Privacy Policy

1. Controller and data protection officer

The controller within the meaning of the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act is:

M-Tech Support, Inhaber Tobias Michel
Bahnhofstraße 51, 66892 Bruchmühlbach-Miesau, Germany
Represented by: Tobias Michel (owner)
E-mail: info@truststar.eu

No external data protection officer has been appointed as the statutory thresholds (Art. 37 GDPR, Section 38 BDSG) are not met. Data protection requests are handled personally by the owner at info@truststar.eu or by post marked “confidential – data protection”.

2. Terms and principles

Personal data means any information relating to an identified or identifiable natural person (Art. 4(1) GDPR), such as name, e-mail address or IP address. Processing means any operation performed on such data, including storage, retrieval and deletion.

We process personal data exclusively where a legal basis exists. As a rule this is:

• Art. 6(1)(a) GDPR – your consent (e.g. statistics cookies, newsletter),
• Art. 6(1)(b) GDPR – performance of a contract or pre-contractual measures (e.g. company account, support request),
• Art. 6(1)(f) GDPR – legitimate interest in the secure and economical operation of the platform (e.g. server logs, abuse prevention).

No automated decision-making including profiling within the meaning of Art. 22 GDPR takes place.

3. Server logs and hosting

When you access a page, your browser technically transmits data to our web server. We store the following in so-called server log files:

• IP address in shortened or hashed form (depending on hosting configuration; we cannot trace it back to your connection),
• date and time of access,
• resource or page requested,
• amount of data transferred and HTTP status code,
• referrer URL (previously visited page),
• browser used and its version, and the operating system.

Purpose: ensuring trouble-free operation, defence against attacks (e.g. mass requests, form injection attempts), load management. Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in secure operation. Retention: 7 days, then automatic deletion; in case of a specific security incident, until the investigation is complete.

The website runs on servers of Hostinger International Ltd., 61 Lordou Vironos str., 6023 Larnaca, Cyprus (EU) – a hosting provider within the European Union (EU data centre). A data processing agreement under Art. 28 GDPR exists with the provider (Data Processing Addendum, see hostinger.com/legal/dpa). All connections are TLS-encrypted (HTTPS).

4. Using search and profiles

Company search works without an account and without cookies. When you enter a search term it is transmitted as a parameter to our server interface api/customer-preview.php?action=search and used solely to query the database. No association with your person is made and no search profile is created.

When you open a company profile we transmit the numeric identifier of the company (?action=reviews&id=…). Again: no personal data of the visitor is stored beyond the access data described in section 3.

For performance reasons and to protect the Google interface, query results are briefly cached (Cache-Control: 5 minutes). This cache contains company data only, never visitor data.

5. Submitting reviews

When you publish a review we process the following:

• Display name – shown publicly. You may choose a pseudonym, e.g. “Sabrina K.”,
• Star rating and review text – shown publicly,
• E-mail address – used for verification and for contacting you with queries; it is never published,
• Time of submission – shown publicly as a date,
• optional: order or invoice number – only to verify the order, not public,
• hashed IP address at the time of submission (SHA-256 salted hash, not reversible) – for abuse prevention, deleted after 30 days.

Purpose: publishing your opinion as a contribution to market transparency, checking compliance with our Review Guidelines, defence against legal claims. Legal basis: Art. 6(1)(a) GDPR (your explicit confirmation in the form) and Art. 6(1)(f) GDPR for abuse prevention.

Confirmation flow for reviews without a code (website or widget): your review is not stored publicly at first (status “awaiting confirmation”). The company receives a notification containing only your display name, the date and your short note “What was it about?” (e.g. “painting work”, “purchase”) – text and stars remain hidden. The reference helps the business identify you without knowing your review in advance. If the business confirms your customer relationship, the review is published and only then becomes readable for the company; if it declines, the review stays unpublished and you are informed (if you provided an e-mail address). This way nobody can filter reviews by content – and businesses are protected against reviews from non-customers.

Reviews with a review code (QR card) count as verified immediately because the code is tied to a specific order; they are published straight away.

In both cases the company never receives your e-mail address.

Self-management of your review: after submitting you receive a confirmation e-mail containing a personal management link (also shown on the thank-you page after scanning a review card, provided you entered your e-mail address there). Via this link you can edit your review within 30 days (stars, subject and text – as long as the company has not replied publicly), withdraw it at any time, or attach a note once the deadline has passed, which is published as such. Technically we store a random access token known only to you (confirm_token, 48 hex characters) with the review; it is the only proof of access – therefore treat the link like a password. The token is deleted when the review is withdrawn and for withdrawn, declined or moderated contributions. Edits are marked publicly as “edited”; the text before the change is stored internally (previous_comment) solely so that the original content can be checked in case of reports or appeals – it is never displayed. Without the link, or informally, we will also delete your review at any time: loeschung@truststar.eu. After a deletion we remove the entry and the associated e-mail address immediately, unless a retention obligation applies – for example because a review or court procedure is ongoing.

Review cards, QR codes and short links: To support offline review collection, we provide companies with review cards bearing individual codes. The QR code points to our review URL containing the code, or to a short-link domain (e.g. tsta.eu/CODE) that merely redirects to that URL. When it is called, we check the validity and redemption status of the code; the code is pseudonymous and cannot be linked to a person without additional data. Access is treated technically like any other page call (server logs per section 3, rate limits against abuse); no additional trackers or cookies are set. Codes are stored assigned to the respective company and deleted when the account expires or is deleted.

6. Company accounts and profile management

For companies that claim a profile or book a paid plan we process:

• company name, address, industry, website, Google Place ID,
• name, business e-mail address and phone number of the contact person,
• access credentials in hashed form (bcrypt/argon2, no plaintext passwords),
• texts of public replies to reviews,
• invoice and contract data for paid plans,
• proof of business for the ownership check (e.g. business registration, commercial register excerpt, trade card or a recent business invoice showing the company name) – uploaded as PDF or photo and, since October 2026, also as several files (e.g. one photo per page, maximum five files per application). These files are stored in a web-blocked area of our server; only our review team can access them, they are never displayed publicly and are not passed on to third parties.

Legal basis: Art. 6(1)(b) GDPR (performance of contract or pre-contractual measures) and Art. 6(1)(f) GDPR for verifying ownership. Retention: for the duration of the contractual relationship; afterwards according to commercial and tax retention periods (Section 147 AO, Section 257 HGB) usually 6 to 10 years, limited to documents subject to retention.

Two-factor authentication: Administrator accounts are protected by mandatory two-factor authentication (TOTP, RFC 6238); company accounts can enable it optionally. For this we store the server-side Base32 secret, hashed one-time recovery codes (SHA-256), the setup and confirmation timestamps, and failed login attempts (account/e-mail, time, IP hash) for a 15-minute lock window. Legal basis: Art. 6(1)(b) and (f) GDPR (access protection, account integrity).

Invoicing, payment reconciliation and dunning (Lexware Office): For paid plans and card orders we create invoices and dunning documents electronically in our accounting system Lexware Office (provider: Haufe-Lexware GmbH & Co. KG, Freiburg, Germany). Processing takes place in Germany within the framework of a data processing agreement under Art. 28 GDPR. Data transferred: company name, billing address, business e-mail address, phone number, name of the contact person, VAT ID (if provided by you), plan/billing period, order and amount data, and the payment status. Purpose: proper invoicing (Section 14 German VAT Act), receivables management, dunning and payment reconciliation. Legal bases: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (commercial and tax retention, Section 147 AO, Section 257 HGB). Generated invoice PDFs are additionally stored in a web-blocked area of our server; invoices may be delivered to you by e-mail. Incoming status notifications (webhooks) are verified cryptographically (RSA signature). Retention: 6 to 10 years in accordance with statutory retention periods.

Analytics and exports in the company portal: Sentiment, topic and competitor analyses as well as CSV/PDF exports are calculated entirely locally on our servers from the review data of the respective company; no external analysis or tracking services are involved. Exports contain only data of the own company account.

Company profiles from open geodata (OpenStreetMap)

We source part of the company master data (name, address, category, website) from the free geodatabase OpenStreetMap (OSM) (© OpenStreetMap contributors, license ODbL). Import is two-stage: raw data is reviewed internally; a profile is published only after explicit approval by us and is then clearly labelled on the profile page (© notice, data as-of date, link to claim or request removal).

Purpose and legal basis: providing a regional review directory and making it easier for businesses to claim their profile; legal basis is Art. 6(1)(f) GDPR (legitimate interest in a complete, up-to-date directory; the data comes from a publicly accessible source). We deliberately do not import e-mail addresses or phone numbers from OSM and the data is not used for advertising outreach.

Information pursuant to Art. 14 GDPR: the source is the OpenStreetMap database (openstreetmap.org); we store name, address, category, website, import date and OSM identifier. The data remains until the business claims the profile (account data then applies), requests removal (prompt deletion or blocking), or is found to no longer exist. Objection: any business may object to being listed at any time without giving reasons – informally via the contact form or by e-mail to the address in the imprint; removal usually happens within 7 days.

Claiming a profile: if you use the “claim this profile" link on your profile page, we process your form details (name, e-mail address, optionally phone number and message) solely to verify your entitlement and, after approval, to set up your account access. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures / contract) and Art. 6(1)(f) GDPR (protection against unauthorised takeovers). The request is documented until the review is concluded and then deleted under the retention periods applicable to contact requests; if you submit proof after approval (e.g. a business registration), the section “Company verification" applies.

Newsletter (double opt-in)

If you wish, we will inform you about new features, practical tips and product updates in a newsletter approximately once a month. You can sign up via an explicit, optional checkbox in the profile application or in the company portal. The newsletter only becomes active after you have confirmed it via a separate email (double opt-in) – without confirmation no newsletter email is sent at all and the pre-registration expires.

Legal basis: Art. 6(1)(a) GDPR (consent). We document your confirmation with a timestamp and the sign-up path as proof of consent (Art. 7(1) GDPR). Delivery runs via our own mail server in the EU – no third-party provider, no transfer to advertising networks, no tracking in the emails except the unsubscribe link required for revocation.

Revocation: you may revoke your consent at any time with effect for the future – via the toggle in the company portal (dashboard → settings) or via the unsubscribe link at the end of every newsletter email (no login required). After revocation the status is set to “unsubscribed”; the consent record remains stored for documentation purposes.

7. Google Business Profile API

To display the Google overall rating in company profiles we fetch, via the official Google Business Profile API (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), exclusively data that the respective company itself has made public:

• name of the company profile,
• overall rating and number of ratings,
• publicly visible review texts, display names of reviewers, relative time information and star rating – exclusively for internal analysis (sentiment / AI analysis in the company dashboard); individual Google reviews are not republished.

The fetched data is stored in a cache table (google_reviews_cache) on our own servers in the EU. Only the overall score and the number of ratings are displayed publicly – clearly labelled as the Google rating and linked to the Google profile. If the cache is older than 30 days, the Google rating is no longer shown (no stale data). Fetching occurs at fixed intervals (daily by default) or at the express request of the company. When visiting a TrustStar page no connection to Google servers is established; no Google fonts, scripts or images are loaded and no Google cookies are set. The Google icon is displayed as a local vector graphic.

Legal basis: Art. 6(1)(f) GDPR – legitimate interest in a complete and current presentation of publicly accessible company reviews. Use of the interface is additionally subject to the Google APIs Terms of Service and the Google Privacy Policy; no linkage with a Google account takes place on our side.

If you would like a Google review deleted, please contact Google directly, as we only hold a copy for internal analysis and do not publish review texts. In addition, we remove the copy from our cache as soon as you provide proof of deletion; at the latest at the next synchronisation the entry will no longer be imported.

8. Contact form and e-mail

When you contact us by form, e-mail or phone we process the details you provide (name, e-mail address, possibly phone number, company and message content) to handle your request. Legal basis: Art. 6(1)(b) GDPR for contractual or pre-contractual requests, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering) or Art. 6(1)(a) GDPR insofar as you consented in the form.

We delete the data as soon as your request is finally resolved and no retention obligations conflict – usually after 12 months. For notices under Section 10 DDG a period of 3 years from completion of the review applies so that we can demonstrate our decision practice.

Form messages are sent via our own mail server in the EU; no US transactional service is used.

9. Cookies and similar technologies

We use cookies and browser storage (localStorage). Strictly necessary entries serve exclusively to deliver and secure the website; they are stored on the basis of Art. 6(1)(f) GDPR and Section 25(2) no. 2 TDDDG. All other entries are set only with your consent pursuant to Art. 6(1)(a) GDPR, Section 25(1) TDDDG.

No cookies are set by advertising networks, social media plugins, map services or external font providers. All icons, graphics and the logo are locally embedded vector graphics.

10. Consent, withdrawal and cookie settings

On your first visit a notice appears in which you can activate or reject statistics and marketing entries individually. Your decision is stored locally in your browser with a timestamp (local storage entry “ts_consent_v1”) so that the notice does not reappear and your choice remains traceable and changeable at any time. At present we do not process any data beyond technically necessary cookies that would require consent; as soon as statistics or marketing functions are activated, we will additionally log your consent server-side (demonstration of consent under Art. 7(1) GDPR).

You can withdraw your consent at any time with effect for the future – either via the Cookie Settings page or by deleting the corresponding entries in your browser. The lawfulness of processing carried out until then remains unaffected.

11. Recipients and processors

Your data is disclosed to third parties only insofar as legally permitted or required. Categories of recipients are:

• Hosting and infrastructure providers – Hostinger International Ltd., Larnaca, Cyprus (EU): servers, backups, e-mail dispatch – processing under Art. 28 GDPR,
• the company concerned – only the non-personally-identifying review details named in section 5,
• Payment service providers, tax advisors and accounting – including our invoicing system Lexware Office (Haufe-Lexware GmbH & Co. KG, Freiburg, Germany; data processing agreement under Art. 28 GDPR) for invoicing, payment reconciliation and dunning – exclusively for paid plans or card orders,
• legal advisors and courts – in case of disputes or official information requests,
• maintenance providers with possible access to systems under a data processing agreement.

No data is sold, transmitted to credit agencies or used for third-party advertising.

12. Transfers to third countries

As a rule, no personal data is transferred to countries outside the EU/EEA. Our servers and providers are located in Germany or within the EU.

Exception: when fetching publicly visible Google rating data via the Google Business Profile API, processing by Google Ireland Limited may occur; according to Google, onward transfer to Google LLC in the USA cannot be excluded. The legal basis is Art. 49(1)(g) GDPR in conjunction with Art. 6(1)(f) GDPR, as the information originates from a publicly accessible source. Google is certified under the EU-US Data Privacy Framework; standard contractual clauses also exist. We transmit exclusively the Place ID of the company, never data of visitors to this website.

13. Retention and deletion

Note for companies: embedding the widget on your own website

If you, as a company, embed the TrustStar review widget on your website, you are the controller for the embedding (Art. 24 GDPR). When the widget loads, widget content is delivered from our servers (Germany/EU) to your visitors; technically necessary connection data is processed (among others IP address in shortened or hashed form, time, page). The legal basis is Art. 6(1)(f) GDPR (legitimate interest in displaying your own customer reviews). A ready-to-copy module for your privacy policy (German wording for German sites):

“Diese Seite bindet das Bewertungs-Widget der TrustStar (M-Tech Support, Inhaber Tobias Michel, Bahnhofstraße 51, 66892 Bruchmühlbach-Miesau) ein. Beim Laden werden Widget-Inhalte von Servern der TrustStar in Deutschland/EU geladen; dabei werden technisch notwendige Verbindungsdaten (u. a. IP-Adresse in gekürzter bzw. gehashter Form, Zeitpunkt, aufgerufene Seite) verarbeitet. Rechtsgrundlage ist Art. 6 Abs. 1 lit. f DSGVO – berechtigtes Interesse an der Darstellung eigener Kundenbewertungen. Weitere Informationen: truststar.eu/datenschutz.”

You can find the current module at any time at truststar.eu/datenschutz#widget-einbindung.

14. Your rights

You have the following rights with regard to your personal data:

• Access (Art. 15 GDPR) – whether and which data we process, for what purposes, with which recipients and for how long,
• Rectification (Art. 16 GDPR) – correction of inaccurate or completion of incomplete data,
• Erasure (Art. 17 GDPR) – e.g. if the purpose ceases or you withdraw consent,
• Restriction of processing (Art. 18 GDPR) – e.g. while an objection is being reviewed,
• Data portability (Art. 20 GDPR) – provision in a structured, common, machine-readable format,
• Objection (Art. 21 GDPR) – to processing based on legitimate interests, for reasons arising from your particular situation,
• Withdrawal of consent (Art. 7(3) GDPR) – at any time with effect for the future.

To exercise these rights an informal message to datenschutz@truststar.eu or to the address in the Legal Notice suffices. We answer free of charge within one month; in justified cases the period is extended by two further months, about which we will inform you. For identification we may request additional details – but never copies of identity documents by e-mail unless legally required.

15. Right to complain to a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence, place of work or place of the alleged infringement (Art. 77 GDPR). Responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz
Hintere Bleiche 34, 55116 Mainz, Germany
www.datenschutz.rlp.de

16. Security and incident reporting

We take technical and organisational measures under Art. 32 GDPR, in particular: exclusive TLS encryption, hashed passwords, prepared SQL statements (no string concatenation), access limited to necessary staff, encrypted backups, logging of administrative access, two-factor authentication for administrator accounts (TOTP; optional for company accounts), cryptographic signature verification of incoming webhooks, and regular updates of components. Our interfaces are rate-limited against mass requests and injection attempts.

We report personal data breaches to the supervisory authority within 72 hours of becoming aware and inform data subjects where there is a high risk to their rights and freedoms (Art. 33, 34 GDPR).

17. Currency and changes to this declaration

This privacy policy is currently valid and dated 28 September 2026. Further development of our website or changed legal or official requirements may make adaptation necessary. The current version is always available at truststar.eu/datenschutz.html (German, binding). Registered companies are additionally informed of essential changes by e-mail.