EPV│ABLE – Privacy Notice for the Application

Version: EPV-ABLE-APP-PRIVACY-2026-10-08-V0.5-IG
Date: 8 October 2026

1 Controller and contact

EPV Managing UG (haftungsbeschränkt) i.G., Rosental 5, 80331 Munich, Germany. Managing Director: Fernando Santoro.

The provider identified there is the controller for the processing activities carried out for its own purposes and described below. You can contact us at hello@epv-group.com, or at privacy@epv-group.com for privacy matters. We use “EPV” below. The product name EPV│ABLE and the EPV│GROUP umbrella brand do not establish an additional controller.

Where EPV processes personal data exclusively under a business customer's documented instructions, that customer is the controller and EPV is a processor. The customer's notices and the agreed data processing agreement additionally apply to that customer data. EPV supports the customer with privacy matters; the general privacy contact address is not a statement that a data protection officer has been appointed.

2 Scope

This notice concerns the application at app.epv-able.de, including sign-in, business access, Self-Audit, Financial Health Check and separately commissioned EPV Verified reviews. It is distinct from the notice concerning visits to the information website epv-able.de.

The individual review services do not create an EPV│ABLE subscription. Buying a product is neither blanket consent to data processing nor approval of all EPV systems. Functions that are unavailable or expressly designated as tests do not constitute production processing of customer data. This notice does not itself activate sign-in, payments, data imports or integrations.

Applicant data, active sourcing, special categories of personal data, criminal offence data and identifiable individual guest data are not part of the regular review assignment described here. Please provide only necessary data and remove unnecessary personal information before uploading.

3 Data categories and sources

We process the following to the extent necessary in each case:

• Identity and contact data: the user identifier, email address and, where available, profile name supplied by the sign-in service, company and property details, and designated contacts.
• Authorisation and contractual records: user roles, company/property assignments, acceptance of the terms version, acknowledgement of the privacy notice version, business customer confirmation and timestamps.
• Review data: answers, related evidence, structured operational and financial figures, documents, source and version information, findings, comments, actions, reports and human approvals.
• Technical data: IP address, request timestamp, requested resource, browser/device information, session and security events, filename, file type, size, checksum and scan status.
• Business communications and, where payment processing is actually used, order, invoice, payment status and transaction references.

We receive data directly from you, from the sign-in service, from your employer or the commissioning company, or from its authorised users. Information about other persons named in documents comes from the documents supplied by the customer. An authorised import from GEN│RAL is a separate source under section 9; this does not involve public profiling or purchasing addresses.

Where EPV carries out processing for its own purposes using data not collected directly from the individual, we provide information on the specific categories, sources and purposes under Article 14 GDPR, generally no later than one month and, where applicable, earlier upon the first communication or disclosure. Statutory exceptions are used only where their actual requirements are met. For processing on behalf of a customer, this information obligation rests with the customer as controller; EPV assists it.

4 Purposes and legal bases

For entering into and performing a contract with a natural person, we process necessary data under Article 6(1)(b) GDPR. This concerns, in particular, the agreed review, setting up access and business administration. If you act as an employee or company contact, contact management, user organisation and contract coordination are based on Article 6(1)(f) GDPR. The legitimate interest is the proper performance of the business relationship with the company.

Article 6(1)(f) GDPR applies to secure operation, role and tenant separation, prevention of misuse, troubleshooting and traceable approvals. Our legitimate interests are the confidentiality, integrity and availability of the application and the protection of customers and their data. For specific legal claims, the same legal basis may support preservation of evidence limited to the subject of the dispute.

We process invoice, tax and retention data required by law under Article 6(1)(c) GDPR in conjunction with the applicable commercial and tax provisions. Consent under Article 6(1)(a) GDPR is used only for an expressly specified, genuinely optional activity. A general confirmation that a privacy notice has been read does not replace a legal basis and is not such consent.

For content we process on behalf of the customer, the customer determines the permitted purposes and its legal basis. Article 28 GDPR governs processing on behalf of the customer and does not replace the customer's legal basis. The professional label “Verified” does not automatically determine the data protection role. Where a specifically commissioned professional review involves EPV's own purposes or essential means, that different allocation of controllership is communicated to the customer and affected individuals before the relevant processing. Joint controllership is not assumed merely because the parties cooperate.

5 Sign-in, user roles and security

Customers sign in with their email address and a one-time eight-digit code; no ChatGPT account is required. EPV processes the email address, a derived or previously assigned user identifier and technical security records. The code is valid for ten minutes and can be used once. Sign-in alone does not create a customer role, purchase or authorisation to process review data. EPV subsequently assigns the verified access only to the authorised customer and that customer’s company, property and role.

The existing internal EPV Owner access continues to use “Sign in with ChatGPT”. The platform handles that sign-in and sign-out; EPV receives the user identifier, email address and, where supplied, profile name, but not the ChatGPT password. This internal sign-in is not a requirement for customers. The Sites documentation describes the internal process.

For the customer sign-in expressly requested by you, the application uses the cookie __Host-able_customer on app.epv-able.de. It is HttpOnly, Secure and SameSite=Lax and expires no later than eight hours after issue. It contains only a random session value. The server stores its hash; active customer roles and company scope are checked on every request. Sign-out revokes the session on the server. Sign-in codes are stored only as purpose-bound HMAC hashes. Expired challenges and sessions, and revoked sessions, are removed on the next sign-in-code request; a new request supersedes earlier unused codes for the same email address. These are the functional validity periods of this sign-in, not blanket retention periods for other data.

EPV uses the existing Resend service to deliver the customer code. The recipient email address, code, selected language text and a technical delivery identifier are transmitted; no review documents, financial data or findings. Acceptance by the delivery service does not itself prove receipt in the mailbox. Other support and system transfers remain separate processing activities. The existing statements in this notice concerning actual provider contracts, processing locations, subprocessors and any required transfer grounds also apply to the delivery service; using an API key does not confirm new facts.

Administrative EPV Owner functions have an additional passkey check. For this purpose, EPV stores public keys, device/credential identifiers, registration and usage timestamps, and security records. Private passkey keys and biometric features used for local unlocking are not transmitted to EPV through this process. This additional Owner function is not a general customer login using a one-time email code.

Permissions are limited to the relevant company and review. Changes, professional approvals and security-related events are documented with the necessary user, time and object references. A log entry does not authorise reuse of all content for other purposes.

6 Browser data and local financial pre-check

The current FHC pre-check reads a user-selected file locally in the open browser window and checks the mapping of monthly figures. The file, preview and mapping remain in that window's working memory before the separate upload. The payment process opens in a different tab. If the original window is closed or reloaded, the file may need to be selected again. Selecting and pre-checking a file alone does not upload its content to EPV. Account, connection and expressly initiated order data are processed separately.

Language and currency display settings are passed through URL parameters. The storage description for the Group information website, particularly its language cookie, does not automatically apply to the application.

For the additional Owner device confirmation, the application uses the cookie __Host-epvable_owner_device on app.epv-able.de, with a lifetime of seven days from issue. It serves only the security check and is HttpOnly, Secure and SameSite=Strict. Renewed confirmation for specially protected Owner actions is valid for fifteen minutes; a passkey challenge expires after five minutes. These are functional validity periods, not blanket erasure periods for all security logs.

The sign-in service and hosting platform may use their own necessary session and security mechanisms. Their lifetimes must not be equated with the EPV Owner cookie. Storage or access on your device without consent takes place only insofar as necessary for transmission or an expressly requested function under section 25(2) TDDDG. Additional, non-essential device storage requires a valid choice. Further processing of personal data also requires its GDPR legal basis.

7 Review content, uploads and human review

The Self-Audit processes your answers and necessary evidence for a defined property and result. The Financial Health Check processes the confirmed monthly periods, selected mapping and associated source set. Before the financial file is actually uploaded after the local preliminary step, the application checks the corresponding confirmed payment entitlement.

Uploaded files are assigned to the relevant review subject. For the technical security check, necessary file content and metadata are transmitted to the integrated Microsoft Azure scanner. Only an unambiguous clean scan response permits further use; inconclusive results remain in quarantine, and detected malware is rejected for use. Malware scanning is not a professional assessment of the document's content.

Analyses and automated preliminary checks may generate indications, contradictions, risk priorities and drafts. The Self-Audit is not an independent EPV confirmation. A customer result issued as EPV Verified requires human professional review and release by EPV. The processes described here do not make solely automated decisions about individuals with legal or similarly significant effects within the meaning of Article 22 GDPR.

EPV does not use personal or confidential review content for general AI training, advertising, public references or other clients' engagements merely because a booking has been made. Use of a hosting and sign-in platform is not equivalent to authorising transmission of all review documents to a generative AI model.

8 Recipients and technical service providers

Access is granted to customer users authorised for your review subject and the EPV employees or reviewers actually responsible for it. Administrative and support access must be limited to its necessary purpose. Service providers receive only the data necessary for their function; the required agreements apply where they process data on behalf of another party.

The application is provided through OpenAI Sites. The technical hosting chain uses Cloudflare services for application operation, structured data and file storage. This infrastructure processes connection and operational data and the application data stored there. The OpenAI/ChatGPT account and its sign-in are additionally subject to the sign-in service's own controllership for its account purposes. A contractual relationship with EPV does not remove those independent purposes.

According to its product description, Sites automatically records access counts for platform statistics. The absence of an additional analytics tool integrated by EPV therefore does not mean that the hosting platform processes no traffic data. This notice does not authorise additional advertising profiling. Information about Sites

Microsoft Azure is integrated for technical file scanning. The region documented for the scan, Germany West Central, is not an assurance that all hosting, support, logging and backup activities of all participating services take place exclusively there.

Communications sent to the published EPV email addresses are handled through the IONOS mail infrastructure used for that purpose. This involves processing sender, recipient, message content, attachments and delivery information. Please do not send unnecessary raw review data by email; use the designated protected data channel instead.

9 Separate transfers and excluded destinations

An import from GEN│RAL concerns only the selected, version-specific data package, the stated review purpose and the expressly confirmed assignment. Returning released findings or actions to GEN│RAL is a separate activity requiring package-specific authorisation. Technical confirmation does not automatically replace the required data protection basis.

This version does not permit transfer of personal review content to EPV│Nexus, EPV│Intelligence or Notion. User identifiers, hashes and references are not automatically anonymous if they can still be linked to individuals. A separate data flow requires its own transparent description of purpose, roles and legal bases. Booking alone does not create automatic EPV-wide use of data.

10 Payments through Stripe

This section applies only to an actually provided payment process initiated by the customer. A prepared checkout or one labelled Sandbox/Test is not real payment processing and does not require real payment data.

A real Stripe checkout involves processing the necessary contact, order, invoice and payment details. EPV transmits, in particular, the email address, product/price and review references, necessary assignment identifiers, and the version and timestamp of the contractual/privacy confirmation. The checkout collects the information required for the chosen payment method and billing. EPV receives, in particular, payment status and transaction references. Full card details must not be entered in EPV free-text fields, review documents or uploads.

EPV processes necessary billing data on the contractual, business-relationship and statutory bases described in section 4. Stripe processes certain payment data as a service provider and may itself be a controller for its own statutory, security and fraud-prevention purposes. Its specific role depends on the service used. Stripe's privacy notice describes these own processing activities, recipients, international transfers and rights. This notice does not make Stripe the seller of the EPV review service and does not activate any payment.

11 Processing outside the European Economic Area

The involvement of international platform and payment providers may include processing outside the European Economic Area, particularly in the United States. A European domain, an EU contracting entity or a single German scanning region is not an assurance of exclusively European processing.

Any necessary transfer to a third country must have a permissible basis for the respective contract and data flow, such as an adequacy decision applicable to the particular case or appropriate safeguards under Article 46 GDPR, particularly EU Standard Contractual Clauses and necessary supplementary measures. A provider name or this general description does not replace that basis. Information on the recipients, locations and safeguards applicable to the respective processing activity, and a copy of the relevant safeguards, is available from privacy@epv-group.com, with redactions where necessary to protect third parties.

12 Retention, return and erasure

We retain operational review data and uploaded documents during the necessary commissioned work, including specifically required revisions. After the actual end of the review service or processing and the proper completion/retrieval notice, a follow-up period of 30 full calendar days (Europe/Berlin) generally applies for secure return and retrieval. The period does not start upon creation or upload. After the retrieval window, active working data and copies that are no longer needed are erased through the controlled process. Longer specifically agreed or legally required retrieval/switching obligations remain unaffected; effective earlier erasure requests are handled separately. For processing on instruction, the agreed return/erasure choice and the controller customer's documented instructions govern; the follow-up period applies only to return/retrieval procedures agreed or instructed accordingly. Our own legally necessary records and specifically required legal-defence records are handled separately, for their limited purpose and with restricted access. A customer invoice or an audit report does not thereby automatically become a document requiring long-term retention by EPV. The separate rules for logs, backups and reapplying erasure decisions following restoration remain in force.

Account and authorisation data are processed for the access needed. Once authorisation ends, continued storage must not, by itself, permit further access. Necessary contractual and approval records are handled separately. Return and retrieval of data are governed by the agreed terms, the specific engagement and, where applicable, the data processing agreement; mandatory statutory rights take precedence.

Completed simple contact enquiries are erased after the defined three-month follow-up period, unless a specifically applicable retention obligation or defence of legal claims requires longer storage. For support cases, continued retention depends on whether the information is still needed for troubleshooting, demonstrating contractual performance or handling a specific claim.

Where the relevant statutory requirements apply, commercial and business correspondence is generally retained for six years, accounting records for eight years, and books or annual financial statements for ten years. The type of record, statutory start of the period and any extensions are decisive. A financial file or audit report does not automatically become a document requiring ten years of retention merely because of its content.

Security and change logs are needed only for as long as they serve their specific protection, incident-investigation or evidential purpose. Customer data processed on instruction is subject to the controller customer's documented instructions and erasure rules. No single general period in days is promised for all application and provider logs.

Where a statutory retention obligation or a specific dispute applies, necessary data may be retained separately under a hold. The reason and review date are documented; the data must not be reused for other purposes on that account. Such a legal hold is not equivalent to unlimited storage.

Backups serve recovery after an outage, not ordinary archiving. Propagation of erasure and removal from backups are governed by the backup rotation applicable to the service and the necessary recovery periods. No unverified uniform backup lifetime is claimed for all providers. Following a necessary restoration, existing erasure and restriction instructions must be reapplied. Ending access does not automatically erase all data; payment failure alone does not justify erasure.

13 Required information and choices

Necessary identity, company, authorisation and review information is required to assign access and perform the selected service. Without this information, the relevant access or review assignment may not be available. Financial analyses require the agreed data period and its reliable underlying data.

Optional information and separate transfers remain distinct. Please do not provide unnecessary data about employees, guests or other third parties. If you provide data on behalf of a company, you must be authorised to do so; this does not transfer EPV's own data protection obligations to you.

14 Your rights

Subject to statutory requirements, you may request access, rectification, erasure, restriction of processing and data portability. The right to data portability applies to the data and processing covered by law; it is not a blanket entitlement to all company documents. Where we act as a processor, we support the controller customer in handling the request.

Where processing is based on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. You may object to direct marketing at any time. You may withdraw validly given consent at any time for the future; withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

Please send your request to privacy@epv-group.com. If there are reasonable doubts, we may request necessary additional information to verify identity. A blanket requirement to provide an identity document copy does not apply to every request. Access responses and personal data exports are provided securely to the verified authorised person.

We handle requests without undue delay and generally within one month. We notify you within that initial period of any extension permitted by law and its reasons. You may complain to a data protection supervisory authority, particularly in the place of your habitual residence, workplace or the suspected infringement. For private-sector controllers in Bavaria, the Bavarian State Office for Data Protection Supervision is the competent authority in particular.

15 Updates

This version describes the stated application purposes and defined data flows. A new function or purpose does not become permissible under data protection law merely through a technical update. In the event of material changes, affected individuals are informed of the necessary additional details before the corresponding new processing.