Privacy Policy
Last updated: 9 October 2026
This policy covers personal data processed through Cancilico’s website, products and services, and recruitment.
Controller and data protection officer
Cancilico GmbH, Tatzberg 47, 01307 Dresden, Germany. Contact: privacy [at] cancilico.com.
Our data protection officer is MAMS Consulting GmbH, Landsberger Straße 155, 80687 Munich, Germany. Contact: datenschutz [at] pri-com.de.
What we process and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Delivering and securing our website and services | Technical connection data (IP address, time, requested resource, browser), authentication events, error reports | Legitimate interest in reliable, secure services (Art. 6(1)(f) GDPR) | As long as needed to investigate faults, misuse or incidents |
| Answering inquiries (contact form, email, LinkedIn, recruitment platforms) | Name, contact details, organization, message, correspondence | Pre-contractual steps (Art. 6(1)(b)); otherwise legitimate interest in responding (Art. 6(1)(f)) | Until the inquiry is resolved; commercial correspondence 6 years |
| Feedback, complaints and product issues | Name, contact details, organization, product and version, description of the issue, attachments such as screenshots, related account or case identifiers, correspondence, investigation and resolution records | Contract where the report concerns our services (Art. 6(1)(b)); otherwise legitimate interest in investigating and correcting issues, improving our products and documenting this in our quality management system (Art. 6(1)(f)) | 10 years after the last release of the product concerned, or longer if the product’s lifetime is longer |
| Accounts and service emails (activation, confirmations, access links, reminders) | Name, email, organization, account identifiers, preferences, authentication data | Contract (Art. 6(1)(b)); for an organization’s users, legitimate interest in serving that organization (Art. 6(1)(f)) | While the account exists; then only what statutory obligations or claims require |
| Payments, invoices and contract evidence | Contact and billing details, tax information, purchases, amounts, payment references, accepted document versions and timestamps | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c), § 147 AO, § 257 HGB); legitimate interest in documenting agreements (Art. 6(1)(f)) | Invoices and accounting vouchers 8 years; other contract evidence until the end of the third year after completion |
| Usage analytics across our websites and applications (self-hosted Umami) | Pages visited, referrer, device and browser type, product events such as checkout started or module completed; no cookies or device storage, no form content, case or patient data | Legitimate interest in understanding and improving our services (Art. 6(1)(f)) | Event records without IP addresses, kept for trend analysis |
| c.vision workspaces and support | Account preferences, user activity, records of authorized support access | Contract (Art. 6(1)(b)); legitimate interest in accountability (Art. 6(1)(f)) | While the workspace exists, at most 3 years per audit record; records needed to investigate a complaint or product issue are kept with that record |
| Store orders and reduced-rate eligibility | Buyer and attendee details, purchases, account links; for reduced rates, the eligibility decision, issuer, dates and file fingerprint | Contract (Art. 6(1)(b)); legitimate interest in administering organizational purchases and verifying eligibility (Art. 6(1)(f)) | Proof documents deleted after review; eligibility records 12 months |
| Live training via Zoom | Attendee details for Zoom registration, access to personal session links; Zoom processes name, audio, video and chat you share | Contract (Art. 6(1)(b)) | As for orders and accounts |
| Waiting lists | Email address, selected course | Pre-contractual step you request (Art. 6(1)(b)) | Until notification, your removal request or course discontinuation |
| Training recordings | Lecturer and slides; attendee contributions only with consent | Contract with lecturers; consent for attendees (Art. 6(1)(a)) | Raw recordings while editing; published contributions until consent is withdrawn |
| MyeloLEARN learning | Account and institution, subscriptions, enrolments, progress, quiz answers, scores, response times | Contract (Art. 6(1)(b)); for organization-purchased access, legitimate interest (Art. 6(1)(f)) | While the account exists; ending a subscription does not delete learning history |
| MyeloLEARN marketing emails | Name, email address | Consent (Art. 6(1)(a)) | Until you withdraw consent |
| Recruitment | Application documents, contact details, qualifications, interview notes, correspondence | Employment decision (§ 26(1) BDSG); defending claims (Art. 6(1)(f)) | 6 months after rejection |
| Candidate pool | Application documents | Consent (Art. 6(1)(a)) | Until withdrawal, at most 2 years |
Where we receive your details from your organization, a platform or a reference you authorize, we inform you when we first contact you. Information marked as required is needed to provide the service or assess an application.
Deleted data remains in backups until the backup rotation removes it.
Notes
Patient data. Users and customers must not enter directly identifying patient information into our products and services. The customer is responsible for an appropriate legal basis, notices, permissions, pseudonymization and access controls. Where we process data on an institutional customer’s behalf, the customer is the controller and its data processing agreement applies; direct requests about that data to the customer.
Feedback and complaints. Please do not include directly identifying patient information in feedback, screenshots or attachments. Where a report concerns case data in c.vision, we access that data only as far as needed to investigate the issue, on behalf of the customer.
c.digitize. The iPhone app keeps captures, upload queues and its sign-in credentials on your device until you delete them or remove the app; camera and photo access are controlled in iOS settings. Imported images may keep their existing metadata, including location. Diagnostics are shared only when you send them to us.
Training recordings. Including your contributions in a published recording is optional and does not affect attendance. If you withdraw consent, we stop future use and remove your contribution from recordings under our control.
Applications. We receive applications by email and, for roles advertised there, through LinkedIn or Indeed, which process your data under their own privacy notices. We may also receive information from references you authorize.
LinkedIn. For statistics about our LinkedIn company page (Page Insights), we and LinkedIn Ireland Unlimited Company are joint controllers, based on our legitimate interest in understanding our audience (Art. 6(1)(f)). LinkedIn bears primary responsibility under its Page Insights Joint Controller Addendum, and you can exercise your rights with LinkedIn directly. The LinkedIn posts shown on our homepage are copied to our own servers; viewing them sends no data to LinkedIn.
Automated decisions. We do not make decisions with legal or similarly significant effects solely by automated means. c.vision produces AI-assisted analysis results for authorized users to review and correct; these results support the user’s own assessment and do not by themselves produce legal or similarly significant effects on an individual.
Providers and international transfers
- Hetzner Online GmbH (Germany): hosting, storage and self-hosted monitoring for our products and internal services.
- Netlify, Inc.: homepage hosting and contact forms.
- Cloudflare, Inc.: DNS, content delivery and security services, processing technical connection data such as IP addresses.
- Google Ireland Limited (Google Workspace): email, calendars and documents, including inquiries and applications.
- Resend: service and marketing emails.
- Stripe: payment processing and invoices. Card numbers do not reach our systems.
- Zoom: live training and recordings.
- Tax advisers: accounting.
Providers act on our instructions under data processing agreements; some, including Stripe for certain payment activities, are independent controllers. Platforms such as LinkedIn process data under their own privacy notices. We disclose data to authorities where the law requires it, or to advisers where needed for legal claims.
Some providers process data outside the European Economic Area, including in the United States. Where required, we rely on an adequacy decision or appropriate safeguards such as the European Commission’s standard contractual clauses. You can request a copy of the applicable safeguards.
Your rights
Subject to the applicable requirements, you may request access, correction, erasure, restriction of processing, or receipt or transfer of data you provided in a portable format (Arts. 15–20 GDPR).
You may withdraw consent at any time, without affecting the lawfulness of earlier processing. You may object to processing based on legitimate interests on grounds relating to your situation (Art. 21); we then stop unless overriding grounds or legal claims justify continuing. You may object to direct marketing at any time.
Contact us or our data protection officer using the details above. You may complain to a supervisory authority, including the Saxon Data Protection and Transparency Commissioner: www.datenschutz.sachsen.de.
Changes to this policy
We update this policy when our services or processing change. You may request earlier versions using the contact details above.