1. Data controller

The controller of personal data is the operator of the ReviCall service.

Contact for privacy enquiries: privacy@revicall.com

User account and business account distinction

A user account is the sign-in identity of a specific person. A business account is a separate workspace in which organization, property, inspection, document and membership data are processed. One user account may be linked to multiple business accounts. Closing a business account therefore does not automatically delete the user account; deletion of the user account is a separate process and may be restricted by the requirement that every active business account retain at least one active owner.

2. Personal data we process

Account and identification

• email address
• user identifier
• authentication data stored securely

Application data

• data relating to accounts, properties, inspections and technicians
• uploaded documents and attachments

Billing data

• name or organization name
• address
• company registration number and VAT number, where provided

Technical data

• IP address
• audit, security and technical logs

Contact details of technicians and organizations

• an optional telephone number may be processed for technicians for contact related to the management and performance of inspections
• a business account may contain an organization's contact telephone number
• a telephone number is not required in the personal profile of a regular user

Contact details of technicians and organizations are used for communication related to the provision of the service and the management of inspections.

ReviCall does not currently use telephone numbers for marketing SMS messages or as a means of two-factor authentication. Inspection notifications are sent by email.

3. Purposes of processing

• provision of the service and performance of the contract
• management of accounts, properties, inspections, documents and related workflows
• authentication, authorization and account security
• sending operational and inspection notifications
• billing and subscription administration
• security, auditing, troubleshooting and prevention of misuse
• compliance with legal obligations
• communication with customers

4. Recipients of personal data

Where necessary, data may be processed by service providers used to operate ReviCall, in particular:

• Stripe – payments
• Postmark – email communication
• Zoho – customer communication
• Hetzner – infrastructure hosting

Some providers may process data outside the EU. Relevant transfers are protected by appropriate legal mechanisms, such as Standard Contractual Clauses.

5. Retention

• account-related data: for the duration of the account and subsequently according to the applicable retention rules
• invoices and accounting records: 10 years where retention is required by law
• technical and security logs: generally 30 to 180 days depending on the type of record
• operational email logs: approximately 90 days

Data may be retained for longer where required by law or where necessary for the protection of legal claims and the security of the service.

6. Security

ReviCall uses technical and organizational measures appropriate to the nature of the service, in particular:

• encrypted communication using HTTPS
• access control based on permissions and the active account
• audit and security logs
• protection and integrity checks for attachments
• backups
• mandatory two-factor authentication for user accounts

7. User rights

Subject to the conditions laid down by applicable law, you have in particular the right:

• to access your personal data
• to rectify inaccurate data
• to erasure of personal data
• to restriction of processing
• to data portability
• to object to processing

You also have the right to lodge a complaint with the competent supervisory authority.

Contact for exercising your rights: privacy@revicall.com

8. Account deletion

When an account is closed, personal data is deleted or anonymized in accordance with ReviCall's retention rules.

Data that must be retained due to legal obligations, security, audit requirements or the protection of legal claims may be retained for the necessary period.

9. Changes

This Privacy Notice may be updated, in particular when ReviCall features, service providers or legal requirements change.

User account deletion

When permanent deletion of a ReviCall user account is requested, ReviCall first verifies that the user is not the last active owner of any active business account. It then removes active memberships and access rights, terminates active delegations and individual access grants, cancels pending invitations addressed to the user's email address, and removes or minimizes personal data in the technician profile. The sign-in identity, including authentication data and 2FA-related data, is then deleted.

Deleting a user account does not delete operational data of business accounts or their inspection, document and audit history. Technical identifiers may remain in historical and audit records where necessary for integrity, security, legal claims or evidence of past operations; they are no longer usable as an active sign-in identity.