Status: 6 August 2026
Scope: User accounts for accessing service and maintenance documents (service technician access)

1. Controller and contacts

Controller:
LAUDA Medical GmbH & Co. KG
Laudaplatz 1
97922 Lauda‑Königshofen
Germany

General contact:info@lauda-medical.com
Data Protection Coordinator (DSK):service@lauda-medical.com

External Data Protection Officer (DPO):
Ingdilligenz GmbH
Leightonstr. 3
97074 Würzburg
Email: dsb-services@ingdilligenz.de

Competent supervisory authority:
Bavarian Data Protection Authority (BayLDA)
Promenade 18
91522 Ansbach
Germany

2. Purposes of processing

• Creation and administration of your user account for the service portal
• Controlling qualification‑based access to service, maintenance, and repair instructions
• Proof of qualification (e.g., training status, validity period) to customers and internal quality management
• IT operations, security, and logging (e.g., logins, error diagnosis, abuse prevention)

3. Legal bases

• Art. 6(1)(f) GDPR (legitimate interests): Ensuring that only qualified personnel access safety‑relevant documents; protection of business and product information; auditability
• Art. 6(1)(b) GDPR (contract): Insofar as portal access forms part of contractual obligations toward customers
• Sec. 26 BDSG (employee data): Insofar as applicable to our own employees

Note: You have the right to object to processing based on Art. 6(1)(f) GDPR (see the “Your rights” section).

4. Categories of personal data

• Identification and contact data: Name, business email address
• Qualification data: Training status/certificate, validity period, associated product/device categories
• Account data: User ID, roles/permissions, password hash
• Log data: Timestamps for account creation, login/logout, permission changes, technical log data (e.g., IP address in server logs, user agent) as part of IT security

No special categories of personal data under Art. 9 GDPR are requested or intentionally processed.

5. Source of data (Art. 14 GDPR)

Your data is generally provided to us by your employer/customer or the training provider who organizes training on our devices and documents your qualification. We may collect supplementary contact details directly from you (e.g., during password resets or corrections).

6. Recipients or categories of recipients

• Internal departments at LAUDA Medical (e.g., Service, Quality/Regulatory, IT) on a need‑to‑know basis
• Processors for operation and development of the website/portals:
  rocket‑media GmbH & Co. KG
  Wassertrüdinger Str. 14
  91550 Dinkelsbühl
  Germany
  info@rocket-media.de
  +49 9851 58 97 28 0
  IT service provider for maintenance, monitoring, and security measures (only under instruction, with data processing agreement)

No transfer to third parties for advertising or independent third‑party purposes takes place.

7. Third‑country transfers

Currently, there are no transfers to third countries outside the EU/EEA. Should this change, we will inform you in advance in a transparent manner about the destination country, safeguards under Art. 46 GDPR (e.g., EU Standard Contractual Clauses), and any potential access scenarios.

8. Storage period and deletion

• Account data: typically for three years from creation or until the qualification’s validity expires. After expiry, the account is deactivated; deletion follows the deadlines defined in the deletion policy.
• Log data: stored for a limited period for IT security and evidentiary purposes; subsequently deleted or anonymized in accordance with the deletion policy.
• Training records: according to the retention policy and regulatory requirements (quality assurance).
• Statutory obligations/legal enforcement: longer retention where legally required or for the establishment, exercise, or defense of claims; thereafter deletion or anonymization.

9. Necessity of provision

Providing your name, business email address, and a valid training certificate is required to enable qualification‑based access to service and maintenance documents. Without this information, an account cannot be created and access cannot be granted.

10. Your rights (Art. 12–22 GDPR)

• Access
• Rectification
• Erasure (“right to be forgotten”), insofar as no retention obligations apply
• Restriction of processing
• Data portability (where applicable)
• Objection to processing based on legitimate interests (Art. 6(1)(f) GDPR) on grounds relating to your particular situation
• Complaint to a supervisory authority

To exercise your rights, please contact our Data Protection Coordinator or the External Data Protection Officer (contact details see Section 1).

11. Security of processing

We implement technical and organizational measures to protect the confidentiality, integrity, and availability of your data, including role‑based access controls, encryption in transit, system hardening and monitoring, logging of security‑relevant events, data processing agreements, and regular permission reviews.

12. Changes to this information

If purposes, legal bases, recipients, or other relevant aspects change, we will update this notice. The current version is permanently available on this page; the version published here is authoritative.

13. Links to the portal

Login page: https://www.lauda-medical.com/en/services/login-service-technicians
Forgot password: https://www.lauda-medical.com/en/services/login-service-technicians/passwort-vergessen