Privacy Notice
Last updated: 27 September 2026
No cookie banner: CatalogHub does not use advertising, audience measurement or user profiles. Storage is limited to what is technically necessary for security and sign-in and to the language selected by you. We therefore do not present a misleading “accept or reject” choice.
1. Controller
forsix GmbH
Eichendorffstr. 11
71540 Murrhardt
Germany
Email: info@forsix.de
2. Roles in data processing
forsix GmbH is the controller for operating this website, administering CatalogHub accounts, IT security and its own contractual relationships.
Where an issuer creates customer accounts or supplies price lists to its customers, that issuer generally determines the purpose and scope of the customer data. To the extent forsix processes these data only on the issuer's instructions to provide CatalogHub, forsix acts as processor. The issuer remains responsible for the lawfulness of the customer data and for informing its customers.
3. Website access and server logs
Technical processing when the site is accessed includes the IP address, date and time, requested method, path and protocol, HTTP status, bytes transferred, referrer and browser identifier. This is necessary to deliver the site, diagnose faults and defend against attacks.
Legal basis: Article 6(1)(f) GDPR; our legitimate interest is secure and reliable operation. Apache access/error logs and technical application logs are rotated daily and generally deleted after 14 days unless a security incident requires longer purpose-limited retention.
4. Accounts and use of CatalogHub
Depending on the role, we process company/display name, name, email address, customer number, country, language, issuer assignment, password hash, permissions, notification settings and, where applicable, a hashed API key. Passwords and API keys are not stored in plaintext.
For issuer and customer accounts created by an issuer, these data originate from that issuer. An account, authentication and protected delivery cannot operate without fields marked as required.
Purposes: authentication, account administration, delivery of price lists, customer assignment, notifications, support and abuse prevention. Legal bases: Article 6(1)(b) GDPR where necessary to perform a contract and Article 6(1)(f) GDPR for secure operation, evidence and abuse prevention. Processing performed on behalf of an issuer is additionally governed by that controller's instructions.
5. Price lists, files and content inspection
We store uploaded files and their title, description, list number, validity, filename, size, MIME type, checksum, sharing permissions and review status. Uploads are inspected locally on our server using rules for file types, unsafe archives, formulas, external connections, hidden worksheets and configured confidentiality terms. No file is transferred to an AI provider or other third party for this inspection.
Where an issuer permits a customer to upload its own price lists, we additionally process the stable list name, version number, uploading user and retrieval status. A previous file is permanently removed from active storage after a successful replacement or customer deletion; an audit record without the file contents remains for traceability.
A finding may automatically deactivate a file or require human review. No solely automated decision about a person within Article 22 GDPR is made. Details are set out in the usage and content rules.
6. Usage, upload and download records
For security and issuer-requested statistics, upload and download records include in particular the time, file or price list, account, result, IP address and, for downloads, browser identifier. Review and approval actions are recorded with time and acting account.
Legal basis: Article 6(1)(b) and (f) GDPR. Records are generally kept until the related price list or issuer account is deleted, unless they are needed longer to establish, exercise or defend legal claims.
7. Strictly necessary cookies and local storage
| Name | Purpose | Duration |
|---|---|---|
cataloghub-session | Authentication, session state and access protection | Up to 2 hours of inactivity |
XSRF-TOKEN | Protects forms and accounts against cross-site requests | Up to 2 hours |
remember_web_… | Only when “Remember me” is expressly selected | Framework-managed; until logout, expiry or browser deletion |
cataloghub-language (local storage) | Remembers the language expressly selected on the landing page | Until deleted in the browser |
These technologies are necessary for the service expressly requested or for the selected convenience function (Section 25(2)(2) TDDDG). You may delete cookies and local storage in your browser; authentication and protected functions cannot work without session and CSRF storage.
8. Email
CatalogHub may send access details, password-reset messages and price-list notices. The recipient address, content, send time and technical delivery data are processed through the SMTP endpoint mail.forsix.de. The legal basis is Article 6(1)(b) GDPR or, for optional notices, Article 6(1)(f) GDPR; opt-outs are respected.
9. Recipients and international transfers
Access is limited to authorised CatalogHub users under the permissions granted and to staff and technical providers where required for operation, maintenance, hosting or email. Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, is used as a sub-processor for hosting, server infrastructure, backup and system email under an Article 28 GDPR agreement. Authorities receive data only where legally required. The application and database run on infrastructure in Germany administered by forsix. Recipients, their email providers and authorised users may nevertheless be located outside the EEA. Any third-country transfer by forsix is made only in accordance with Articles 44 et seq. GDPR.
10. Retention and erasure
Accounts, price lists and assignments are generally retained for the period of use or the contractual relationship. Deleting a price list removes its stored file. After contract end or a valid erasure request, personal data are erased unless statutory retention duties or necessary evidence require otherwise. Password-reset records regularly expire after 60 minutes and expired sessions are cleared automatically.
Customer-uploaded files that are replaced or deleted are removed from active file storage immediately. They may remain in encrypted system backups until normal rotation expires and are not restored to production use.
11. Your rights
Subject to the GDPR, you have rights of access, rectification, erasure, restriction and data portability. Where processing relies on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. Consent can be withdrawn at any time for the future.
Contact info@forsix.de. If your request concerns an account created by your issuer, you may also contact that issuer directly.
12. Right to lodge a complaint
You may complain to a data-protection supervisory authority. The authority generally competent for forsix GmbH is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Heilbronner Straße 35, 70191 Stuttgart. Information and complaint form: baden-wuerttemberg.datenschutz.de.
13. Changes
We update this notice when functions, recipients or the legal situation change. The version published on this page applies.