Privacy policy

The controller responsible for the processing of personal data on the TRA Studio website and application is:

Alsensio GmbH, Albert-Einstein-Ring 6, 22761 Hamburg, Germany
Email: mail@alsensio.de · Phone: +49 (0)40 228 6789 10

We are not legally required to appoint a data protection officer. For any privacy matter, contact us at mail@alsensio.de.

Account data (Art. 6(1)(b) GDPR — performance of a contract). When you create or are given an account: your name, work email, organisation and a securely hashed password. Used to provide the service, authenticate you and manage your organisation and seats.

Authentication & security (Art. 6(1)(b) and (f)). Session and CSRF cookies to keep you signed in and protect requests, optional multi-factor authentication, and an append-only audit log of security-relevant actions — in our legitimate interest in operating a secure service and in providing you with your own compliance records.

Standards poll (Art. 6(1)(a) consent, or 6(1)(f)). If you use the "which standard do you miss?" form, we store the standard you request and — only if you enter it — your email, used solely to prioritise standards and, optionally, to notify you. No IP address is stored with the submission.

Account emails (Art. 6(1)(b) and (f)). We send transactional emails — address verification, password reset and organisation invitations — to operate and secure your account.

Contact (Art. 6(1)(b) and (f)). If you email us, we process your message to respond to it.

We use only strictly necessary cookies: a session cookie (tra_access) and a CSRF token (tra_csrf), both required to sign you in and secure the application. Under § 25(2) TDDDG these need no consent.

We do not use advertising or third-party tracking cookies, and there is no analytics or advertising tracking in the application.

The service is hosted on servers in Germany operated by IONOS SE, Montabaur, Germany, acting as our processor under a data-processing agreement (Art. 28 GDPR). To operate and secure the service, the server may log technical data (a truncated IP address, timestamp, requested URL, referrer and user agent) on the basis of our legitimate interest (Art. 6(1)(f)); these logs are deleted after 8 weeks.

We do not sell your data. It is processed within the EU/EEA. We engage processors only where necessary — hosting and email delivery (IONOS SE, Montabaur, Germany) and, once introduced, a payment provider — each under an Art. 28 GDPR agreement. Any transfer to a third country would rely on an adequacy decision or EU Standard Contractual Clauses. A payment provider has not yet been selected.

We link to our community forum at community.tra-studio.eu. The forum is a separate service on its own server, running Discourse software; it shares no accounts, cookies or data with TRA Studio. Following the link takes you out of this website, and your visit there is governed by the forum's own privacy policy and terms, which you will find linked in its footer. Registering for the forum is a separate, voluntary step — you do not need a forum account to use TRA Studio, and posts you make there are public.

We (Alsensio GmbH) are the controller for the forum as well, so the contact details in section 1 and your rights under sections 8 and 9 apply there too.

Account data is kept for the life of your account and deleted or anonymised after closure, unless statutory retention periods (e.g. under tax or commercial law) require otherwise. Poll suggestions are kept until the standard is added or the request becomes obsolete. Server logs are retained as described in section 4.

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object (Art. 21). Where processing is based on consent, you may withdraw it at any time with effect for the future (Art. 7(3)). To exercise any right, contact us at mail@alsensio.de.

You may lodge a complaint with a data protection supervisory authority, in particular the one for our registered office: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Hamburg.

We may update this policy to reflect changes to the service or the law. The current version is always available on this page, together with the date it was last updated.