Privacy Policy

Last updated: 19 October 2026

This is a translation for convenience. The German version (Datenschutzerklärung) is legally binding.

1. Controller

The controller for the processing of personal data within the meaning of the GDPR is:

This policy applies to the website hrarchitecturestudio.com (incl. www.) and to the tools of the HR Architecture Studio brand:

• Process Architecture Studio (PAS) – pas.hrarchitecturestudio.com
• Job Architecture Studio (JAS) – jas.hrarchitecturestudio.com
• Data Architecture Studio (DAS) – sfwb.hrarchitecturestudio.com
• Workforce Reporting Studio (WRS) – hrm.hrarchitecturestudio.com

2. General

We process personal data only to the extent necessary to provide the website, to handle enquiries and to deliver our services. The legal bases are in particular Art. 6(1)(b) GDPR (contract or pre-contractual measures), Art. 6(1)(f) GDPR (legitimate interest) and, where obtained, Art. 6(1)(a) GDPR (consent). No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

3. Visiting the website

When you access the website and the tools, the following data is processed for technical reasons:

• IP address of the requesting device
• date and time of the request, requested address
• amount of data transferred and status code
• user agent (browser, operating system) and referrer URL

Traffic is routed through the Cloudflare network (see section 7), which secures the connection and protects against attacks. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation). Server access logs are deleted after 30 days at the latest. There is no tracking and no audience measurement.

4. Contact form

If you write to us via the contact form, we process your name, email address, optionally your company, the selected tools and your message in order to answer your enquiry. The details are sent by email to our mailbox (delivered via Cloudflare) and are not stored in a database. The legal basis is Art. 6(1)(b) GDPR (pre-contractual enquiry) or Art. 6(1)(f) GDPR (legitimate interest in answering). We delete the details once the enquiry has been fully handled, unless statutory retention obligations apply. To prevent abuse, the number of requests per IP address is briefly limited.

5. Using the tools

When you use the tools (after we have granted access), we additionally process:

• account data: email address, name, role, hashed password (bcrypt or Argon2id)
• session data for sign-in (HTTP-only cookies) and security-related logs (e.g. sign-in attempts)
• content you enter or upload yourself (e.g. process descriptions, job profiles, SAP SuccessFactors configuration files, comments and decisions)
• input to AI features (see section 8)

Sign-in with Microsoft: In some tools (including Data Architecture Studio and Job Architecture Studio) you can sign in with your Microsoft account (Microsoft Entra ID). Microsoft then provides us with your name, email address and an account identifier; we never learn your Microsoft password.

System emails (e.g. invitations, password resets) are sent via Cloudflare or Microsoft 365 (Exchange Online), depending on the tool.

The legal basis is Art. 6(1)(b) GDPR (terms of use) and Art. 6(1)(f) GDPR (security and operation). If you enter personal data of third parties (e.g. your employees) into the tools, you are the controller for that data; on request we conclude a data processing agreement (Art. 28 GDPR).

6. Retention

• Account data: until the account is deleted or use ends.
• Content: as long as the account is active; in backups until they are routinely overwritten.
• Audit logs: 90 days by default, longer on request (e.g. for compliance reasons).
• Server access logs: 30 days at most.

7. Hosting, recipients and processors

The website and the tools run on the operator's own server infrastructure in Germany. We use the following service providers as processors (Art. 28 GDPR):

On request we will tell you which AI provider is active for your tenant.

8. AI features

Some features send your input and the related business context (e.g. process or job descriptions) to the respective AI provider in order to generate suggestions. According to the providers' terms, data submitted via the API is not used to train their models; by default OpenAI retains it for up to 30 days for abuse monitoring and then deletes it. AI results are marked as suggestions and must be reviewed by a specialist. Please do not enter special categories of personal data (Art. 9 GDPR, e.g. health data) and, where possible, no employee names into AI features.

9. Cookies and local storage

The website sets no tracking, analytics or advertising cookies and embeds no third-party pixels. The following are technically necessary and therefore permitted without consent (Section 25 (2) no. 2 TDDDG):

• session and security cookies of the tools (sign-in, CSRF protection)
• your language choice (German/English) stored in the browser when you switch languages
• security cookies set by Cloudflare where required to fend off attacks

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You may withdraw any consent at any time with effect for the future (Art. 7(3) GDPR). An informal email to [email protected] is sufficient.

11. Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

12. Data security

We protect your data with technical and organisational measures, including TLS encryption in transit, hashed passwords, role and tenant separation, limits on sign-in attempts, regular backups and audit logs.

13. Changes

We update this policy when our processing changes. The version published here applies.