Privacy
Privacy
Privacy notice for the OOTB apps
Last updated: 24 October 2026
1. Controller and Data Protection Officer
Out of the Blue KG, Beim neuen Damm 28, 28865 Lilienthal, Germany,
telephone +49 (0)4298 93 53 0, email info@ootb.de.
Data Protection Officer: Louis Schulz, Louis.schulz@ootb.de.
You may also contact dataprotection@ootb.de or write to our Data Protection
Officer at the postal address above.
2. Which services does this notice cover?
This notice covers the OOTB app overview and the applications made available
to you: catalogue and order entry, reports, customer development, organisation,
new customer acquisition, data exchange and the associated administration areas.
The separate online shop has its own privacy information. Advertising and
analytics described there are not, for that reason alone, features of these apps.
3. Sign-in, access and personal settings
We process account names, business contact details, password verification
values, user types, assigned permissions and data scopes, language, display
settings and session information. We use these to provide, secure and manage
authorised access. Central sign-in sessions normally last eight hours. With “Stay signed in”, a protected cookie is stored for up to 365 days and renewed on use. Signing out, account suspension or a password change ends access. Technically necessary session cookies are used. Storage on your device
that is necessary for a function you request is governed by section 25(2),
point 2 of the German Telecommunications Digital Services Data Protection Act
(TDDDG). Any consent required for additional optional purposes is obtained
separately.
For direct contracting parties, necessary processing to perform a contract or
take steps at your request before entering into a contract is based on
Article 6(1)(b) GDPR. For business contacts at companies, it is based on
Article 6(1)(f) GDPR. Our legitimate interests are reliable business operations,
support for assigned customers and protection against unauthorised access.
Where employee data is necessary for the employment relationship, section 26(1)
of the German Federal Data Protection Act (BDSG) applies in particular.
Processing required by law is based on Article 6(1)(c) GDPR. Article 6(1)(a)
GDPR applies to further processing that requires consent.
4. Sign-ins, active use and security
Authorised administrators can see the last sign-in, sign-in frequency, last
activity and aggregated active usage times. This supports access management,
identification of unused accounts, support and portal security. Our activity
feature counts active use while the application is visible; it does not store
typed text, message contents or complete mouse or movement histories.
Technical server logs may contain IP addresses, times, requested paths and
response statuses. Processing for operational security is based on
Article 6(1)(f) GDPR; necessary employment-related processing is governed by
the basis described above.
5. Customer service, business documents and organisation
We process business customer and contact details, addresses, telephone numbers
and email addresses, assigned sales representatives, orders, invoices,
outstanding items and order histories. Authorised users can record contact
notes, follow-ups and appointments. These functions support the business
relationship and customer-service planning. Access is restricted according to
the account, application permissions and assigned data scope. Depending on the
relationship, the legal bases are Article 6(1)(b) or (f) GDPR and, where
applicable, legal obligations under Article 6(1)(c).
Customer development generates suggestions from existing information, such as
ordering frequency, the date of the last order and sales trends. Representatives
decide for themselves whether to contact a customer. These suggestions do not
make solely automated decisions producing legal or similarly significant
effects within the meaning of Article 22 GDPR.
6. Prospects and data sources
Customer data comes in particular from the business relationship, existing
business systems and information you provide. The acquisition area may contain
expressly approved business prospect profiles from prior research. Access to
this app does not grant access to the entire research database. Where personal
data is not collected directly from you, the information required by
Article 14 GDPR, including the specific source and, where relevant, publicly
accessible sources, is provided separately. Contacting prospects is also
subject to the applicable rules on advertising. You may object to the use of
your data for direct marketing at any time. This notice is not marketing consent.
7. Offline use, images and downloaded files
For requested offline functions, authorised report and catalogue data may be
stored in your browser. If the relevant setting is enabled, previously viewed
product images may be stored offline. Selections, drafts and settings support
the function you use. Browser data can be removed through device or browser
settings; this may also delete local drafts.
PDF and Excel exports and drafts passed to your email application are outside
the app. Blocking an account does not automatically delete these files. Use
appropriately protected devices. If a device is lost, inform us so that we can
block further account access. This does not replace a device lock and does not
remove existing offline copies from a device that is not connected.
8. Recipients, hosting and external services
Responsible employees, authorised representatives and appointed service
providers have access to the extent necessary. The AWS apps are hosted on
Amazon Web Services in the Frankfurt region (eu-central-1). IT operations and
maintenance may include processing by appropriately appointed IT service
providers. Recipients of business data may also include service providers
engaged for business transactions or authorities where disclosure is required
by law.
A European server location does not, by itself, exclude possible access from
third countries. Where a transfer to a third country takes place, the
requirements of Articles 44 et seq. GDPR must be met, for example by an
applicable adequacy decision or appropriate safeguards. Information on the
recipients and safeguards used for the particular processing, and a copy of
the relevant safeguards, can be requested from our privacy contact. This notice
does not replace the necessary agreements with service providers.
Map views load background maps from tile.openstreetmap.org (OpenStreetMap
Foundation). Loading transfers, in particular, your IP address, technical
connection data and the requested map areas to this service. Customer markers
are displayed within the app; the tile-loading function does not receive a
customer list. The purpose is the map view you request, based on our legitimate
interest in geographically organised customer service under Article 6(1)(f)
GDPR. Further information: https://osmfoundation.org/wiki/Privacy_Policy.
You open external websites by clicking the relevant link. When an email draft
is handed over, your device uses the selected email application; that service's
privacy information also applies.
9. Acceptance of the sales terms
For customer accounts with catalogue and order access, explicit acceptance of
the General Terms and Conditions of Sale is recorded with the account, text
version, text checksum, document language, confirmation-interface language and
time. The text version remains traceable. The purpose is to incorporate and
provide evidence of contractual terms, based on Article 6(1)(b) and (f) GDPR.
Acceptance is not consent to advertising, tracking or this privacy notice.
10. Retention and deletion
The following periods apply to portal metadata:
– Sign-in and sign-out events: twelve months.
– Aggregated active usage times: twelve months.
– Short-lived technical activity sessions: two days after the last activity.
– Security-related account changes, password-change events and authorisations
to open protected files: 24 months.
– Web-server access logs: currently 14 daily rotations plus the current log file.
The portal metadata listed above is cleaned up daily. Preserving evidence of
a security incident may require longer retention in a particular case; separate
purpose and access restrictions apply.
Deactivated accounts are flagged for a deletion review after 24 months.
Reactivation ends this flag. Before deletion, we check, in particular,
contractual records that still need to be attributed and statutory evidence
requirements. Evidence of acceptance of terms is retained during the business
relationship and, in principle, until the regular limitation period for related
claims expires; the start of that period depends on the statutory conditions.
Ongoing disputes or other retention duties may require longer retention.
Deletion of this evidence is reviewed separately and is not combined with the
deletion of short-term usage logs.
Business records are subject to the applicable commercial and tax retention
periods. Contact notes, tasks and research profiles are reviewed and deleted
when their purpose ceases, unless legitimate or statutory grounds for retention
remain. Log cleanup does not automatically delete all business or customer
data. You manage offline files on your device yourself.
11. Your rights and complaints
Subject to the GDPR, you have rights of access, rectification, erasure,
restriction of processing and data portability. You may withdraw consent at
any time with effect for the future. You may object to processing based on
Article 6(1)(f) GDPR on grounds relating to your particular situation.
You may object to direct marketing at any time without giving a special reason.
Contact Louis.schulz@ootb.de or dataprotection@ootb.de. You may also complain
to a data protection supervisory authority, in particular the State Commissioner
for Data Protection of Lower Saxony: https://lfd.niedersachsen.de/.
12. Required information and changes
Without the information required for sign-in and permission checks, we cannot
provide protected access. Optional functions are separate from this.
This notice is updated and dated when processing changes. An update does not
replace any additional consent that may be required.