Trust Center
Everything you need to work with us
Aldor processes health data on your behalf. This is the one place for what the GDPR requires for that: the data processing agreement (AVV), our technical measures, and the full list of our subprocessors.
Four areas
What you'll find here
-
01
Security
Encryption, tenant isolation, and hosting exclusively in Germany.
View security -
02
Privacy
How we protect personal data and honour data-subject rights.
Privacy policy -
03
Agreements
The AVV (Art. 28 GDPR) and technical measures to download.
View documents -
04
Subprocessors
The full, always-current list of the providers we engage.
View list
Technology and documentation
-
Documented
Data-protection documents
Privacy notice, data-processing agreement and technical and organisational measures in the Trust Center.
-
Live
Hetzner Germany
The application and its backups are hosted by Hetzner in Germany.
-
Data centres
ISO 27001 (Hetzner)
The certification reference applies to Hetzner’s data centres.
-
Active
AES-256 encryption
Names, addresses, and health data are stored encrypted.
-
Built in
Strict data separation
Each business sees only its own data. The database itself enforces the separation.
Documents
Agreements and records
Download the current versions. You conclude the AVV after signing in.
- Data Processing Agreement (Auftragsverarbeitungsvertrag) Template under Art. 28 GDPR including technical and organisational measures. Version 1.2 · As of July 01, 2026 Download
- General Terms and Conditions (AGB) The general terms and conditions for using Aldor. Version 1.2 · As of July 16, 2026 Download
- Technical and organisational measures (TOM) The safeguards under Art. 32 GDPR at a glance. Version 1.0 · As of June 24, 2026 Download
- Privacy policy How we process personal data on the website and in the application. Version 1.3 · As of August 28, 2026 Download
- Preisanlage (price schedule) Plan prices, annual commitments, and separately billed postal delivery through Pingen. Version 1.0 · As of September 15, 2026 Download
- Auftragsformular (order form template) Blank template for preparing an order. Your confirmed order is supplied separately. Version 1.0 · As of September 15, 2026 Download
- Leistungsbeschreibung (service description) Features, plan scope, and requirements for using Aldor (Annex 1). Version 1.0 · As of September 15, 2026 Download
- Service Level Agreement (SLA) 99 % availability per calendar month, maintenance, and support terms (Annex 3). Version 1.0 · As of September 15, 2026 Download
Subprocessors
Who we engage
| Provider | Purpose | Processing location | Data categories |
|---|---|---|---|
| Hetzner Online GmbH | Purpose Hosting, Datenbank, Object Storage & E-Mail-Versand (EU-Rechenzentrum) | Processing location Deutschland (Nürnberg, Falkenstein) | Data categories Stammdaten, Gesundheitsdaten (Art. 9), Abrechnungsdaten, Dokumente, Kommunikationsdaten |
| BANKSapi Technology GmbH | Purpose Kontoinformationsdienst (Bankabgleich für Abrechnung) | Processing location Deutschland (München) | Data categories Bankverbindung, Zahlungsdaten |
| Stripe Payments Europe, Ltd. | Purpose Zahlungsabwicklung des Aldor-Abonnements | Processing location Irland | Data categories Rechnungsdaten, Zahlungsdaten |
| Google Cloud EMEA Ltd. (Vertex AI) | Purpose KI-Funktionen (Lotte-Assistent, Dokumentenerkennung); keine Speicherung der übergebenen Inhalte | Processing location EU (Frankfurt) | Data categories Zur KI-Verarbeitung übergebene Inhalte (können Gesundheitsdaten umfassen) |
| Google Ireland Limited (Google Maps Platform) | Purpose Adress-Autovervollständigung, Geokodierung & Routenberechnung | Processing location EU (Irland) | Data categories Adressen, Koordinaten |
| Apple Distribution International Ltd. (APNs) | Purpose Push-Benachrichtigungen an iOS-Geräte | Processing location Irland | Data categories Push-Token, Benachrichtigungstexte |
| Twilio Ireland Limited | Purpose SMS-Versand (optional, je Organisation aktivierbar) | Processing location Irland | Data categories Mobilfunknummern, Nachrichteninhalte |
| Pingen GmbH | Purpose Postalischer Briefversand (Druck, Kuvertierung, Zustellung; optional, je Organisation aktivierbar) | Processing location Schweiz (Zürich; Angemessenheitsbeschluss der EU-Kommission) | Data categories Empfängername und Anschrift, Inhalte der versandten Dokumente (können Gesundheitsdaten umfassen) |
This list is kept continuously up to date.