Privacy Policy

Version: 14 October 2026 (edition 3.7 for the REGULARUS platform) · Convenience translation - only the German version is binding.

1. Overview

This policy describes which personal data we process when you use the REGULARUS platform: questionnaire, fixed price, customer account, documents, ordering and delivery. Personal data is any data by which you can be personally identified. For the safety assessment we mainly need product data. We process personal data only insofar as it is necessary for the account, the order, the invoice and communication, or insofar as it is contained in your documents.

2. Controller

CONIUNCTA GmbH
Breslauer Straße 350
90471 Nuremberg
Germany

Phone: +49 911 47715370
Email: regularus@coniuncta.com

REGULARUS is a brand of CONIUNCTA GmbH.

3. Hosting and Storage

The platform runs on Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (Cloudflare Workers, D1 database, R2 file storage). The database and files are stored in data centres in the European Union. The application itself runs at the nearest location of the Cloudflare network, so processing outside the EU may occur.

We have a data processing agreement with Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR); in addition, standard contractual clauses apply (Art. 46(2)(c) GDPR).

The legal basis is Art. 6(1)(b) GDPR insofar as the processing serves the initiation or performance of a contract. Otherwise we rely on Art. 6(1)(f) GDPR, our legitimate interest in secure and reliable operation.

4. Connection Data

When you access the platform, Cloudflare processes technically necessary connection data: IP address, time, requested address, browser and operating system. This serves to deliver the pages and to defend against attacks. The logs of our application contain neither the content of your documents nor personal data. Separately, to protect against abuse, we store your IP address for about one minute at sign-in and otherwise, for example when forms are submitted, when you make your choice in the banner, for price queries via the interface and when the verification page is accessed, a hash of your IP address for at most two days. The legal basis is Art. 6(1)(f) GDPR.

5. Cookies

We use technically necessary cookies without which the platform does not work (Section 25(2) No. 2 TDDDG). We set further cookies only with your consent (Section 25(1) TDDDG). You make your choice in the banner on your first visit. You can change it at any time via "Cookie settings" in the footer.

The Google cookies (_ga, ga, gcl) apply to the entire domain coniuncta.tech. Our other services on this domain, such as ANALYSUS and NUTRITUS, can also read and use them; their own privacy notices apply there. As a result, your browser has the same identifier in the statistics of all these services, and we can recognise that the same browser has visited several of our services. REGULARUS only reads and sets these cookies with your consent in our banner. If you withdraw it, we delete them for the entire domain, i.e. also for our other services.

6. Questionnaire and Fixed Price

We store your answers in the questionnaire together with a random identifier. This includes, for example, product type, number of varieties, markets and the location of your company. From this we calculate your fixed price, and you can continue later. We do not need a name for this.

When you click "Start for free", we freeze your answers, package and price for 30 days. After you sign in, we assign them to your customer account.

If you have received a personal code from us, for example for an introductory offer, your browser keeps the code from the link in the cookie rg-code until you answer the first question, for at most 60 days. After that we store with your questionnaire that and when you applied and redeemed it. The code is assigned to you so that only you receive the benefit and we can show it on your order.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures). We delete questionnaires without a customer account 60 days after the last change.

6a. Price Queries via the Interface

If you, or an assistant acting on your behalf, request a price or the list of required documents via our interface (at /api/v1 or via our MCP server), we use the product details transmitted, such as product type, number of recipes and varieties, markets and the seat of the company, only for the response and do not store them. We do not need names or contact details for this. For our statistics we count the requests per day, type of request and result without reference to any person. Section 4 applies to protection against abuse. A questionnaire under section 6 is only created when you open the link from the response and confirm your details. The legal basis is Art. 6(1)(b) GDPR (enquiry prior to a contract), and Art. 6(1)(f) GDPR for protection against abuse.

6b. Offer as PDF by Email

If you request your offer as a PDF by email on the price page, we store your email address, the language, the reference to your questionnaire with the frozen fixed price (package, add-ons, price, price list, valid for 30 days) and the times of request, sending (to you and to our team), confirmation and objection. We send you the offer as a PDF with a link to continue your questionnaire; we store this link only as a hash. If you open your questionnaire via this link, your address counts as confirmed. We may then contact you personally by email to clarify open questions about your offer. You can object to this at any time, via the link in every email or by replying to regularus@coniuncta.com. If you did not request the offer yourself, ignore the email; we will then not contact you.

To protect against abuse, we check the form with Cloudflare Turnstile; it is only loaded when you open the form. Cloudflare processes technical information about your browser and your IP address to detect automated requests. We also limit the number of requests per connection and per address; section 4 applies.

The legal basis is Art. 6(1)(b) GDPR (enquiry prior to a contract), and Art. 6(1)(f) GDPR for the personal follow-up and protection against abuse. Our legitimate interest lies in answering questions about your offer and preventing misuse of the form.

7. Customer Account and Sign-in

For the customer account we process your email address and the name of your company or your name. You sign in without a password: we send you a sign-in link that is valid for 15 minutes. The legal basis is Art. 6(1)(b) GDPR.

Your account remains as long as you use it or an order is running. On request we delete it, insofar as no retention obligations prevent this (section 18).

8. Documents and Order Processing

For your order you upload documents, for example:

• formulations
• data sheets
• certificates
• label drafts
• photos

These documents may contain personal data, such as names of contact persons.

We store the documents encrypted in file storage in the EU and use them exclusively for your order and our legal obligations. Only the members of our team involved in the order and the safety assessor have access. Every access is logged. We do not use your documents to train AI models. The legal basis is Art. 6(1)(b) GDPR.

For invoices, payments and legal obligations we additionally process:

• billing address
• VAT identification number
• order data

The legal basis is Art. 6(1)(b) and (c) GDPR. We verify the VAT numbers of companies in the EU with the German Federal Central Tax Office or in the EU VIES system.

9. Safety Assessor

The safety assessment pursuant to Art. 10 of Regulation (EC) No 1223/2009 is carried out by Dr. med. Rosemarie Klotz. She receives the documents required for the assessment and is bound to confidentiality. Her name, qualification and signature appear in the safety report; her name and qualification also appear on the report's verification page (section 9a). The legal basis is Art. 6(1)(b) GDPR.

9a. Verification Number and Verification Page

Every signed safety report carries a random verification number, also as a QR code. Anyone who knows the verification number can check at regularus.coniuncta.tech/en/verify, without signing in, whether the report comes from us, is unchanged and is still valid. The verification page shows the product name and version as in the report, the date of signature, the name and qualification of the safety assessor, the status (valid, replaced by a newer version or withdrawn) and the hash of the PDF file. It does not show your company, your formulation or any other person. The page is blocked for search engines. If you check a PDF file against the hash there, this happens only in your browser; the file is not transmitted. We do not count visits to the verification page, and no analytics or advertising services run on it; checks via our MCP server are counted, as in section 6a, only per day and result. Section 4 applies to protection against abuse. The details shown on the verification page are kept even when we delete the PDF and documents under section 18. If we withdraw a report, we record internally who did so, when and for what reason. The legal basis is Art. 6(1)(b) GDPR, because the verification number is part of the report, and Art. 6(1)(f) GDPR: our legitimate interest, and that of authorities, retailers and marketplaces, lies in being able to verify the authenticity of a report.

10. Review Assistant (AI)

An AI-supported review assistant assigns uploaded documents to the requirements of your order and checks them for completeness and suitability. For this we use language models via Google Cloud Vertex AI. The provider is Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland. We currently use models of the Claude series by Anthropic.

We use the European Union endpoint; processing takes place in data centres in EU Member States. Your data is not used to train the models. We have a data processing agreement with Google.

The review assistant does not make decisions about you. The safety assessment is carried out exclusively by the safety assessor. There is no automated decision within the meaning of Art. 22 GDPR.

The legal basis is Art. 6(1)(b) GDPR, supplemented by Art. 6(1)(f) GDPR. Our legitimate interest lies in giving you quick feedback on your documents.

11. Requests to Manufacturers and Suppliers

At your request, we ask your manufacturers or suppliers for missing documents. For this we process the email address you give us and send a request on your behalf with a personal upload link. What the recipient uploads is visible only to our team and the safety assessor.

If you are the contact person of a manufacturer or supplier and have received such a request, we process your email address, your name (if provided) and your uploads to carry out our customer's order. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in obtaining the documents required for the legally prescribed safety assessment. You can object at any time (section 19). We store these data as long as the documents of the order.

12. Ask a Question

If you write to us via "Ask a question", we process your message and your email address in order to reply. The legal basis is Art. 6(1)(b) GDPR, otherwise point (f). We delete the message two years after the last reply, unless it belongs to an order.

13. Payment

We process payments via Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. You enter your payment data, such as card number or IBAN, directly with Stripe. We only receive the payment status, a Stripe customer number and details of the payment method, for example the last four digits.

If you choose PayPal, PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg, additionally processes the payment.

The legal basis is Art. 6(1)(b) and (c) GDPR. For fraud prevention and their legal obligations, Stripe and PayPal are partly controllers themselves. Details can be found in their privacy notices.

14. Email Delivery

We send the platform's emails via Resend, Inc., USA, from the EU region of the service. These include:

• sign-in links
• Offers as PDF
• status messages
• reminders
• requests to manufacturers

Recipient address, subject, content and any attachments are transmitted. We have a data processing agreement with Resend. Insofar as data may reach the USA, standard contractual clauses apply (Art. 46(2)(c) GDPR). The legal basis is Art. 6(1)(b) GDPR.

15. Process Events, Visit Statistics and Reminders

So that we can see where customers get stuck, we store on our servers which steps of the process you complete. Examples:

• question answered, including "don't know",
• fixed price shown, account created,
• document viewed, uploaded or requested from the supplier,
• result of the pre-check,
• sent to the assessor, accepted, delivered.

Only the type of event, the time, the identifier of your questionnaire or order and a few fixed details such as the type of document are stored. We never store the content of your documents, names or email addresses with these events. We do not set any additional cookies for this. We evaluate the events in aggregated form, for example how many customers reach which step per week. To find obstacles, we also look at individual journeys, i.e. the sequence of steps of a questionnaire or order, without names and without email addresses.

For every visit we store, without cookies and without your IP address, the page on which you arrived and where you came from: the domain of the referring website (for example google.de), the campaign details from the address (for example utm_campaign) and, for ads, the identifiers of the campaign and ad group as well as the booked search term with its match type. In addition, we store the country, which we derive from the IP address without storing it, the device class (smartphone, tablet or computer) and the language of your browser. We do not link several visits with one another. If you start the questionnaire, we also store this origin with it. We do not store click identifiers of advertising providers, such as Google's gclid. We do not pass on the origin. Legal basis, objection and retention as described in this section.

If a step remains open for several days, we send you a reminder with the next step. Occasionally we briefly ask on the platform what is holding you up; answering is voluntary. You can unsubscribe from reminders in every reminder and in your customer account.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in improving the process and supporting you with open steps; you can object (section 19). We delete individual events after 13 months. After that, only aggregated figures without reference to you remain.

16. Consent in the Banner

On your first visit we ask in a banner whether you allow statistics and marketing. "Only necessary" and "Accept all" are equivalent; under "Settings" you choose individually. Without your consent we do not load any of the services in sections 16a to 16d.

We store your choice in the cookie rg-consent and as proof on our server: selection, time, version of the banner and a random identifier, without name or email address. The legal basis for the proof is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR. We delete the proof after three years.

You can withdraw or change your consent at any time via "Cookie settings" in the footer. The withdrawal takes effect for the future.

16a. Google Tag Manager

With your consent for statistics or marketing we load Google Tag Manager. It loads the services in sections 16b and 16d according to your choice and does not set any cookies itself. In the process, your IP address is transmitted to Google. We use Google's consent mode in its basic form: without your consent the site sends no data to Google.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

16b. Statistics with Google Analytics

With your consent for statistics we use Google Analytics 4 to measure how the site is used. We record page views and events such as "questionnaire started" or "price shown" with a few fixed details (product type, price level, number of varieties), plus device and browser without precise model and version details and an approximate location without city, which Google derives from the IP address. Google Analytics does not store the IP address itself. Granular location and device data, Google Signals, user IDs and ad personalisation are switched off. We share data with Google only as far as the link with Google Ads and Google Search Console requires. The content of your documents, names and email addresses never go to Google Analytics.

We link Google Analytics with our Google Ads account and Google Search Console so that we can see which ads and search results lead to visits. Google Analytics retains the data for 14 months. Cookies: _ga and ga*, see section 5.

The provider is Google Ireland Limited (address in section 16a). Google may transfer data to the USA; Google LLC is certified under the EU-US Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

16c. Product Analytics with PostHog

To make the platform easier to understand, we may, with your consent, measure how it is used. For this we use PostHog in the EU cloud with data storage in Frankfurt am Main. The provider is PostHog, Inc., USA.

We record page views, clicks and the course of your session, also as a recording, without your name or email address. In recordings we mask all inputs and your details such as company, product and file names. We record nothing on pages with documents, formulations or review views. We delete the data after 90 days.

Without your consent, no analytics take place. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time in the cookie settings. Insofar as data may reach the USA, standard contractual clauses apply.

16d. Marketing with Google Ads

With your consent for marketing we measure which Google ads lead to orders. We also show visitors of our site more relevant ads in later Google searches (remarketing).

• In the browser: If you come via a Google ad, the conversion linker stores the click identifier of the ad (gclid, gbraid or wbraid) in cookies of our domain (_gcl_au, _gcl_aw, _gcl_ag, _gcl_gb). Your browser transmits the page address, device and browser details and, for technical reasons, your IP address to Google. Google assigns you to remarketing lists and also sets cookies on its own domains such as doubleclick.net for this purpose (see section 5).
• From the server: If you reach a step that counts as a success for us (account created, first document uploaded, order paid, request for a custom quote), our server reports this to Google Ads. For this, our server stores the click identifier with your questionnaire, your account and your order. We transmit the click identifier, the name of the step, the time, a value with currency (for orders the net amount, otherwise a fixed value per step), an identifier of the report (for orders our internal order number, otherwise a random identifier) so that Google can recognise duplicate reports, and your consent status. We report an order only once it has been paid. If an order that has already been reported is refunded or cancelled, we set its value at Google to zero.
• Enhanced conversions: In addition, we transmit a hash value of your email address (SHA-256). This allows Google to attribute an order to the ad even if you switched devices in between. Google uses the hash value only for this matching with its own accounts.
• Never to Google: names, address, telephone number, formulations, documents and free text.
• Storage: We store click identifiers only with your consent. If you withdraw it, we delete stored click identifiers and report nothing further. We delete them after 90 days at the latest anyway.

The provider is Google Ireland Limited (address in section 16a). Google also processes this data as an independent controller; see Google's privacy policy (https://policies.google.com/privacy). Google may transfer data to the USA; Google LLC is certified under the EU-US Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

17. Recipients

Only the following receive your data:

• the members of our team involved in your order,
• the safety assessor,
• the service providers named in this policy, under data processing agreements,
• Google Ireland Limited and Google LLC for Tag Manager, Google Analytics and Google Ads, only with your consent (sections 16a to 16d); for Google Ads also as an independent controller.

Authorities receive data insofar as we are legally obliged to provide it, in particular as responsible person under Regulation (EC) No 1223/2009. This includes notification, the product information file on request and the reporting of serious undesirable effects.

18. Retention

• Questionnaires without a customer account: 60 days after the last change.
• Documents without an order: six months after the last activity.
• Work results without representation in the EU: three years after completion of the order; we notify you beforehand so that you can retrieve them.
• Access log of an order: ten years.
• Process events and visit statistics: 13 months, after that only aggregated figures.
• Protection against abuse: IP address at sign-in about one minute; hash of the IP address otherwise at most two days.
• Offer as PDF by email: address and request six months after the request; immediately after an objection. After that we keep only a hash of the address so that we send no further emails. The questionnaire is kept at least as long as the request.
• Verification data of a report: for as long as the report may be used, i.e. until ten years after the last batch of the product was placed on the market (Art. 11 of Regulation (EC) No 1223/2009); if we do not know this date, at least ten years after signature.
• Proof of your choice in the banner: three years.
• Google click identifiers: until withdrawal, at most 90 days.
• Google Analytics: 14 months.
• Representation in the EU: product information file and safety report ten years after the last batch was placed on the market (Art. 11 Regulation (EC) No 1223/2009).
• Invoices and accounting records: according to commercial and tax law retention periods, currently eight years.
• Business letters: currently six years.
• Otherwise: we delete data as soon as the purpose no longer applies.

19. Your Rights

You have the following rights:

• access (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR).

You can withdraw consent at any time with effect for the future.

Right to object: Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process the data unless there are compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims.

An email to regularus@coniuncta.com is sufficient for all requests.

You may also lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

20. Obligation to Provide Data

For the customer account and the order we need your email address, the billing details and the product documents. Without them we cannot conclude or perform the contract. Beyond this, you are not obliged to provide us with data.

21. Changes

We adapt this policy when the platform, our service providers or the legal situation change. The version published on the platform applies.