or delete your account

Processing only takes place where you have enabled the relevant notification channels (e-mail and/or phone) in your account settings.

4.6 Google Analytics 4 (GA4) – only with consent

Where you have given your consent, we use Google Analytics 4 (GA4) to statistically analyse the use of our website. GA4 helps us understand how visitors use the website (e.g. which pages are visited) in order to improve content and navigation.

Typical data categories in GA4 (depending on configuration):

  • Online identifiers (e.g. cookie/device IDs)
  • Device/browser information (e.g. device type, operating system, browser version, language)
  • Usage data/events (e.g. page views, clicks, dwell time, interactions)
  • Approximate location (derivable from IP-based information; no GPS tracking)

Important:

  • GA4 is only loaded after your active consent (opt-in). No analytics tracking takes place before consent is given.
  • Consent may be withdrawn at any time via the cookie settings.
  • IP addresses are not stored by Google Analytics 4 for EU traffic; they are used only to derive an approximate location and are then discarded.

Details:

  • Purpose: Reach measurement, statistics, website improvement
  • Legal basis: Art. 6(1)(a) GDPR (consent)
  • Device access/cookies: § 25(1) TDDDG (consent), as analytics are not strictly necessary
  • Recipient: Google Ireland Limited
  • Retention period: As configured in GA4 (event data retention); we have configured an appropriate retention period

5. Cookies & Consent Management

We use cookies and similar technologies. Necessary technologies are required for the operation of the website (e.g. security functions, login). Non-necessary technologies (e.g. analytics) are only used with your consent.

  • Consent: is obtained via a consent banner
  • No "continued browsing" as consent: Consent requires an active action (e.g. clicking "Accept")
  • Withdrawal: with effect for the future, possible at any time via the cookie settings

Further details on the specific cookies/tools used can be found in our Cookie Policy.

6. Data Processing Outside the EU/EEA

Your data are generally processed and stored within the European Union or the European Economic Area (EU/EEA).
Where service providers operate on a group-wide basis (e.g. Google, Okta/Auth0) or data may in exceptional cases be processed outside the EU/EEA, we have concluded Standard Contractual Clauses (SCCs) with these providers pursuant to Art. 46(2)(c) GDPR where required. These ensure a level of protection equivalent to that of the GDPR. In addition, we implement technical and organisational measures (e.g. encryption, access restrictions).

Providers such as Google may also be certified under the EU-US Data Privacy Framework (DPF); the respective provider's information and SCCs are decisive.

7. Retention Period (Art. 13(2)(a) GDPR)

We retain personal data only for as long as necessary for the respective purposes or as required by statutory retention obligations.

The key criteria are in particular:

  • Duration of the contractual relationship / user account
  • Statutory retention periods (typically 6, 8 or 10 years depending on the document type)
  • Limitation periods for potential legal claims
  • Security and error analysis (log data: limited period)

8. Your Rights (Arts. 15–21 GDPR)

You have the following rights against us:

  • Access (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection (Art. 21 GDPR), in particular against processing under Art. 6(1)(f) GDPR
  • Withdrawal of consent (Art. 7(3) GDPR) with effect for the future

To exercise your rights, please contact us at: datenschutz@justima.app

Right to lodge a complaint (Art. 77 GDPR)

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for North Rhine-Westphalia is, for example:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestr. 2–4, 40213 Düsseldorf, Germany
Postfach 20 04 44, 40102 Düsseldorf

9. Obligation to Provide Data (Art. 13(2)(e) GDPR)

The provision of certain personal data may be necessary in order to conclude a contract with us or to use our services (e.g. e-mail address for registration, account and support).

Consequence of non-provision: We may be unable to provide the relevant services or process enquiries.

Data that we process solely on the basis of your consent (e.g. analytics) do not need to be provided. You will suffer no disadvantage if you do not give consent – except that we will be unable to analyse usage statistically.

10. No Automated Decision-Making / No Profiling (Art. 13(2)(f) GDPR)

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). Profiling within the meaning of Art. 22 GDPR does not take place.

11. Changes to this Privacy Policy

We may update this Privacy Policy if the legal situation, our services or processing activities change. The current version applies from the effective date stated above or the date indicated in the policy.