Trust Center
Everything you need to work with us
Aldor processes health data on your behalf. This is the one place for what the GDPR requires for that: the data processing agreement (AVV), our technical measures, and the full list of our subprocessors.
Four areas
What you'll find here
-
01
Security
Encryption, tenant isolation, and hosting exclusively in Germany.
View security -
02
Privacy
How we protect personal data and honour data-subject rights.
Privacy policy -
03
Agreements
The AVV (Art. 28 GDPR) and technical measures to download.
View documents -
04
Subprocessors
The full, always-current list of the providers we engage.
View list
Technology and documentation
-
Documented
Data-protection documents
Privacy notice, data-processing agreement and technical and organisational measures in the Trust Center.
-
Live
Hetzner Germany
The application and its backups are hosted by Hetzner in Germany.
-
Data centres
ISO 27001 (Hetzner)
The certification reference applies to Hetzner’s data centres.
-
Active
AES-256 encryption
Names, addresses, and health data are stored encrypted.
-
Built in
Strict data separation
Each business sees only its own data. The database itself enforces the separation.
Documents
Agreements and records
Download the current versions. You conclude the AVV after signing in.
- Data Processing Agreement (Auftragsverarbeitungsvertrag) Template under Art. 28 GDPR including technical and organisational measures. Version 2.0 · As of October 14, 2026 Download
- General Terms and Conditions (AGB) The general terms and conditions for using Aldor. Version 2.0 · As of October 14, 2026 Download
- Technical and organisational measures (TOM) The safeguards under Art. 32 GDPR at a glance. Version 2.0 · As of October 14, 2026 Download
- Privacy policy How we process personal data on the website and in the application. Version 2.1 · As of October 19, 2026 Download
- Preisanlage (price schedule) Plan prices, annual commitments, and separately billed postal delivery through Pingen. Version 2.0 · As of October 14, 2026 Download
- Auftragsformular (order form template) Blank template for preparing an order. Your confirmed order is supplied separately. Version 2.0 · As of October 14, 2026 Download
- Leistungsbeschreibung (service description) Features, plan scope, and requirements for using Aldor (Annex 1). Version 2.0 · As of October 14, 2026 Download
- Service Level Agreement (SLA) 99 % availability per calendar month, maintenance, and support terms (Annex 3). Version 2.0 · As of October 14, 2026 Download
Subprocessors
Who we engage
| Provider | Purpose | Processing location | Data categories |
|---|---|---|---|
| Hetzner Online GmbH | Purpose Hosting, Datenbank, Object Storage, E-Mail-Versand & verschlüsselte Sicherungskopien | Processing location Deutschland (Nürnberg, Falkenstein); Sicherungskopien Finnland (Helsinki) | Data categories Stammdaten, Gesundheitsdaten (Art. 9), Abrechnungsdaten, Dokumente, Kommunikationsdaten |
| BANKSapi Technology GmbH | Purpose Kontoinformationsdienst (Bankabgleich für Abrechnung) | Processing location Deutschland (München) | Data categories Bankverbindung, Zahlungsdaten |
| Stripe Payments Europe, Ltd. | Purpose Zahlungsabwicklung des Aldor-Abonnements | Processing location Irland | Data categories Rechnungsdaten, Zahlungsdaten |
| Google Cloud EMEA Ltd. (Vertex AI) | Purpose KI-Funktionen (Lotte-Assistent, Dokumentenerkennung); keine Speicherung der übergebenen Inhalte | Processing location EU (Frankfurt) | Data categories Zur KI-Verarbeitung übergebene Inhalte (können Gesundheitsdaten umfassen) |
| Google Ireland Limited (Google Maps Platform) | Purpose Adress-Autovervollständigung, Geokodierung, Routenberechnung & Kartendarstellung | Processing location Global (Google-Infrastruktur, EU-Standardvertragsklauseln) | Data categories Adressen, Koordinaten, IP-Adressen und Geräteinformationen der Nutzer |
| Apple Distribution International Ltd. (APNs) | Purpose Push-Benachrichtigungen an iOS-Geräte | Processing location Irland | Data categories Push-Token, Benachrichtigungstexte (können Namen und Nachrichtenauszüge enthalten) |
| Google Ireland Limited (Firebase Cloud Messaging) | Purpose Push-Benachrichtigungen an Android-Geräte | Processing location Global (Google-Infrastruktur, EU-Standardvertragsklauseln) | Data categories Push-Token, Benachrichtigungstexte (können Namen und Nachrichtenauszüge enthalten) |
| Pingen GmbH | Purpose Postalischer Briefversand (Druck, Kuvertierung, Zustellung; optional, je Organisation aktivierbar) | Processing location Schweiz (Zürich; Angemessenheitsbeschluss der EU-Kommission) | Data categories Empfängername und Anschrift, Inhalte der versandten Dokumente (können Gesundheitsdaten umfassen) |
| PflegeHelfer24 GmbH | Purpose Softwareentwicklung, Wartung und Support; Zugriff auf personenbezogene Daten nur im Einzelfall | Processing location Deutschland (Berlin) | Data categories Alle in der Anwendung verarbeiteten Daten |
| Aldor GmbH | Purpose Betrieb und Weiterentwicklung von Aldor im Auftrag der PflegeHelfer24 GmbH, ab 1. Dezember 2026. Nur für Verträge, die noch mit der PflegeHelfer24 GmbH bestehen | Processing location Deutschland (Berlin) | Data categories Alle in der Anwendung verarbeiteten Daten |
This list is kept continuously up to date.