Privacy Policy

Protecting your personal data is a priority for us. We process your data exclusively on the basis of the applicable legal provisions (GDPR, BDSG, TDDDG).

1. Controller

The controller responsible for data processing on this website is:
Kai-Uwe Schmidt
trading as BEL-IT
Aufhamer Straße 5a
83229 Aschau
Germany

2. Which data we process

  • Account data: email address, name, password (only as a hash), available quota
  • Optionally in your profile: signing certificate (stored encrypted) and signature lines
  • Uploaded documents and the files created from them (PDF, conversion report)
  • Details of your jobs: file name, timestamps, status
  • Log data: IP address, timestamp, requested page, technical details of errors

3. Purposes and legal bases

  • Providing the service, your account and the conversion of your documents: performance of the terms of use (Art. 6(1)(b) GDPR)
  • Error analysis when one of your conversions fails (see section 4): performance of the terms of use (Art. 6(1)(b) GDPR)
  • Secure and stable operation, defence against misuse and attacks based on log data: legitimate interest (Art. 6(1)(f) GDPR)
  • Compliance with legal obligations, e.g. retention of billing data: legal obligation (Art. 6(1)(c) GDPR)

4. Uploaded documents

We process your documents only to convert them. The uploaded document, the result and the conversion report are deleted automatically no later than 24 hours after the upload, also if the conversion fails. Please download your results in time. Passwords and certificate data you provide for a job are stored encrypted and deleted as soon as the job is finished.

If a conversion fails, the controller may open the document within this period solely to find and fix the error in your job. Your documents are not passed on to third parties and are not used as test material or for any other purpose without your explicit consent.

After the deletion, your job list keeps an entry with file name, timestamps and status until you delete your account.

5. Retention periods

  • Uploaded documents and results: no more than 24 hours (section 4)
  • Account data and job list: until you delete your account, which you can do yourself at any time in your profile
  • Log data: no more than 24 hours; logs from before version 1.1.7: no more than 30 days
  • Failure data that an administrator saves after a failed conversion to analyse the error (log lines and technical error details, no document and no document text): no more than 30 days
  • Data subject to statutory retention periods: until these periods expire

6. Recipients and processors

The service runs on Microsoft Azure in data centres in the EU (France). Microsoft processes the data as a processor under Art. 28 GDPR for hosting, database, file storage, operational metrics (Application Insights) and sending emails (Azure Communication Services, data stored in Germany). No transfer to countries outside the EU is intended; should Microsoft access the data in an individual case, this is safeguarded by the EU-U.S. Data Privacy Framework and standard contractual clauses.

Beyond that, we only pass on your data if we are legally obliged to or if you have given your explicit consent. We do not embed third-party content: fonts are loaded from our own server, and there are no analytics or advertising services. Businesses whose documents contain personal data of third parties conclude a data processing agreement with us.

7. Cookies

We only use technically necessary cookies that are required for operation and need no consent (Section 25(2) No. 2 TDDDG): a cookie for your sign-in, cookies that protect forms against misuse (antiforgery) and a cookie that keeps your connection on the same server for the status display.

8. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw any consent at any time with effect for the future. Please contact the controller named above.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

9. Security

We use technical and organisational measures to protect your data against manipulation, loss, destruction or unauthorised access, including encrypted connections (TLS), encrypted storage of certificates and passwords, and separate, restricted access rights for each service.

10. Changes to this privacy policy

We update this privacy policy when the service or the legal situation changes. The current version is always available on this page.

Last updated: November 7, 2026