Legal information

Privacy policy of Commitly GmbH

Personality rights in connection with data protection are important to COMMITLY. We therefore attach great value to the confidentiality of your personal information. We have drawn up these guidelines in order to explain what information we collect, how we use it and what choices you have.

Please take enough time to familiarise yourself with our practices for protecting personality rights and contact us as soon as you have any questions.

A. Definitions

  1. “We” or “Commitly” is Commitly GmbH, FN 476463 g, commercial register court Wiener Neustadt, with its registered office at Dr. Clemens Pirquet-Strasse 43, 2380 Perchtoldsdorf, (“Commitly”).
  2. “You” or “user” is a natural person who creates a user account with Commitly for the use of the Commitly platform as a consumer and/or submits a corresponding enquiry to Commitly.
  3. The “Commitly website” is the website created by Commitly and used for marketing purposes.
  4. The “Commitly platform” is a software application created and offered by Commitly. You can use the Commitly platform by calling up the corresponding web page (web application).
  5. “Data protection provisions” are these provisions, which give you information on what data is collected from you by Commitly and how it is processed. When a user account is created, the data protection provisions are made known to you. We reserve the right to adapt the above privacy policy at any time in observance of the current legal requirements. An update will be made known to you by email to your registered email address. This notice will also inform you of your right of objection (which you can exercise directly by deleting your account) and of the consequences of the objection. If the updated data protection provisions are the reason why you no longer wish to use Commitly, you can delete your user account at any time up to the moment the update comes into force. This ends the usage relationship with Commitly.
  6. “Personal data” is the data of a person that identifies them personally, such as their name, their email address or their telephone number, or other non-public data in this connection.
  7. “Service providers” are providers of software-related or remote-communication-based services as well as companies used by Commitly to process payments or to render technical services.
  8. “Anonymous data” is data that is not connected to personal data. Anonymous data no longer makes it possible to identify an individual person.

B. General

  1. Commitly GmbH, FN 476463 g, commercial register court Wiener Neustadt, Dr. Clemens Pirquet-Strasse 43, 2380 Perchtoldsdorf, (“Commitly”) offers you the possibility of enabling data on incoming and outgoing payments from bank and credit card accounts as well as other payment services for viewing and of analysing and evaluating it according to certain criteria, as well as of being informed about movements in your accounts by a notification function.
  2. Commitly collects, uses and processes your personal data exclusively within the framework of the provisions of Austrian data protection law. In the following we inform you about the nature, scope and purposes of the collection and use of personal data. You can call up this information at any time on our website Commitly.com.

C. Data protection principles

  1. We undertake to handle all of your personal data that is passed on to us in accordance with the applicable Austrian data protection laws. That means in particular that we do not pass it on to third parties. We also undertake to collect, record, store, alter, block or delete the personal data protected by the Federal Data Protection Act only for the purpose of the lawful performance of our tasks. The data is not used for purposes other than the lawful performance of our tasks.
  2. Our technical infrastructure reliably protects against unauthorised third parties being able to view and alter the data stored with us (data security and integrity). Through the choice of the location of our data centre, we ensure that European law is complied with by our service providers.
  3. The data we collect is either provided by you when you use the Commitly platform or make use of functions and services, or it arises within the course of that use. In order for the Commitly platform to be usable as intended, user data is always necessary.
  4. The data created by you in the course of using the Commitly platform and of services and/or functions within the Commitly platform, in particular via the login (in so far as you select this) and via the application, is stored on dedicated servers in the highly secure data centre of Amazon Web Services (AWS) in Frankfurt, but is not used or otherwise processed by the server service provider.

D. Data provided by you

  1. When you register, for example by signing up and subsequently logging in, you leave basic data (including the information on how you found us on the internet) which is transmitted to us. This data is prescribed by the registration form and is collected, stored and used exclusively for the use of the Commitly platform and its services. Using this registration data, we may inform you about changes, additions or new versions of the Commitly platform and about information made available via the website as well as, for example, about news on the website/the application.
  2. Registration for a newsletter can take place either via a login or by signing up with an email address. In the case of the email address, no further information is necessary. You are, however, free to provide further information of your own accord when signing up for the newsletter. By signing up for the newsletter, you as the person signing up expressly agree that the confirmation of registration and then the newsletter will be sent to the email address provided.
  3. In the context of the newsletter subscription and in the context of registration, we are also entitled to inform you about changes, additions or new versions of the website or of the Commitly app and of the functions offered through it, and about information made available via the website as well as, for example, about news regarding the available banks.
  4. In the context of and in order to enable the use of the Commitly platform or the provision of the functions named in the usage agreement, Commitly records various kinds of data, some of which is provided by you and some of which is necessary for the use of the Commitly platform and for the associated provision of services, or arises through that use.

E. Use of the Commitly platform or services

COMMITLY uses analytics services so that we can better understand how you use our website and our applications. In doing so, you help us to develop the COMMITLY experience further and to improve our communication with you step by step.

  1. In order to improve the quality and the security of our service, we store for statistical purposes the data on each individual access to the pages of the Commitly platform that your browser/the application transmits whenever you visit the website/use the app. These server logs contain data such as your web request/usage call, your IP address, browser type, browser language, the date and time of your request and one or more cookies by which your browser can be uniquely identified, as well as general information for example when errors occur and the information from security events (change of password, password recovery, change of email address), since this is necessary for use. The IP address is stored in shortened form in compliance with data protection law.
  2. When you visit our website and in the course of the provision of services, the website sends one or more cookies – small files containing a string of characters – to your computer or your other device, by means of which the browser is uniquely identified. We use cookies to improve the quality of the website, including to store usage preferences and to track user trends as well as to measure how you found our website and our services on the internet. When you visit the website or subpages, we may place one or more cookies in the browser. You can set your browser so that it notifies you when a cookie is sent. That gives you the possibility of either accepting or rejecting a cookie. The data we record and analyse is used to improve services and the website, to make the web experience personal and to enable easy logging in where log-in cookies have been set permanently.
  3. We make use of the services of third-party providers in order to assess the effectiveness of the Commitly platform and of the services and to determine how you use the Commitly platform and/or the services. For this purpose we may use counting pixels (web beacons) on the pages of the Commitly platform, which the third-party providers make available to Commitly for this purpose. The information we record includes the pages visited, navigation patterns and similar data. This statistically collected data enables us to find out which services within the Commitly platform are of most interest to users and which offers users most like to look at. Although the provider logs the data originating from our website on our behalf, we have control over how this data may or may not be used. The cookie itself does not contain any personal data, but if you provide personal data (such as your user ID) when visiting the website and do not delete the cookie from your browser after providing this data, the provider records the non-personal data stored in the cookie (such as the number of visits) and stores it anonymously.

F. Our services

Registration – user account (“account”)

  1. In order to be able to use our services, you must first register with us on the platform. To do so you must open an account and enter your email address and a password. You complete the registration by entering your personal data, such as surname and first name. We store this data for the duration of the platform contract, assigned to your account.
  2. In order to make the best possible use of the services offered by Commitly, you can at any time supplement your profile information on the platform with further personal details in the electronic forms provided in your account. This data is likewise stored by us for the duration of the platform contract.

Registration for the retrieval of account data (“bank connection”)

  1. To enable one or more bank, credit card and/or payment service accounts of your company on the platform, we collect and process the following further personal data: account number and bank sort code or IBAN and BIC, usage identifier / login and PIN or password (“access data”).
  2. At no time does Commitly store the access data you enter for the purpose of connecting the account.
  3. You can of course remove the connected bank, credit card and/or payment service accounts again at any time.

Provision and use of your account data (“synchronisation”)

  1. In the course of synchronisation, data on account balances and on incoming and outgoing payments of your company (“transactions”) from the bank, credit card and/or payment service accounts you have enabled on the platform is transmitted to us by the respective account-holding institutions.
  2. These transactions
  • we store for the term of the platform contract existing with you,
  • we use and process in order to present them to you for your information in overviews as part of the planning – including by carrying out analyses and evaluations – in your password-protected user area on the platform,
  • we use and process in order to keep you up to date by notifications about movements in your enabled accounts.

Use of the COMMITLY “Account” and the “COMMITLY Card”

  1. When using the COMMITLY Account, account opening and payment processing take place via our partner Swan SAS.
  2. The data protection provisions and regulatory requirements of our payment service provider additionally apply to these services.
  3. The processing of personal data serves, among other things, identity verification, account opening, transaction processing and fraud prevention.

G. Commissioned data processing

COMMITLY uses third-party providers in order to be able to make the services of the COMMITLY platform available to you. You will find more detailed information in our data processing agreement pursuant to Art. 28 GDPR, which is concluded between the Commitly customer (controller or principal) and Commitly GmbH (processor or contractor).

BANKSapi Technology GmbH (account information service)

To connect bank accounts and to provide account information services, we use BANKSapi Technology GmbH, Maximilianstraße 13, 80539 München. BANKSapi is a provider of account information services regulated under § 34 of the German Banking Act (KWG) within the meaning of the PSD2 directive. BANKSapi processes personal data exclusively on the instructions of Commitly and is subject to German data protection law. A corresponding data processing agreement pursuant to Art. 28 GDPR has been concluded.

https://www.banksapi.de/datenschutz/

finAPI GmbH (account information service)

The transaction data within the account information service is provided by the external interface provider finAPI GmbH (“finAPI”), Ainmillerstraße 11, 80801 München, which processes the data under supervision and exclusively on the instructions of Commitly. As a German company, finAPI is bound by German data protection law. The access data for accounts & cards is additionally stored in encrypted form at finAPI. Commitly has no access to this access data. A corresponding contract on the processing of personal data on behalf of the controller has been concluded between finAPI and Commitly.

https://www.finapi.io/

Monite GmbH (invoice & expense management)

To integrate functions for invoicing, expense management and receipt capture, we use Monite GmbH, Dircksenstraße 3, 10179 Berlin. Monite provides a platform via an API with which certain financial processes can be automated. The processing of personal data takes place exclusively on behalf of Commitly and is subject to the GDPR.

https://monite.com/data-privacy/

Swan SAS (embedded finance / payment infrastructure)

For the technical provision of business accounts and for carrying out SEPA payments we use Swan SAS, 95 Avenue du Président Wilson, 93100 Montreuil, Frankreich, registration number 86245. Swan is an electronic money institution regulated under French law and is fully subject to the General Data Protection Regulation. The processing takes place exclusively on the basis of a data processing agreement pursuant to Art. 28 GDPR.

https://www.swan.io/privacy-policy

Chargebee (subscription administration)

Parts of your personal data (the name of your company, first name and surname) serve to identify you and your company and to check the payment methods offered. As part of the registration, your first name and surname are passed on to the service provider ChargeBee (Chargebee Inc., 340 S Lemon Avenue, #1537, Walnut, California 91789, USA). In addition, your payment data such as credit card and bank details (depending on the payment method you have selected) is collected, used and processed for the purpose of payment processing and passed on to payment service providers and to the credit card company or bank you have specified, and used and further processed by them. At no time does Commitly store credit card data in connection with a transaction.

https://www.chargebee.com/

Braintree Payment (payment processing)

Commitly uses Braintreee Payments (“Braintree”) as a payment gateway. Braintree is a service of PayPal (Europe) S.à r.l. et Cie, S.C.A.. Braintree is used exclusively to process the payments between Commitly and its users. For this purpose the credit card data recorded in Chargebee is transmitted to Braintree for further processing.

https://www.braintreepayments.com/at/legal

GoCardless Ltd. (direct debit & payment administration)

GoCardless Ltd., 65 Portland Place, London W1B 1NB, Vereinigtes Königreich.

We use GoCardless to process SEPA direct debits and payment mandates within the COMMITLY platform. In doing so, personal data (e.g. name, IBAN, mandate reference) is transmitted to GoCardless on behalf of COMMITLY and processed there. GoCardless hosts data in the EU (data centre Dublin, Ireland) and uses EU standard contractual clauses to safeguard data transfers to third countries. The processing takes place exclusively on the basis of our instructions and in accordance with Art. 28 GDPR. Further information:

https://gocardless.com/privacy/

Intercom (customer experience)

We make use of third-party services in order to understand the use of Commitly better. In particular we transmit some of your information (such as your email address and the date of your registration) to Intercom, Inc. (“Intercom”) and use Intercom when you visit our website or use our product in order to collect data for analytical purposes. Intercom analyses your use of our website and/or our product and tracks the development of our customer relationship so that we can improve our service for you. We also use Intercom as a medium for communication, either by email or in the form of messages within our product/our products. In addition we use Intercom to make a help section available to you.

https://intercom.io/

Mailchimp (newsletter management)

When sending our newsletter to registered prospective customers and when sending transactional emails to users, we make use of Mailchimp (a brand of The Rocket Science Group, LLCm, Georgia, USA) within the framework of commissioned data processing. Mailchimp was carefully selected by us as a specialised service provider and is checked by us regularly in order to ensure that your privacy is preserved. Mailchimp processes your personal data only on behalf of and on the instructions of us and may use your personal data exclusively for the purposes we specify. Compliance with these data protection provisions and with the necessary security measures is guaranteed at all times.

https://mailchimp.com

Pipedrive Ireland Limited (CRM management)

Pipedrive Ireland Limited, 4th Floor, 7–8 Wilton Terrace, Dublin 2, Irland.

Pipedrive provides us with a CRM platform with which we administer customer data and map sales processes. In doing so, personal data (e.g. name, email, contact history) is transmitted to Pipedrive and processed there on behalf of COMMITLY. Pipedrive uses standard contractual clauses to safeguard EU data transfers. You will find further information in the Pipedrive privacy policy:

https://www.pipedrive.com/en/privacy

GetStream.io (in-app messaging & activity feeds)

GetStream.io Inc., 548 Market St PMB 62437, San Francisco, CA 94104, USA.

We use GetStream.io to handle in-app messages and activity feeds in the Commitly platform. In doing so, personal data (e.g. user IDs, message content, timestamps) is transmitted to GetStream.io on behalf of COMMITLY and processed there. GetStream.io hosts data in the EU (data centre Dublin, Ireland) and uses EU standard contractual clauses to safeguard data transfers to third countries. The processing takes place exclusively on the basis of our instructions and in accordance with Art. 28 GDPR. You will find further information at:

https://getstream.io/legal/privacy/

Flatfile, Inc. (data import & preparation)

Flatfile, Inc., 1550 Wewatta Street / Suite 200, Denver, CO, USA

We use Flatfile for the secure capture, validation, normalisation and preparation of imports of customers’ ERP data (e.g. CSV/Excel imports, field mappings and validation rules). In the course of these services, personal data (e.g. names, email addresses, company data, account information and transaction data contained in uploaded files) may under certain circumstances be processed by Flatfile in exceptional cases. Flatfile processes this data exclusively on our instructions and acts as a processor within the meaning of Art. 28 GDPR. Flatfile operates its services on Amazon Web Services (AWS) and offers customer-side options for regional hosting configurations (including EU regions); the specific hosting region follows from the configuration agreed between Commitly and Flatfile. You will find further details on data protection, security measures and data processing at Flatfile here: https://flatfile.com/privacy/

H. Use of tracking tools

  1. In order to make visiting the Commitly website and the Commitly platform attractive and to make the use of certain functions more user-friendly, more effective and more secure, we use what are known as cookies on various pages. These are small text files that are stored on your device, assigned to the browser you use, and by means of which certain information flows to the entity that sets the cookie (in this case, therefore, to us). Cookies cannot execute programs or transfer viruses to your device.
  2. Most of the cookies we use are what are known as “session cookies”. They are automatically deleted after the end of your visit to our website. In addition we use cookies that remain stored on your device after the end of your visit to our website until you delete them. These cookies enable us to recognise your browser on your next visit.
  3. You can also set your browser so that you are informed about the setting of cookies and allow cookies only in individual cases, exclude the acceptance of cookies for certain cases or in general, and activate the automatic deletion of cookies when the browser is closed. If cookies are deactivated, however, the functionality of our website may be limited.

Google Analytics

  1. Our website uses Google Analytics, a web analytics service of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”).
  2. The information generated by the cookie about your use of our website is generally transferred to a Google server in the USA and stored there. Since this website uses Google Analytics with the extension “_anonymizeIp()”, your IP address is, however, first shortened by Google within the member states of the European Union or in other states party to the Agreement on the European Economic Area, so that a direct link to a person can be ruled out. Only in exceptional cases is the full IP address transferred to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information in order to evaluate your use of the website, to compile reports on website activity and to render further services to the website operator connected with the use of the website and of the internet.
  3. The IP address transmitted by your browser within the framework of Google Analytics is not merged with other data held by Google.
  4. You can prevent the storage of the cookies by setting your browser software accordingly; we point out, however, that in this case you may not be able to use all the functions of this website to their full extent. You can also prevent the recording of the data generated by the cookie and relating to your use of the website (including your IP address) by Google, and the processing of this data by Google, by downloading and installing the browser plug-in available at the following link: http://tools.google.com/dlpage/gaoptout?hl=de.3
  5. Google Analytics is used in accordance with the conditions agreed between the German data protection authorities and Google. Information from the third-party provider: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, fax: +353 (1) 436 1001.

Google’s terms of use:

http://www.google.com/analytics/terms/de.html

Overview of data protection at Google:

http://www.google.com/intl/de/analytics/learn/privacy.html

Google’s privacy policy:

http://www.google.de/intl/de/policies/privacy.

Use of Google Remarketing

  1. Our website uses the remarketing function of Google Inc.. This function serves to present visitors to the website with interest-based advertisements within the Google advertising network.
  2. The browser of the website visitor stores cookies, that is, text files that are stored on your computer and that make it possible to recognise the visitor when he calls up websites belonging to Google’s advertising network. On these pages the visitor can then be presented with advertisements relating to content that the visitor has previously called up on websites that use Google’s remarketing function. According to its own statements, Google does not collect any personal data in this process.
  3. If you nevertheless do not want Google’s remarketing function, you can in principle deactivate it by making the corresponding settings at

http://www.google.com/settings/ads.

Alternatively you can deactivate the use of cookies for interest-based advertising via the Network Advertising Initiative by following the instructions at

http://www.networkadvertising.org/managing/opt_out.asp.

You can view further information on Google Remarketing and Google’s privacy policy at:

http://www.google.com/privacy/ads/

  1. As an AdWords customer we also use Google conversion tracking, an analytics service of Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; “Google”). In this, Google AdWords sets a cookie on your computer (“conversion cookie”) if you reached our website via a Google advertisement. These cookies lose their validity after 30 days and do not serve to identify you personally. If the user visits certain pages of this website and the cookie has not yet expired, we and Google can recognise that the user clicked on the advertisement and was forwarded to this page. Every Google AdWords customer receives a different cookie. Cookies can therefore not be tracked across the websites of AdWords customers. The information obtained with the help of the conversion cookie serves to compile conversion statistics for AdWords customers who have opted for conversion tracking. The customers learn the total number of users who clicked on their advertisement and were forwarded to a page carrying a conversion tracking tag. They do not, however, receive any information with which users can be personally identified.
  2. If you do not wish to take part in the tracking procedure, you can also refuse the setting of a cookie required for this – for example by a browser setting that generally deactivates the automatic setting of cookies. We point out, however, that in this case you may not be able to use all the functions of this website to their full extent. You can also deactivate cookies for conversion tracking by setting your browser so that cookies from the domain “googleadservices.com” are blocked. You can find out more about Google’s data protection provisions at

http://www.google.de/policies/privacy/

Sentry

We use the service Sentry (Sentry, 132 Hawthorne St, San Francisco, CA 94107, USA) in order to improve the technical stability of our services by monitoring system stability and identifying code errors. Sentry serves these aims alone and does not evaluate any data for advertising purposes. For further information we refer you to Sentry’s privacy policy:

https://getsentry.com/privacy/

J. Communication

  1. If you send us email messages or other communications, or enter them directly on the website/the Commitly platform, we as the provider retain such communications in order to process your enquiry, to answer questions and to improve the website, products, functions/services and services.
  2. Communication within the Commitly platform takes place exclusively via an encrypted internet connection, with storage on internet-connected servers. In addition, in the course of communication, emails and, where applicable, push messages are sent directly to the device.

K. Your rights as a user

  1. You have the right at any time to enquire free of charge about the data collected about you. You have the right at any time to withdraw your consent to the use of your personal data with effect for the future. For information and for withdrawal, please contact Commitly at support@commitly.com. We will then provide the information without delay.
  2. If you so wish, we will on your request delete the data stored with us in full in accordance with your instructions. This may, however, mean that you can no longer use the website and, where applicable, services and/or functions within the Commitly platform. In that case you have an extraordinary right of termination for existing contractual relationships, without this giving rise to any claims for compensation against Commitly.
  3. Where statutory retention obligations exist, and for their duration, and within the framework of data backup, we are, however, entitled to continue storing data that has otherwise been instructed to be deleted, including backups and logs, and to use and process data in so far as this is necessary to comply with the statutory obligation.

L. Data security

  1. The storage and processing of data collected in the course of services or in any other way is carried out on servers on behalf of Commitly. Within the framework of commissioned data processing, Commitly ensures compliance with the data protection provisions and with the content of the privacy policy through appropriate technical, organisational and contractual measures.
  2. Commitly takes the necessary security measures in order to protect data against unauthorised access and to prevent the unauthorised alteration, disclosure or destruction of data. This includes internal reviews of data collection and of data storage and data processing practices and security measures, as well as of the physical security measures for protection against unauthorised entry to the systems on which personal data is stored.

M. Contact

For information or statements regarding the use of your data, please contact:

Commitly GmbH

Dr. Clemens Pirquet-Strasse 43 2380 Perchtoldsdorf

Email: support@commitly.com

(Status: 07.09.2025)

COMMITLY privacy policy

20250907_Data privacy