Privacy policy
Privacy at a glance
The following notes provide a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally. This website exists solely to introduce Tally and to let you join our early-access programme. We collect personal data only when you provide it yourself through the form, plus technical data that is generated automatically when the page is loaded (e.g. IP address, browser, operating system, time of access). With your consent we use privacy-friendly web analytics (AWS CloudWatch RUM) to measure performance and errors — see "Web analytics (CloudWatch RUM)". We use no advertising or cross-site tracking tools. You have the right to information, rectification, erasure, restriction of processing, data portability, and to withdraw any consent given, as well as the right to lodge a complaint with a supervisory authority. Details are set out in the sections below.
Hosting
We host this website with Amazon Web Services (AWS) via the AWS Amplify service. The provider is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. The servers are located in the eu-central-1 region (Frankfurt am Main, Germany). When the website is accessed, AWS processes technical access data (server log files) on our behalf, e.g. IP address, date and time of access, page requested, browser type and operating system. This processing is necessary to provide the website securely, reliably and efficiently. The legal basis is our legitimate interest in reliable provision (Art. 6(1)(f) GDPR) and the initiation or performance of pre-contractual measures (Art. 6(1)(b) GDPR). We have concluded a data processing agreement (Art. 28 GDPR) with AWS, ensuring that data is processed only on our instructions and in line with the GDPR.
Controller
The controller for data processing on this website is: Pascal Euhus, Tally Im Werth 5 79312 Emmendingen, Germany Phone: 015112026359 Email: datenschutz@tallypay.de The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.
Storage period
Unless a more specific storage period is stated in this privacy policy, your personal data remains with us until the purpose for processing no longer applies. If you make a legitimate request for erasure or withdraw your consent, your data will be deleted unless we have other legally permissible grounds for storing it (e.g. tax or commercial retention periods); in the latter case, deletion takes place once those grounds no longer apply.
Legal bases for processing
Where you have consented to processing, we process your data on the basis of Art. 6(1)(a) GDPR and, where consent covers the storage of information on your device (e.g. cookies), § 25(1) TDDDG. Consent can be withdrawn at any time. Where your data is required to perform a contract or to carry out pre-contractual measures, we process it on the basis of Art. 6(1)(b) GDPR. To comply with legal obligations, we process data under Art. 6(1)(c) GDPR. In addition, we process data on the basis of our legitimate interest under Art. 6(1)(f) GDPR. The relevant legal basis in each case is stated in the sections below.
Recipients of personal data
We only share personal data where this is necessary to perform a contract, where we are legally obliged to do so, where we have a legitimate interest in sharing it, or where another legal basis permits it. We share data with processors only on the basis of a valid data processing agreement. The main recipient in the context of processing on our behalf is our hosting provider, Amazon Web Services (see the "Hosting" section).
Withdrawal of your consent
Many processing operations are only possible with your express consent. You can withdraw consent you have already given at any time. The lawfulness of processing carried out before the withdrawal remains unaffected.
Right to object (Art. 21 GDPR)
IF PROCESSING IS BASED ON ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION, TO THE PROCESSING OF YOUR PERSONAL DATA; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES TO ASSERT, EXERCISE OR DEFEND LEGAL CLAIMS (OBJECTION UNDER ART. 21(1) GDPR).
Right to lodge a complaint with a supervisory authority
In the event of breaches of the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged breach. This right is without prejudice to any other administrative or judicial remedy.
Right to data portability
You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format. Where you request the direct transfer of the data to another controller, this will only be done where technically feasible.
Information, rectification and erasure
Within the framework of the applicable statutory provisions, you have the right at any time to free information about your stored personal data, its origin and recipients, and the purpose of the processing, and, where applicable, a right to rectification or erasure of this data. You can contact us at any time regarding this and other questions about personal data.
Right to restriction of processing
You have the right to request the restriction of the processing of your personal data. This right applies in particular where you contest the accuracy of your data (for the duration of the review), where processing is unlawful and you request restriction instead of erasure, where we no longer need the data but you need it to assert, exercise or defend legal claims, or where you have objected under Art. 21(1) GDPR and the balancing of interests is not yet complete. Restricted data may — apart from being stored — only be processed with your consent or for certain purposes provided for by law.
SSL/TLS encryption
For security reasons, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the browser address bar starting with "https://". When encryption is active, the data you transmit to us cannot be read by third parties.
Cookies
This website uses only technically necessary cookies. To remember your language choice (German/English), our software sets a cookie named "TALLY_NEXT_LOCALE". This cookie is necessary to deliver the website in your chosen language; the legal basis is our legitimate interest in a correct, multilingual presentation (Art. 6(1)(f) GDPR and § 25(2) TDDDG). With your consent we also set analytics cookies for AWS CloudWatch RUM (e.g. cwr_s, cwr_u) — see "Web analytics (CloudWatch RUM)"; you can decline or withdraw at any time. We use no advertising cookies and no third-party tracking cookies. You can set your browser to refuse or delete cookies; the functionality of this website may be limited as a result.
Web analytics (CloudWatch RUM)
With your consent, we use Amazon CloudWatch RUM (Real User Monitoring) to understand how this website performs in real browsers. It collects technical performance data — web vitals (loading, interactivity, visual stability), JavaScript errors and basic request telemetry — together with a randomly generated session identifier. We do not use it to identify you personally. RUM stores small cookies in your browser (e.g. cwr_s, cwr_u) to recognise a session. We load RUM only after you accept analytics in the consent banner; the legal basis is your consent (Art. 6(1)(a) GDPR) and, for storing information on your device, § 25(1) TDDDG. You can decline, and you can withdraw your consent at any time with effect for the future (e.g. by declining again or clearing this site's data). The data is processed by Amazon Web Services as our processor and collected via the eu-central-1 (Frankfurt) region; see the "Hosting" section for the data processing agreement.
Early-access form
You can register for early access to Tally using the form on this website. Your email address and the segment you identify with (organizer, investor or partner) are required. You may optionally provide your name, organization, event size and a message. We also store your language setting. As proof of your consent, we store a timestamp, the version of the consent text, and a salted, irreversible hash of your IP address — never your IP address in plain text. We use this data solely to contact you about Tally early access and to help shape the product. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future. The data is stored in Amazon DynamoDB in the eu-central-1 (Frankfurt) region; AWS acts as a processor (see "Hosting"). Automated email sending (e.g. via Amazon SES) is not currently active — we do not send any emails on the basis of this form at this time. Before any email sending (with double opt-in) is introduced, we will update this privacy policy in advance. We store your details until you withdraw consent or request erasure.
Web fonts (self-hosted)
For a consistent appearance we use the Bricolage Grotesque, Hanken Grotesk and JetBrains Mono typefaces. These fonts are self-hosted: the font files are bundled when the website is built and served from our own infrastructure. When the fonts are loaded, no connection is made to servers operated by Google or other third parties, and no data (in particular no IP address) is transmitted to third parties. The legal basis is our legitimate interest in a consistent presentation (Art. 6(1)(f) GDPR).