Data processors: services that receive data

Overview

Octibiz runs on your server. Without a configured connection, no record leaves the system. Each of the following services receives data only once you set it up — by storing credentials, connecting an account or switching on the corresponding module. For each service this page lists the purpose, the data, the moment it flows and the provider's agreement.

The legal classification — processing on your behalf under Art. 28 GDPR or processing under the service's own responsibility — is for your data protection officer. This page supplies the technical facts for it, checked against the code.

Google

Agreement: With a Google Workspace or Google Cloud account the Cloud Data Processing Addendum applies. Private Google accounts come without a data processing agreement — use Workspace accounts for business.

Microsoft 365

Agreement: For business accounts the Microsoft Products and Services Data Protection Addendum applies.

lexoffice (Lexware Office)

• Purpose: accounting hand-over — contacts, documents and quotes end up in lexoffice; for purchasing

evaluations, incoming invoices per supplier are read.

• Which data: contacts (company name and VAT ID, or first and last name, email address, role

customer or supplier), documents (date, amounts, tax rates, remark, assigned contact), quotes (title, line items, prices, introduction, remark).

• Active when: an API key for lexoffice is stored. Without a key the documents stay queued for

hand-over; nothing is sent.

• Agreement: Auftragsverarbeitung Lexware Office (German).

Twilio

• Purpose: sending SMS and WhatsApp messages to customers; incoming SMS arrive as a message on the

ticket.

• Which data: the recipient's phone number, message text, sender number; for incoming messages the

sender number and text.

• Active when: the “Twilio” connection is set up with account ID, sender number and access key.

Without access, sending fails visibly instead of silently counting as sent.

• Agreement: Twilio Data Protection Addendum.

finAPI

• Purpose: fetching transactions from the bank account so that payments are matched to open items.

Account access requires a licence in the EU; it runs under finAPI's licence.

• Which data: you enter the bank credentials only in finAPI's form — Octibiz never sees them.

Octibiz receives account name, IBAN, account holder, balance and the transactions (booking date, amount, reference text, name and IBAN of the counterparty).

• Active when: the “finAPI bank connection” module is set up and an account is connected.

Disconnecting also deletes the associated user at finAPI.

• Agreement: the contractual classification is governed by your agreement with finAPI;

finAPI privacy notice (German).

Dealfront

• Purpose: CRM → Prospector searches Dealfront's B2B company database (Echobot) and takes companies

and contact persons over as lead, customer or contact; CRM → Website visitors shows companies that visited your own website (visitor recognition from Leadfeeder).

• Which data goes to Dealfront: only the search criteria (company name or domain, country, city,

postcode, number of employees, industry codes), the identifiers of the companies and contact persons whose data is retrieved, the period of the visitor list and the API key for sign-in. Nothing from Octibiz itself — customers, contacts, documents — is sent. Visitor recognition itself is fed by Dealfront's tracking script on your website, not by Octibiz.

• Which data Octibiz receives: company data (name, address, website, phone, email, VAT ID, size,

industry, last visit) and — only when taking over chosen contact persons — name, position, business email address and phone number.

• Active when: an integration “dealfront” with an API key is set up under Settings → Integrations.

Without a key the CRM shows “not connected”; nothing is sent. Every retrieval is listed in the integration's sync log.

• Legal basis: legitimate interest (Art. 6(1)(f) GDPR) — for visitor recognition with a notice in the

website's privacy policy (text proposal under Website visitors).

• Agreement: Dealfront data processing agreement (EEA);

principles at dealfront.com/gdpr.

AI providers

• Purpose: generating and summarising text, answering questions to the assistant, generating

images and videos and making company knowledge searchable.

• Which data: the request and the excerpt from Octibiz that the respective function passes along —

that is, contents of the records currently being worked on. For knowledge search, text passages from the company knowledge go to a provider with an embedding function (OpenAI or Gemini).

• Active when: a key for the provider is stored (Settings → AI or environment configuration).

Without a key Octibiz sends nothing to that provider.

• Own models: a self-hosted model in your own network is not a third party; it is entered as a

separate endpoint.

Parcel and shipping services

• Purpose: creating shipping labels, return labels on request and — where the service offers it —

querying the shipment status.

• Which data: the recipient's name, company and address, for delivery to a parcel locker or parcel

shop its ID and the customer number, weight and dimensions of the parcels, booked additional services (such as age verification, cash-on-delivery amount), customs data for international shipments. The recipient's email address and phone number go to DHL, DPD, GLS, Hermes, UPS, Sendcloud and shipcloud — for delivery notifications; not to Deutsche Post.

• Active when: the shipping module of the respective service is set up and a label is created.
• Agreement: parcel carriers usually deliver under their own responsibility; shipping platforms such

as Sendcloud and shipcloud work on your behalf. Privacy notices: DHL, Deutsche Post, DPD, Hermes, Sendcloud; GLS, UPS and shipcloud on their websites.

Payment services: Stripe and PayPal

• Purpose: letting customers pay for appointments that carry a price when booking online.
• Which data: Octibiz hands over the amount, currency, the booking reference and the return address.

The person booking enters name, email address and payment details directly on the payment service's page; afterwards Octibiz only receives the confirmation that the payment was made.

• Active when: the credentials for Stripe or PayPal are stored and a booked appointment has a

price.

• Agreement: payment services usually process payment data under their own responsibility;

Stripe Data Processing Agreement, PayPal's privacy notice on its website.

fiskaly (till)

• Purpose: every till receipt is signed by a certified technical security device (TSE), as the

German cash register security regulation (KassenSichV) requires; fiskaly runs it as a cloud service.

• Which data: receipt type and receipt data (amounts per tax rate, payment methods) plus the IDs of

the TSE and the till. Customer names or addresses are not included.

• Active when: the fiskaly cloud TSE is selected for a till and the access key is stored.
• Agreement: conclude a data processing agreement with fiskaly before the till goes live.

Cloudflare Turnstile (online booking)

• Purpose: preventing bookings by bots without making visitors solve picture puzzles.
• Which data: the visitor's browser loads the check from Cloudflare; to verify it, Octibiz sends the

check token and the visitor's IP address to Cloudflare.

• Active when: booking protection is set to “Turnstile” and the keys are stored. The alternative

without a third party is the computing puzzle in the visitor's browser.

• Agreement: Cloudflare Data Processing Addendum.

Error tracking: Sentry or GlitchTip

• Purpose: runtime errors (server errors, aborted background jobs and console commands) end up in

one place and can be evaluated by operations.

• Which data: error type and message, stack trace with files, lines and the source lines around the

point of failure, the requested address without parameters, request method, non-sensitive headers, environment, version, server name, PHP version and operating system, and the list of installed packages. Removed before sending: user context (email, name, username, IP address), request body, cookies, address parameters, headers with credentials, function arguments; every email address in messages is replaced by [entfernt]. No performance measurement, no metrics.

• Errors in the browser: with the same DSN the user interface reports its errors too — staff area,

customer portal and public pages (JavaScript errors, failed pages, rejected promises). What is sent: error type and message, stack trace of the delivered scripts, the page address without parameters, browser and operating system (from the browser identifier), language, version of the installation, the area (staff or portal) and the last steps before the error (page changes, clicks, network calls with status). Sending goes through your own installation (/api/v1/platform/public/error-tracking), which forwards only errors to the configured DSN. Removed before sending, already in the browser: the user object, email addresses and name fields, request and response bodies, headers (except the browser identifier), cookies, parameters and fragments of every address, access tokens in the path (invitations, password links, share links), token and credential values in text, input into form fields, console arguments, properties of interface components. Not captured: session recording (replay), performance measurement, session statistics.

• Active when: SENTRY_DSN is set — then for server and browser. Empty (the default) means error

tracking is off in both places; the browser does not even load the component.

• Target and agreement: either the Sentry cloud with data storage in the EU (Frankfurt) —

Sentry Data Processing Addendum — or a self-hosted GlitchTip on your own server; then no third party is involved.

Further connections

These modules also transfer data once they are set up; the respective provider's agreement applies: mail delivery via your SMTP service (MAILER_DSN) and newsletters via Postmark, Slack, marketplaces and shops (Amazon, eBay, Kaufland, OTTO, Shopify, Shopware, WooCommerce, WordPress), social networks (Meta, LinkedIn, X, YouTube, TikTok) and the imports from HubSpot, awork and Calendly.

• Embeds on web pages: if a page designed with the page builder contains a video (YouTube via the

cookie-free address, Vimeo) or a map (OpenStreetMap), the visitor's browser loads this content from the respective provider — which learns the visitor's IP address in the process.

• Public bodies: checking a VAT ID queries the EU Commission's VIES service and transmits the

checked number and, if stored, your own; exchange rates are loaded from the European Central Bank without personal data. Neither is processing on your behalf.

What your business has to arrange itself

• Conclude agreements before storing credentials. Octibiz does not check this; a stored key is

enough for data to flow.

• Record of processing activities: add the services you set up.
• Transfers to third countries: assess them — several providers are based outside the EU.
• Remove unused connections: delete the credentials or switch off the module; that ends the data

flow.

admin.data-processors · Available from version 0.6.150