Privacy policy

1. Controller and contact

Honodo GbR
Lohwaldstr. 22
86356 Neusäß
Germany
Email: info@honodo.de

Partners authorised to represent the company: Philipp von Mühldorfer, Angelos Galios, Tassilo Engelniederhammer. For questions about data protection, you can reach us at the email address above. No data protection officer has been appointed, as the requirements for a mandatory appointment (§ 38 BDSG) are currently not met.

2. Overview: website, platform, integrations

• Website (www.honodo.de): information about Honodo. Here we are the controller (sections 3 to 6).
• Platform (app.honodo.de): the software for projects, quotes, HOAI fees and invoices. We are the controller for accounts, contract, sign-in and security (sections 7 and 8). For the content that firms record there, we are the processor on behalf of the respective firm (sections 9 and 10).
• Optional interfaces to other programs: data is only transferred if a firm sets up an interface itself (section 11). Visiting the website does not trigger any such transfer.

3. Website: provision and server log data

When the website and the platform are accessed, our server processes, as technically necessary, the IP address of your device, the date and time of access, the address accessed and the technical information transmitted by the browser. This data is stored in server log files.

The purpose is to deliver the pages, analyse faults and defend against attacks, including limiting automated access. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is secure and stable operation. The log data is not combined with other data sources, not analysed for marketing and automatically deleted after 14 days, unless it is needed for longer in an individual case to investigate a specific security incident.

4. Contact by email

If you send us an email – to info@honodo.de or to a personal address of our team – we process your email address, your name and the content of the message in order to answer your request. The emails are received and stored on our own mail server at the hosting provider (section 12).

The legal basis is Art. 6 (1) (b) GDPR insofar as your request concerns a contract or its initiation, otherwise Art. 6 (1) (f) GDPR (legitimate interest in answering requests).

5. Website: cookies, local storage, fonts

Without your consent, the website does not set any cookies. The only strictly necessary entry is one that records your decision in the cookie settings – including a refusal – so that we can respect it and do not ask you again on every visit:

The legal basis for storing and reading is § 25 (2) no. 2 TDDDG. After expiry, if the entry is damaged or if a service changes in substance, we ask again; optional services remain switched off until then.

Evidence of your decision: So that we can demonstrate whether and for what consent was given or withdrawn, we send the following information to our own server with every decision – including a refusal: the consent ID, the action chosen, your decision per service with the version of the service description, the version of the texts displayed and the time. We store neither your IP address nor browser information and do not link the information to an account. The request itself appears in the server log data like any page view (section 3). You can see the consent ID in the cookie settings. The legal basis is Art. 6 (1) (c) in conjunction with Art. 7 (1) GDPR. The information is automatically deleted after 3 years.

Fonts are loaded from our own server, not from Google or other providers. Videos, maps or other content from third-party servers are not embedded.

6. Website: statistics and marketing services

Only if you consent in the cookie settings do we use the following services on this website. Each service is requested separately; without consent, no connection to it is established. With your consent to marketing services, Honodo ads may be shown to you on other websites and in social networks (retargeting). Your choice also applies to our registration page (app.honodo.de/register): there, the services you have consented to record the page view and the completion of a registration – without your entries such as name or email address. None of these services are used in the signed-in area of the platform.

Google Analytics 4 via Google Tag Manager (Statistics)

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Function and purpose: Google Tag Manager is a tool for managing website tags; we use it to integrate Google Analytics 4, a tool for audience measurement. Audience measurement for the website and the registration page: pages visited, origin of the visit (website address without path, campaign parameters utm_*), clicks on registration and completed registrations (without your details). Google Tag Manager itself does not set any cookies.

Data processed: IP address (technically required for transmission), device and browser information, language setting, approximate location based on the IP address, pages visited as a cleaned address (without further query parameters), page title, timestamps, a pseudonymous identifier in the cookie. We do not pass on names, email addresses, form contents or customer identifiers; page addresses are cleaned before transmission.

Storage period at Google: Analysable event data is deleted in Google Analytics after 2 months.

Recipients: Google Ireland Limited as processor on the basis of the data processing terms agreed with Google; Google LLC (USA) as sub-processor.

Third country: A transfer to Google LLC in the USA is possible. It is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795), insofar as Google LLC is certified under it, and additionally on standard contractual clauses.

Not enabled: Google Signals, User-ID and enhanced conversions. Analytics data only flows into Google Ads (e.g. audiences, conversion import) if you have additionally consented to Google Ads.

More information: Google privacy policy.

Google Ads (ad measurement and retargeting) (Marketing)

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Function and purpose: Google Ads is Google's advertising platform (Search, YouTube, partner websites). It is integrated via Google Tag Manager. Measuring the success of our ads (whether a visit came from an ad click and led to a registration), optimising campaigns and retargeting: visitors to this website may later be shown Honodo ads on Google.

Data processed: IP address (technically required for transmission), device and browser information, ad click identifier (gclid), pages visited, time and type of measured events (click on registration, completed registration without your details), pseudonymous identifiers in cookies. Google may link this data to your Google account and read its own cookies on Google domains. We do not pass on names, email addresses, form contents or customer identifiers; page addresses are cleaned before transmission.

Storage period at Google: The storage period at Google is determined by Google as an independent controller; information on this can be found in Google's privacy policy.

Recipients: Google Ireland Limited as an independent controller (Google Ads Controller-Controller Data Protection Terms); Google LLC (USA).

Third country: A transfer to Google LLC in the USA is possible. It is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795), insofar as Google LLC is certified under it, and additionally on standard contractual clauses.

Not enabled: enhanced conversions and customer lists — we do not transfer email addresses or other customer data to Google.

More information: Google privacy policy.

Meta Pixel (Facebook, Instagram) (Marketing)

Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

Function and purpose: The Meta Pixel is a Meta tool for advertising on Facebook and Instagram. It is integrated via Google Tag Manager; for this purpose the Tag Manager is loaded from Google servers even if you only consent to the Meta Pixel. Google receives your IP address and browser information in the process; Google Tag Manager itself does not set any cookies. Measuring the success of our ads on Facebook and Instagram (page views, click on registration, completed registration without your details), optimising campaigns and retargeting: visitors to this website may later be shown Honodo ads on Facebook and Instagram.

Data processed: IP address, device and browser information, pages visited, time and type of measured events, ad click identifier (fbclid), pseudonymous identifiers in cookies. Meta may link this data to your Facebook or Instagram account and read its own cookies on Meta domains. We do not pass on names, email addresses, form contents or customer identifiers; page addresses are cleaned before transmission.

Storage period at Meta: Any further storage period at Meta is determined by Meta; information on this can be found in Meta's privacy policy.

Recipients: We are jointly responsible with Meta Platforms Ireland Limited for the collection on this website and the transfer to Meta (Art. 26 GDPR; Meta's joint controllership agreement, Controller Addendum). Meta handles requests from data subjects; however, you can contact either of us. Meta alone is responsible for further processing. Further recipient: Meta Platforms, Inc. (USA). For delivering Google Tag Manager: Google Ireland Limited and Google LLC (USA).

Third country: A transfer to Meta Platforms, Inc. in the USA is possible. It is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795), insofar as Meta Platforms, Inc. is certified under it, and additionally on standard contractual clauses. The same applies to Google LLC.

Not enabled: Advanced Matching and customer lists — we do not transfer email addresses or other customer data to Meta.

More information: Meta privacy policy.

Legal basis: your consent (Art. 6 (1) (a) GDPR; for storing and reading on your device § 25 (1) TDDDG), separately for each service. Consent is voluntary. If you refuse, the website remains fully usable.

Withdrawal: You can withdraw your consent at any time with effect for the future – via cookie settings in the footer or directly here. The page then reloads, the services are ended and their cookies on this website are deleted. Withdrawal does not affect the lawfulness of the processing carried out up to that point; data already transferred to the providers is not automatically deleted as a result – for this, you have the rights set out in section 15.

7. Platform: registration and contract

To use the platform, you register your firm. In doing so, we process:

• the firm's name and address, your name and your email address,
• your password – stored exclusively as a cryptographic hash, never in plain text,
• a confirmation code that we send to your email address,
• the contract variant chosen, licence scope and, where applicable, a promotional code,
• only when the contract is concluded in the platform: account holder, IBAN and BIC for the SEPA direct debit mandate and the resulting invoice and payment data.

The purpose is the conclusion and performance of the contract, including billing. The legal basis is Art. 6 (1) (b) GDPR; for the retention of invoices Art. 6 (1) (c) GDPR in conjunction with the retention obligations under commercial and tax law. We send contract and billing notifications by email via our own mail server.

8. Platform: sign-in, cookie and local storage

Sign-in uses short-lived, signed access tokens and a session cookie. Active sessions are managed on the server and ended when the password is changed. Optionally, you can enable two-factor sign-in with time-based one-time codes (TOTP).

These entries are strictly necessary for the service you have requested (§ 25 (2) no. 2 TDDDG) and are not transferred to third parties. The legal basis for processing is Art. 6 (1) (b) GDPR, and additionally (f) for security measures.

Resetting your password

When you reset your password, we send a confirmation code to the stored email address. It is sent via our own no-reply outgoing mail server. The legal basis is Art. 6 (1) (b) GDPR.

9. Platform: firms' content (data processing on behalf)

Firms record their own business data in Honodo, including personal data of their clients and contact persons (names, addresses, contact details) as well as quote, fee and invoice data. We process this data exclusively on behalf of and on the instructions of the respective firm (Art. 28 GDPR). The firms' data is kept separate from each other; it is not used for our own purposes.

The respective firm is the controller for this data. The basis is the data processing agreement, which is agreed with the user agreement (Terms § 7 (2)). Please direct requests about this data to the firm; we support it in responding.

10. Platform: PDF, e-invoice and email sending

Quotes, invoices and other documents are generated as PDFs within the platform. E-invoices (XRechnung and ZUGFeRD/Factur-X according to EN 16931) are created entirely on our systems, without external services.

Firms can store the access credentials of their own email mailbox in order to send quotes and invoices directly from the platform. The credentials are used exclusively for sending initiated by the firm. Sending runs via the email provider chosen by the firm; the firm is responsible for the processing there.

11. Optional interfaces

A firm can connect Honodo to ERPNext, Odoo or clockodo. Data is only exchanged once the firm sets up a connection and stores its access credentials:

• ERPNext and Odoo: client and project data in both directions,
• clockodo: import of clients, projects and time entries.

The transfer takes place on behalf of the firm (section 9) to the system chosen by the firm. The firm or its provider is responsible for the processing there.

12. Hosting and recipients

We operate the website, platform, database (MongoDB) and mail server ourselves on a server that we rent from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server is located in a Hetzner data centre in Falkenstein (Saxony, Germany). Hetzner processes the data on our behalf (Art. 28 GDPR). We do not use any other hosting or database providers.

We do not transfer any personal data to countries outside the European Union or the European Economic Area, except for services to which you have consented (section 6). If a firm uses its own email mailbox or an interface (sections 10 and 11), the place of processing depends on the provider chosen by the firm.

Beyond this, we only pass on personal data if this is necessary to perform the contract (such as email sending initiated by the firm or an interface set up by the firm), if we are legally obliged to do so or if you have consented to a service under section 6. Data is not sold.

13. Data security

We take technical and organisational measures pursuant to Art. 32 GDPR, including:

• encrypted transmission via HTTPS (TLS),
• passwords only as a cryptographic hash, optional two-factor sign-in,
• separate data storage per firm and role-based permissions,
• limitation of automated access and HTTP security policies.

As with any IT application, absolute security cannot be guaranteed. More on this on the Security page.

14. Storage period

• Server log data: 14 days, then automatic deletion (exception: investigation of a specific security incident).
• Email enquiries: deleted once your matter has been dealt with and no further queries are to be expected, at the latest after 12 months. Emails that prepare or process the conclusion of a contract (commercial and business letters) are kept for 6 years.
• Account and firm data: for the duration of the contract. After the end of the contract, access remains in place for 30 days for data export (Terms § 9 (7)). The account is then blocked and initially archived; the firm data stored on the firm's behalf is then deleted in accordance with the DPA. Archiving alone does not extend the storage period.
• The provider's own contract documents and commercial or business letters: generally 6 years; where a document is subject to another statutory retention obligation, its period applies. This does not apply across the board to the project and client data of the firms using the platform.
• Invoices and other accounting records including payment data: 8 years (§ 147 (3) AO, § 257 (4) HGB).
• The provider's own books and records, in particular billing records subject to retention: 10 years.
• Bank details and SEPA mandate records: during contract processing and thereafter only insofar as they are required for statutory retention obligations, proof of a mandate under the collection agreement or the processing of outstanding payments.
• Sign-in sessions: end after 7 days at the latest without a new sign-in.
• Your choice in the cookie settings: 6 months on your device; after that we ask again. Evidence of the decision on our server: 3 years. Data at the providers: see section 6.

Statutory retention periods begin at the end of the calendar year in which the document was created. During retention, we only use the data to fulfil these obligations. After the period has expired, it is deleted unless, for example, an ongoing tax audit or the establishment, exercise or defence of legal claims requires further storage. Such an exception is limited to the necessary data and reviewed regularly.

Backup copies that cannot technically be cleaned up individually are overwritten in the documented backup cycle and not used for other purposes. Deletions already carried out are applied in the event of a restoration before the data is used productively again.

15. Your rights and complaints

You have the right to

• access (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdraw consent given with effect for the future (Art. 7 (3) GDPR).

An informal message to info@honodo.de is sufficient for all of the rights mentioned.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

16. Obligation to provide data, no automated decision-making

You do not have to provide any personal data to visit the website. The information requested during registration is required to conclude the contract; without it, the platform cannot be used.

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR. The platform's HOAI and invoice calculations are calculation functions without legal effect on data subjects.

17. Changes

We update this privacy policy when the scope of functions or the legal situation changes. The version published here applies.

As of 18 October 2026