The following privacy notice provides an overview regarding the collection and processing of user data. The full information can be found in the Privacy Statement.
The server log data is retained for 7 days.
The access and analysis data are automatically logged during access to our web pages. The form data are collected when you sign up for the Forum.
We use the access and analysis data in providing our products and services and in optimising and protecting our web pages.
Camunda Services GmbH (hereinafter also referred to as "Camunda") is a German provider of services and software in the field of workflow automation. Under the address bpmn.io, Camunda operates a site which hosts the project bpmn.io (hereinafter referred to as "sites").
Via this privacy statement, we wish to explain for users which data are required when using the Camunda web pages, and how we will proceed to use those data if the user browses the Camunda web pages.
We take protection of the personal data of our users very seriously, and we comply with the applicable provisions under data protection law, especially the new General Data Protection Regulation (GDPR) applicable across the EU. We collect, process and use the personal data of our users only if this is essential to run our web page and insofar as the law permits data processing. If you have any questions or comments about this Privacy Statement, please contact us via email@example.com.
I. Name and address of the controller and of its data protection officer
Controller within the meaning of the GDPR, of other data protection laws applicable in the Member States of the European Union and of other provisions having the character of data protection legislation is:
Camunda Services GmbH
Zossener Strasse 55-58
The Data Protection Officer for Camunda is:Julian Höppner
1. Web pages and log files
Personal data: Every time our web page is called up, our system automatically records data and information from the computer system of the computer making contact.
The following data may be collected for this (access data):
The data are similarly stored in the log files for our system. No storage takes place for this data together with other personal data of the user.
Purpose and legal basis: The temporary storage of the IP address by the system is necessary in order to make it possible to deliver the web pages to the user's computer. For this, the user's IP address needs to remain stored for the duration of the session. Storage takes place in log files, in order to guarantee the functionality of the web pages. In addition, the data help us to optimise the web pages and to ensure the security of our IT systems. These purposes also constitute our legitimate interest in data processing pursuant to Art. 6 (1) (f) GDPR. No evaluation of data for marketing purposes takes place in this connection.
Duration of storage and data erasure: The data are erased as soon as they are no longer necessary for achievement of the purpose for which they were collected. In the situation of recording data for provision of the web pages, this is the case if the respective session has ended. In the situation of storing the data in log files, this is the case after seven days at the latest.
Opportunity to object and for removal: The recording of data for provision of the web pages and storage of the data in log files is fundamentally necessary for operation of the web pages. There is consequently no opportunity for the user to object.
2. Website analysis services (Third-Party cookies from Google-Analytics)
On the web pages Camunda is using Third-Party cookies from Google Analytics, a web analysis service of Google Inc. ("Google"). "Cookies" are text files that are stored on the user's computer and enable analysis of the use of the web pages by the user.
a. Google Analytics
The web pages use Google Analytics, a web analysis service of Google Inc. ("Google").
Personal data: Information generated by the cookie regarding use of these web pages is generally transferred to a Google server in the USA and stored there. As IP anonymisation is enabled on our web pages, the user's IP address is, however, previously abbreviated by Google within the Member States of the European Union or in other signatory states to the Agreement on the European Economic Area. Only in exceptional instances is the full IP address transmitted to a Google server in the USA and abbreviated there. Google Analytics processes the data on behalf of Camunda. Google Analytics is certified under the US Privacy Shield. A data processing agreement with Google Analytics is in place that conforms to the requirements of the GDPR.
Purpose and legal basis: Google will use this information on behalf of Camunda to evaluate use of the web page by the user, to put together reports on web page activities and to provide additional services connected with use of the web pages and use of the internet for the web page operator. The IP address transmitted as part of Google Analytics by the user's browser is not put together with other Google data. Google Analytics is used to increase the effectiveness of our web pages and requires the passing-on of data about users to us. Generally, the user's consent is not obtained for this. However, use of these services is justified via Art. 6 (1) (f) GDPR, because Camunda simplifies and accelerates the handling of the visits by its users to the web pages through the use of Google Analytics.
Duration of storage, data erasure, opportunity to object and for removal: The user is able to prevent storage of cookies via a corresponding setting on their browser software; however, we advise that in that case the user may not be able to use all functions of these web pages to the full extent. In addition, the user can prevent the recording of the data generated by the cookie and relating to their use of the web pages (including their IP address) being sent to Google and the processing of this data by Google by downloading and installing the browser plug-in available from the following link: http://tools.google.com/dlpage/gaoptout.
3. Links to social media platforms and Workable
In our website-footer we offer links to the social media platforms Twitter and GitHub, where you can follow Camunda. We have not implemented Like- Share- or other social media buttons. If the user calls up a page containing a follow me button, indicated using the respective social media logo, a direct connection with the social media servers is established by their browser. Information is then transferred to the respective social media platform indicating that the page was called up.
Twitter: is a micro-blogging service from the American company Twitter, Inc. (795 Folsom St., Suite 600, San Francisco, CA 94107). Further information on data collection, evaluation and processing of the user’s data by Twitter and on their rights in relation to this can be obtained by the user from Twitter’s privacy statement, downloadable from http://twitter.com/privacy.
GitHub: is a web-based hosting service for version control using git (88 Colin P Kelly Jr Street, San Francisco, CA 94107). Further information on data collection, evaluation and processing of the user’s data by GitHub and on their rights in relation to this can be obtained by the user from GitHubs’s privacy statement, downloadable from https://help.github.com/articles/github-privacy-statement/
Workable: We also provide a direct link to Workable, our online-platform to apply for a vacant position. Workable has its registered office in the UK. Further information on data collection, evaluation and processing of the user's data by Workable and on their rights in relation to this can be obtained from Workable's privacy statement, which is available to download from https://www.workable.com/privacy
On our web page, the user has the opportunity to exchange information with other interested users about questions relating to the project bpmn.io
Personal data: Where a user registers for the forum, we record their e-mail address, their user name, Name and Password. If a user posts to a forum, the user name they have chosen is displayed and is therefore viewable by the public. The contribution they have submitted can also be downloaded by any interested party, together with the time of posting. However, the e-mail address is not published.
The web page allows the users to register via a Third-Party account. Currently we are offering this service for GitHub, Twitter and Google. This service may be reduced or extended in the future. This allows for usage of certain data stored by GitHub, Twitter or Google in relation to the user´s account there to log into the Forum. We may then ask the user to complete the necessary sign-in information as applicable and described above. In addition to certain basic profile information (e.g. user name) we also receive the email address the user is using for his GitHub, Twitter or Google account as we need this address to initiate and, subsequently, administrate the user account in the Forum.
Purpose and legal basis: The purpose of the data processing is to provide a platform enabling users to exchange information with one another and with Camunda about our bpmn.io project. Registration of the data is necessary for the provision of content or services. The legal basis for storage of the data is accordingly Art. 6 (1) (f) GDPR.
Duration of storage, data erasure, opportunity to object and for removal: The data are automatically erased as soon as they are no longer necessary for achievement of the purpose for which they were collected. In the event of recording data for registering on the forum, this is the case if the user deletes their account. Old posts are not deleted, however. Registered persons also have the opportunity at any time to delete or have the stored data amended. The data subject can obtain information at any time about the personal data stored about them. For this purpose, the user can write an e-mail to firstname.lastname@example.org.
III. Rights of users (data subjects)
If the user's personal data are processed, this person is a data subject in the sense of the GDPR. The data subject/user is entitled to the following rights vis-à-vis Camunda:
1. Right of access
The user can demand confirmation from Camunda regarding whether personal data concerning them are being processed by us.
Where such processing takes place, the user can demand details from Camunda concerning the following information:
2. Right to rectification
The user has a right to rectification and/or completion by Camunda where the processed personal data concerning them are incorrect or incomplete. Camunda will make the rectification without undue delay.
3. Right to restriction of processing
Under the following conditions, the user can request restriction of processing of the personal data concerning them:
If the processing of the personal data concerning the user was restricted, this data will, with the exception of storage, only be processed with their consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
Where the restriction of processing was established in accordance with the above provisions, the user will be informed by Camunda before the restriction is lifted.
4. Right to erasure
a. Duty of erasure
The user may demand that Camunda erase the personal data concerning them without undue delay, and Camunda will have the obligation to erase these data without undue delay where one of the following grounds applies:
b. Information to third parties
Where Camunda has made the personal data concerning the user public and where Camunda is obliged pursuant to Art. 17 (1) GDPR to erase the data, Camunda, taking account of the available technology and the cost of implementation, will take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the user has requested from Camunda the erasure of all links to those personal data or of copies or replications of those personal data.
The right to erasure does not exist to the extent that processing is necessary
5. Right to be informed
Where the user has asserted the right to rectification, erasure or restriction of processing by Camunda, Camunda will be obliged to notify all recipients to whom the personal data concerning the user were disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or is associated with disproportionate expense.
The user has the right Camunda to be informed by Camunda about these recipients.
6. Right to data portability
The user has the right to receive the personal data concerning them, which they have provided to Camunda, in a structured, commonly used and machine-readable format. The user further has the right to transfer those data to another controller without hindrance from Camunda, to whom the personal data have been provided, where
In exercising this right, the user further has the right to have the personal data concerning them transferred directly by Camunda to another controller, where technically feasible. This will not adversely affect the freedoms and rights of other persons.
The right to data portability does not apply for the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in Camunda.
7. Right to object
The user has the right to object, on grounds relating to their particular situation, at any time to the processing of personal data concerning them which is based on Art. 6 (1) (e) or (f) GDPR.
Camunda will cease to process the personal data concerning the user, unless the user can demonstrate compelling legal grounds for the processing which override the interests, rights and freedoms of Camunda, or where processing serves the establishment, exercise or defence of legal claims.
Where personal data concerning the user are processed for direct marketing purposes, the user has the right to object at any time to processing of personal data concerning them for the purposes of such marketing.
Where the user objects to processing for direct marketing purposes, the personal data concerning them will cease to be processed for such purposes.
In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the user may exercise their right to object by automated means using technical specifications.
8. Right to revocation of the declaration of consent under the privacy law
The user has the right to withdraw their declaration of consent under the privacy law at any time. The revoking of consent does not affect the lawfulness of the processing that has taken place by reason of the consent up to the time of withdrawal.
9. Automated individual decision-making including profiling
Not applicable; no automated decision-making or other profiling measures take place at Camunda.
10. Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, the user has the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their workplace or the place of the alleged infringement, if the user considers that the processing of the personal data concerning them infringes the GDPR.
The supervisory authority with which the complaint has been lodged will inform the complainant on the progress and the outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.
V. Change log
This privacy statement has been completely revised to conform to the requirements set out in the GDPR and was first published in this form on the 25th of May 2018.