Legal information

This is a translation for your convenience. Only the German version of these documents is legally binding.

Privacy policy of Commitly GmbH

Personality rights in connection with data protection are important to COMMITLY. We therefore attach great value to the confidentiality of your personal information. We have drawn up these guidelines in order to explain what information we collect, how we use it and what choices you have.

Please take enough time to familiarise yourself with our practices for protecting personality rights and contact us as soon as you have any questions.

A. Definitions

  1. “We” or “Commitly” is Commitly GmbH, FN 476463 g, commercial register court Wiener Neustadt, with its registered office at Dr. Clemens Pirquet-Strasse 43, 2380 Perchtoldsdorf, (“Commitly”).
  2. “You” or “user” is a natural person who creates a user account with Commitly for the use of the Commitly platform as a consumer and/or submits a corresponding enquiry to Commitly.
  3. The “Commitly website” is the website created by Commitly and used for marketing purposes.
  4. The “Commitly platform” is a software application created and offered by Commitly. You can use the Commitly platform by calling up the corresponding web page (web application).
  5. “Data protection provisions” are these provisions, which give you information on what data is collected from you by Commitly and how it is processed. When a user account is created, the data protection provisions are made known to you. We reserve the right to adapt the above privacy policy at any time in observance of the current legal requirements. An update will be made known to you by email to your registered email address. This notice will also inform you of your right of objection (which you can exercise directly by deleting your account) and of the consequences of the objection. If the updated data protection provisions are the reason why you no longer wish to use Commitly, you can delete your user account at any time up to the moment the update comes into force. This ends the usage relationship with Commitly.
  6. “Personal data” is the data of a person that identifies them personally, such as their name, their email address or their telephone number, or other non-public data in this connection.
  7. “Service providers” are providers of software-related or remote-communication-based services as well as companies used by Commitly to process payments or to render technical services.
  8. “Anonymous data” is data that is not connected to personal data. Anonymous data no longer makes it possible to identify an individual person.

B. General

  1. Commitly GmbH, FN 476463 g, commercial register court Wiener Neustadt, Dr. Clemens Pirquet-Strasse 43, 2380 Perchtoldsdorf, (“Commitly”) offers you the possibility of enabling data on incoming and outgoing payments from bank and credit card accounts as well as other payment services for viewing and of analysing and evaluating it according to certain criteria, as well as of being informed about movements in your accounts by a notification function.
  2. Commitly collects, uses and processes your personal data exclusively within the framework of the provisions of Austrian data protection law. In the following we inform you about the nature, scope and purposes of the collection and use of personal data. You can call up this information at any time on our website Commitly.com.
  3. This privacy policy is also provided in an English translation. In the event of any discrepancy between the German version and a translation, the German version shall prevail.

C. Data protection principles

  1. We undertake to handle all of your personal data that is passed on to us in accordance with the applicable Austrian data protection laws. That means in particular that we do not pass it on to third parties. We also undertake to collect, record, store, alter, block or delete the personal data protected by the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG) only for the purpose of the lawful performance of our tasks. The data is not used for purposes other than the lawful performance of our tasks.
  2. Our technical infrastructure reliably protects against unauthorised third parties being able to view and alter the data stored with us (data security and integrity). Through the choice of the location of our data centre, we ensure that European law is complied with by our service providers.
  3. The data we collect is either provided by you when you use the Commitly platform or make use of functions and services, or it arises within the course of that use. In order for the Commitly platform to be usable as intended, user data is always necessary.
  4. The data created by you in the course of using the Commitly platform and of services and/or functions within the Commitly platform, in particular via the login (in so far as you select this) and via the application, is stored on dedicated servers in the highly secure data centre of Amazon Web Services (AWS) in Frankfurt, but is not used or otherwise processed by the server service provider.

D. Data provided by you

  1. When you register, for example by signing up and subsequently logging in, you leave basic data (including the information on how you found us on the internet) which is transmitted to us. This data is prescribed by the registration form and is collected, stored and used exclusively for the use of the Commitly platform and its services. Using this registration data, we may inform you about changes, additions or new versions of the Commitly platform and about information made available via the website as well as, for example, about news on the website/the application.
  2. Registration for a newsletter can take place either via a login or by signing up with an email address. In the case of the email address, no further information is necessary. You are, however, free to provide further information of your own accord when signing up for the newsletter. By signing up for the newsletter, you as the person signing up expressly agree that the confirmation of registration and then the newsletter will be sent to the email address provided.
  3. In the context of the newsletter subscription and in the context of registration, we are also entitled to inform you about changes, additions or new versions of the website or of the Commitly app and of the functions offered through it, and about information made available via the website as well as, for example, about news regarding the available banks.
  4. In the context of and in order to enable the use of the Commitly platform or the provision of the functions named in the usage agreement, Commitly records various kinds of data, some of which is provided by you and some of which is necessary for the use of the Commitly platform and for the associated provision of services, or arises through that use.

E. Use of the Commitly platform or services

COMMITLY uses analytics services so that we can better understand how you use our website and our applications. In doing so, you help us to develop the COMMITLY experience further and to improve our communication with you step by step.

  1. In order to improve the quality and the security of our service, we store for statistical purposes the data on each individual access to the pages of the Commitly platform that your browser/the application transmits whenever you visit the website/use the app. These server logs contain data such as your web request/usage call, your IP address, browser type, browser language, the date and time of your request and one or more cookies by which your browser can be uniquely identified, as well as general information for example when errors occur and the information from security events (change of password, password recovery, change of email address), since this is necessary for use. The IP address is stored in shortened form in compliance with data protection law.
  2. When you visit our website and in the course of the provision of services, the website sends one or more cookies – small files containing a string of characters – to your computer or your other device, by means of which the browser is uniquely identified. We use cookies to improve the quality of the website, including to store usage preferences and to track user trends as well as to measure how you found our website and our services on the internet. When you visit the website or subpages, we may place one or more cookies in the browser. You can set your browser so that it notifies you when a cookie is sent. That gives you the possibility of either accepting or rejecting a cookie. The data we record and analyse is used to improve services and the website, to make the web experience personal and to enable easy logging in where log-in cookies have been set permanently.
  3. We make use of the services of third-party providers in order to assess the effectiveness of the Commitly platform and of the services and to determine how you use the Commitly platform and/or the services. For this purpose we may use counting pixels (web beacons) on the pages of the Commitly platform, which the third-party providers make available to Commitly for this purpose. The information we record includes the pages visited, navigation patterns and similar data. This statistically collected data enables us to find out which services within the Commitly platform are of most interest to users and which offers users most like to look at. Although the provider logs the data originating from our website on our behalf, we have control over how this data may or may not be used. The cookie itself does not contain any personal data, but if you provide personal data (such as your user ID) when visiting the website and do not delete the cookie from your browser after providing this data, the provider records the non-personal data stored in the cookie (such as the number of visits) and stores it anonymously.

F. Our services

Registration – user account (“account”)

  1. In order to be able to use our services, you must first register with us on the platform. To do so you must open an account and enter your email address and a password. You complete the registration by entering your personal data, such as surname and first name. We store this data for the duration of the platform contract, assigned to your account.
  2. In order to make the best possible use of the services offered by Commitly, you can at any time supplement your profile information on the platform with further personal details in the electronic forms provided in your account. This data is likewise stored by us for the duration of the platform contract.

Registration for the retrieval of account data (“bank connection”)

  1. To enable one or more bank, credit card and/or payment service accounts of your company on the platform, we collect and process the following further personal data: account number and bank sort code or IBAN and BIC, usage identifier / login and PIN or password (“access data”).
  2. At no time does Commitly store the access data you enter for the purpose of connecting the account.
  3. You can of course remove the connected bank, credit card and/or payment service accounts again at any time.

Provision and use of your account data (“synchronisation”)

  1. In the course of synchronisation, data on account balances and on incoming and outgoing payments of your company (“transactions”) from the bank, credit card and/or payment service accounts you have enabled on the platform is transmitted to us by the respective account-holding institutions.
  2. These transactions
    • we store for the term of the platform contract existing with you,
    • we use and process in order to present them to you for your information in overviews as part of the planning – including by carrying out analyses and evaluations – in your password-protected user area on the platform,
    • we use and process in order to keep you up to date by notifications about movements in your enabled accounts.

Use of the COMMITLY “Account” and the “COMMITLY Card”

  1. When using the COMMITLY Account, account opening and payment processing take place via our partner Swan SAS.
  2. The data protection provisions and regulatory requirements of our payment service provider additionally apply to these services.
  3. The processing of personal data serves, among other things, identity verification, account opening, transaction processing and fraud prevention.

G. Commissioned data processing

COMMITLY uses third-party providers in order to be able to make the services of the COMMITLY platform available to you. You will find more detailed information in our data processing agreement pursuant to Art. 28 GDPR, which is concluded between the Commitly customer (controller or principal) and Commitly GmbH (processor or contractor).

BANKSapi Technology GmbH (account information and payment initiation service)

To connect bank accounts, to provide account information services and to initiate payments, we use BANKSapi Technology GmbH, Maximilianstraße 13, 80539 München. BANKSapi is registered with BaFin as an account information service and licensed as a payment initiation service under the German Payment Services Supervision Act (ZAG) (PSD2). We only initiate a payment via BANKSapi if you use the COMMITLY Bills add-on and expressly instruct the payment. BANKSapi processes personal data exclusively on the instructions of Commitly and is subject to German data protection law. A corresponding data processing agreement pursuant to Art. 28 GDPR has been concluded.

https://www.banksapi.de/datenschutz/

finAPI GmbH (account information service)

The transaction data within the account information service is provided by the external interface provider finAPI GmbH (“finAPI”), Ainmillerstraße 11, 80801 München, which processes the data under supervision and exclusively on the instructions of Commitly. As a German company, finAPI is bound by German data protection law. The access data for accounts & cards is additionally stored in encrypted form at finAPI. Commitly has no access to this access data. A corresponding contract on the processing of personal data on behalf of the controller has been concluded between finAPI and Commitly.

https://www.finapi.io/

Swan SAS (embedded finance / payment infrastructure)

For the technical provision of business accounts and for carrying out SEPA payments we use Swan SAS, 95 Avenue du Président Wilson, 93100 Montreuil, Frankreich, registration number 86245. Swan is an electronic money institution regulated under French law and is fully subject to the General Data Protection Regulation. The processing takes place exclusively on the basis of a data processing agreement pursuant to Art. 28 GDPR.

https://www.swan.io/privacy-policy

Mindee SAS (text recognition of invoices)

Mindee SAS, 14 rue Charles V – CS 26154 – 75181 Paris Cedex 04, France.

For the automatic text recognition (OCR) of invoices that you upload in COMMITLY Bills or submit by email, we use Mindee. In doing so, the document files and the information they contain (e.g. name and address of the invoicing party, invoice amounts, bank details) are processed on behalf of COMMITLY. Processing takes place in data centres in the EU (AWS, Ireland). A data processing agreement pursuant to Art. 28 GDPR has been concluded; in so far as sub-processors of Mindee process data outside the EU, this takes place on the basis of the EU standard contractual clauses.

https://www.mindee.com/privacy-policy

Mailgun Technologies, Inc. (email receipt)

Mailgun Technologies, Inc., 112 E Pecan Street #1135, San Antonio, TX 78205, USA.

We receive invoices that you send by email to your COMMITLY invoice inbox via the Mailgun service. In doing so, the email including attachments, sender and recipient address and time stamp are processed on behalf of COMMITLY. Processing takes place exclusively in Mailgun’s EU region. A data processing agreement pursuant to Art. 28 GDPR has been concluded; Mailgun Technologies, Inc. is also certified under the EU-US Data Privacy Framework.

https://www.mailgun.com/legal/privacy-policy/

windata GmbH – konfipay (account information service, EBICS)

windata GmbH, Weißgerberweg 11, 88239 Wangen im Allgäu, Germany.

To retrieve account information and to connect bank accounts via EBICS, we use the konfipay service of windata GmbH. In doing so, account information and bank statements are retrieved and, where you instruct this, payment orders are transmitted to your bank. Processing takes place on behalf of COMMITLY in European data centres (Microsoft Azure, Western Europe). A data processing agreement pursuant to Art. 28 GDPR has been concluded.

https://www.cisbox.com/datenschutzerklaerung/

Chargebee (subscription administration)

Parts of your personal data (the name of your company, first name and surname) serve to identify you and your company and to check the payment methods offered. As part of the registration, your first name and surname are passed on to the service provider ChargeBee (Chargebee Inc., 340 S Lemon Avenue, #1537, Walnut, California 91789, USA). In addition, your payment data such as credit card and bank details (depending on the payment method you have selected) is collected, used and processed for the purpose of payment processing and passed on to payment service providers and to the credit card company or bank you have specified, and used and further processed by them. At no time does Commitly store credit card data in connection with a transaction.

https://www.chargebee.com/

Braintree Payment (payment processing)

Commitly uses Braintree Payments (“Braintree”) as a payment gateway. Braintree is a service of PayPal (Europe) S.à r.l. et Cie, S.C.A.. Braintree is used exclusively to process the payments between Commitly and its users. For this purpose the credit card data recorded in Chargebee is transmitted to Braintree for further processing.

https://www.braintreepayments.com/at/legal

GoCardless Ltd. (account information service, direct debit & payment administration)

GoCardless Ltd., 65 Portland Place, London W1B 1NB, Vereinigtes Königreich.

We use GoCardless as an account information service to retrieve account information from your connected bank accounts and to process SEPA direct debits and payment mandates within the COMMITLY platform. In doing so, personal data (e.g. name, IBAN, mandate reference) is transmitted to GoCardless on behalf of COMMITLY and processed there. GoCardless hosts data in the EU (data centre Dublin, Ireland) and uses EU standard contractual clauses to safeguard data transfers to third countries. The processing takes place exclusively on the basis of our instructions and in accordance with Art. 28 GDPR. Further information:

https://gocardless.com/privacy/

Intercom (customer experience)

We make use of third-party services in order to understand the use of Commitly better. In particular we transmit some of your information (such as your email address and the date of your registration) to Intercom, Inc. (“Intercom”) and use Intercom when you visit our website or use our product in order to collect data for analytical purposes. Intercom analyses your use of our website and/or our product and tracks the development of our customer relationship so that we can improve our service for you. We also use Intercom as a medium for communication, either by email or in the form of messages within our product/our products. In addition we use Intercom to make a help section available to you.

https://intercom.io/

Mailchimp (newsletter management)

When sending our newsletter to registered prospective customers and when sending transactional emails to users, we make use of Mailchimp (a brand of The Rocket Science Group, LLC, Georgia, USA) within the framework of commissioned data processing. Mailchimp was carefully selected by us as a specialised service provider and is checked by us regularly in order to ensure that your privacy is preserved. Mailchimp processes your personal data only on behalf of and on the instructions of us and may use your personal data exclusively for the purposes we specify. Compliance with these data protection provisions and with the necessary security measures is guaranteed at all times.

https://mailchimp.com

Pipedrive Ireland Limited (CRM management)

Pipedrive Ireland Limited, 4th Floor, 7–8 Wilton Terrace, Dublin 2, Irland.

Pipedrive provides us with a CRM platform with which we administer customer data and map sales processes. In doing so, personal data (e.g. name, email, contact history) is transmitted to Pipedrive and processed there on behalf of COMMITLY. Pipedrive uses standard contractual clauses to safeguard EU data transfers. You will find further information in the Pipedrive privacy policy:

https://www.pipedrive.com/en/privacy

GetStream.io (in-app messaging & activity feeds)

GetStream.io Inc., 548 Market St PMB 62437, San Francisco, CA 94104, USA.

We use GetStream.io to handle in-app messages and activity feeds in the Commitly platform. In doing so, personal data (e.g. user IDs, message content, timestamps) is transmitted to GetStream.io on behalf of COMMITLY and processed there. GetStream.io hosts data in the EU (data centre Dublin, Ireland) and uses EU standard contractual clauses to safeguard data transfers to third countries. The processing takes place exclusively on the basis of our instructions and in accordance with Art. 28 GDPR. You will find further information at:

https://getstream.io/legal/privacy/

Flatfile, Inc. (data import & preparation)

Flatfile, Inc., 1550 Wewatta Street / Suite 200, Denver, CO, USA

We use Flatfile for the secure capture, validation, normalisation and preparation of imports of customers’ ERP data (e.g. CSV/Excel imports, field mappings and validation rules). In the course of these services, personal data (e.g. names, email addresses, company data, account information and transaction data contained in uploaded files) may under certain circumstances be processed by Flatfile in exceptional cases. Flatfile processes this data exclusively on our instructions and acts as a processor within the meaning of Art. 28 GDPR. Flatfile operates its services on Amazon Web Services (AWS) and offers customer-side options for regional hosting configurations (including EU regions); the specific hosting region follows from the configuration agreed between Commitly and Flatfile. You will find further details on data protection, security measures and data processing at Flatfile here: https://flatfile.com/privacy/

1. Website hosting

Our website commitly.com is operated by Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg (AWS Amplify, region eu-central-1 in Frankfurt am Main). When the website is accessed, AWS processes technically necessary data such as IP address, date and time, the page accessed and browser information in order to deliver the page and to protect it against attacks. The legal basis is our legitimate interest in secure and stable operation (Art. 6 (1) (f) GDPR). A data processing agreement pursuant to Art. 28 GDPR is in place; transfers to the USA are covered by the EU standard contractual clauses and by certification under the EU-US Data Privacy Framework.

To manage your consent we use Cookiebot of Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark. On your first visit we ask you which categories (necessary, preferences, statistics, marketing) you consent to. Services in the statistics and marketing categories only load after you have given your consent. Cookiebot stores your decision, a pseudonymous identifier, date and time and your settings in order to be able to prove consent (Art. 6 (1) (c) GDPR). You can change or withdraw your consent at any time via the “Cookie settings” link at the bottom of the page.

https://www.cookiebot.com/en/privacy-policy/

3. Google Tag Manager

We use Google Tag Manager of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The Tag Manager itself does not set any cookies and does not evaluate any data; it loads the other services named in this section in accordance with your consent. In doing so, your IP address is transmitted to Google.

4. Google Analytics 4

With your consent (Art. 6 (1) (a) GDPR) we use Google Analytics 4 of Google Ireland Limited to understand how our website is used. Pseudonymous usage data such as pages accessed, time spent, device, browser and approximate location are processed; Google does not store IP addresses from the EU. Google LLC, USA, is certified under the EU-US Data Privacy Framework; the EU standard contractual clauses also apply.

https://policies.google.com/privacy

5. Advertising and performance measurement: Google Ads, Microsoft Advertising, Meta, Reddit

With your consent (Art. 6 (1) (a) GDPR) we use services that allow us to measure the success of our ads and to show visitors to our website relevant ads on other platforms (conversion tracking and remarketing):

In doing so, cookies or comparable identifiers are set and data such as pages accessed, time, device and the information whether you clicked on an ad and subsequently registered are transmitted. The parent companies of these providers in the USA are certified under the EU-US Data Privacy Framework; the EU standard contractual clauses also apply.

6. Referral and partner programme: Cello and FirstPromoter

For our referral programme, through which customers recommend COMMITLY, we use Cello of PowerPlay GmbH, Sumpfmeisenweg 3a, 81249 Munich, Germany. For our partner programme with external sales partners we use FirstPromoter of Igil Webs SRL, Strada Ploiești 9, Birou 817, Etaj 8, 400157 Cluj-Napoca, Romania. If you come to us via a referral or partner link, these services store an identifier so that a later registration can be attributed to the referring person or partner. The legal basis is your consent (Art. 6 (1) (a) GDPR) or, where you take part in the programme yourself, the performance of the contract (Art. 6 (1) (b) GDPR). FirstPromoter stores data with hosting providers in the USA; personal data may be transferred to the USA in the process. FirstPromoter has concluded data processing agreements with its sub-processors for this purpose.

https://cello.so/privacy-policy/ · https://firstpromoter.com/gdpr

7. Embedded videos: YouTube

On some pages we embed videos from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) in privacy-enhanced mode. When a video is loaded or played, data such as your IP address and information about your device are transmitted to Google. The legal basis is our legitimate interest in an appealing presentation of our content (Art. 6 (1) (f) GDPR). Google LLC is certified under the EU-US Data Privacy Framework.

https://policies.google.com/privacy

8. Product demos and webinars: Livestorm

For product demos and webinars we use Livestorm of Livestorm SAS, 16 rue Cuvier, 69006 Lyon, France. If you register for a demo or a webinar, Livestorm processes your details (e.g. name, email address, company) and your participation data on our behalf (Art. 6 (1) (b) GDPR). The data is stored in the EU (AWS, Ireland).

https://livestorm.co/privacy-policy

9. Sentry

We use the service Sentry (Sentry, 132 Hawthorne St, San Francisco, CA 94107, USA) in order to improve the technical stability of our services by monitoring system stability and identifying code errors. Sentry serves these aims alone and does not evaluate any data for advertising purposes. For further information we refer you to Sentry’s privacy policy:

https://getsentry.com/privacy/

I. Communication

  1. If you send us email messages or other communications, or enter them directly on the website/the Commitly platform, we as the provider retain such communications in order to process your enquiry, to answer questions and to improve the website, products, functions/services and services.
  2. Communication within the Commitly platform takes place exclusively via an encrypted internet connection, with storage on internet-connected servers. In addition, in the course of communication, emails and, where applicable, push messages are sent directly to the device.

J. Your rights as a user

  1. You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing (Art. 21 GDPR). You can withdraw any consent you have given at any time with effect for the future. To do so, please contact support@commitly.com. If you believe that the processing of your data infringes data protection law, you can lodge a complaint with the supervisory authority; in Austria this is the Datenschutzbehörde (Austrian Data Protection Authority), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.
  2. You have the right at any time to enquire free of charge about the data collected about you. You have the right at any time to withdraw your consent to the use of your personal data with effect for the future. For information and for withdrawal, please contact Commitly at support@commitly.com. We will then provide the information without delay.
  3. If you so wish, we will on your request delete the data stored with us in full in accordance with your instructions. This may, however, mean that you can no longer use the website and, where applicable, services and/or functions within the Commitly platform. In that case you have an extraordinary right of termination for existing contractual relationships, without this giving rise to any claims for compensation against Commitly.
  4. Where statutory retention obligations exist, and for their duration, and within the framework of data backup, we are, however, entitled to continue storing data that has otherwise been instructed to be deleted, including backups and logs, and to use and process data in so far as this is necessary to comply with the statutory obligation.

K. Data security

  1. The storage and processing of data collected in the course of services or in any other way is carried out on servers on behalf of Commitly. Within the framework of commissioned data processing, Commitly ensures compliance with the data protection provisions and with the content of the privacy policy through appropriate technical, organisational and contractual measures.
  2. Commitly takes the necessary security measures in order to protect data against unauthorised access and to prevent the unauthorised alteration, disclosure or destruction of data. This includes internal reviews of data collection and of data storage and data processing practices and security measures, as well as of the physical security measures for protection against unauthorised entry to the systems on which personal data is stored.

L. Contact

For information or statements regarding the use of your data, please contact:

Commitly GmbH

Dr. Clemens Pirquet-Strasse 43 2380 Perchtoldsdorf

Email: support@commitly.com

(Status: 19.10.2026)

COMMITLY privacy policy

20261019_Data privacy (German version)