top of page

AllocNow Privacy Policies

This data privacy statement was last reviewed and updated on Jan 17, 2024

1. Overview

AllocNow GmbH ("AllocNow", “we” or “us”) is committed to protecting the privacy and security of your data. This Data Privacy Statement outlines how we collect, use, disclose, and protect the personal information provided to us, in compliance with the General Data Protection Regulation (GDPR).

AllocNow is a data processor registered in Germany that provides the AllocNow Product Sustainability Platform (“software” or “service”) to your employer. Our software is designed to automate lifecycle assessments and environmental footprint management for businesses.

As the sole operator of the software, AllocNow acts as a data processor in accordance with Article 28 of the General Data Protection Regulation (GDPR). In the course of providing our software, AllocNow processes data, which may include personal data, particularly for the operation of the software. The details of this processing are explained further in this Data Privacy Statement.

The processing of personal data by AllocNow is governed by a data processing agreement entered into between your employer, acting as the data controller, and AllocNow as the data processor. Additionally, AllocNow may engage sub-contractors, such as hosting providers, to facilitate the provision of the service.

If you have any questions regarding the processing of your personal data in the context of your employment relationship, please direct your inquiries to your employer.

2. Legal Basis for Processing

AllocNow processes your personal data on the AllocNow Product Sustainability Platform because it is necessary for fulfilling the contractual agreement with your employer. When users engage with our service, we collect and process their personal information to fulfill contractual obligations and provide the agreed-upon features and functionalities. This includes tasks such as user account management, service delivery, and customer support. The processing of personal data is essential for the execution of contractual agreements between AllocNow and your employer, ensuring a seamless and efficient experience.

3. Data Collection

In the course of operating the AllocNow Product Sustainability Platform, AllocNow collects specific data to facilitate the provision of our services. This includes the collection of user names, business email addresses, and user ID, for example the Microsoft Entra UserPrincipalName (UPN), which are essential for user identification, and account management. Additionally, AllocNow logs user activities within the platform to enhance functionality and ensure optimal performance. Furthermore, login events, including date and time information, IP-address, and information about web browser and version as well as the user’s operating system are recorded to maintain the security and integrity of user accounts. The collection of this data is crucial for AllocNow to fulfill its contractual obligations, deliver a seamless user experience, and uphold highest security standards.

4. Use of Browser Cookies

In certain instances, our software employs what are commonly known as browser cookies. These are small text files stored on the device you use to access the software. Typically, cookies play a vital role in ensuring the security of the software ("mandatory"), implementing specific features like standard language settings ("functional"), or enhancing the overall user experience and software performance ("performance").

Primarily, the software relies on mandatory and functional cookies, particularly for user identification, security assurance, and the implementation of default settings. The use of cookies is deemed essential for delivering our service, constituting our legitimate interest as per Article 6(1)(f) of the General Data Protection Regulation (GDPR).

The retention period for these cookies extends until the closure of the software session. Users have the autonomy to configure their browser settings, allowing them to either permit or object to the use of cookies. It is important to note that deactivating cookies may constrain or entirely inhibit the operability of the software.

5. Secure Data Storage

Ensuring the secure storage of data is a paramount priority at AllocNow. We employ robust measures to protect the confidentiality, integrity, and availability of the information entrusted to us. Our data storage practices adhere to industry-leading security standards, encompassing encryption protocols, access controls, and regular security assessments. By implementing these measures, we aim to fortify the resilience of our systems against unauthorized access, data breaches, or any compromise of sensitive information. AllocNow is committed to maintaining a secure environment for our users' data, fostering trust and confidence in our platform.

6. Data Retention Policy

Our data retention policies at AllocNow are designed to balance the need for efficient service provision with a commitment to privacy and security. In general, personal data collected are retained only for the duration of the user's access to the service. We maintain a standard retention period of 180 days for logs. This time frame allows us to analyze system activities, diagnose issues, and enhance the overall performance of the AllocNow Product Sustainability Platform. After the 90-day period, logs are routinely and securely purged from our systems, aligning with our dedication to data minimization and privacy principles.

7. Rights of Data Subjects

Users of the AllocNow Product Sustainability Platform possess certain rights concerning their personal data.

  • Right to Access (Art. 15 GDPR): Users have the right to request access to the personal data we hold about them, allowing them insight into the information processed.

  • Right to Rectification (Art. 16 GDPR): Users can request corrections to any inaccurate or incomplete personal data, ensuring accuracy and completeness.

  • Right to Erasure (Art. 17 GDPR): Users possess the right to withdraw consent and request the deletion of their personal data, subject to legal requirements.

  • Right to Restriction of Processing (Art. 18 GDPR): Users have the right to request the restriction of processing in specific circumstances, providing an additional layer of control over their personal data.

  • Right to Object (Art. 21 GDPR): Users can raise concerns or lodge complaints about our data processing practices, seeking resolution and transparency.

To exercise any of these rights, users can contact us at We are committed to promptly and transparently addressing inquiries and concerns, in compliance with the General Data Protection Regulation (GDPR).

Kindly be aware that to assert your data subject rights stemming from the processing related to the employment relationship, it is imperative that you directly approach your employer. We retain the right to choose not to respond to these requests or to forward them to your employer.

8. Disclosure of Personal Data to Sub-Processors

In order to provide the AllocNow Product Sustainability Platform and ensure its seamless operation, we engage with trusted sub-processors. These sub-processors play vital roles, such as providing authentication services and hosting our platform infrastructure. We want to assure our users that the selection of sub-processors is done with careful consideration of their commitment to data protection and security. To this end, we have established Standard Contractual Clauses (SCCs) with our sub-processors to ensure compliance with data protection regulations, including the General Data Protection Regulation (GDPR). Below is a list detailing key information about two of our sub-processors, AWS and Microsoft.


  • Purpose: Hosting Services

  • Location: United States

  • SCC in Place: Yes


  • Purpose: Authentication

  • Location: United States

  • SCC in Place: Yes

9. Changes to this Data Privacy Statement

We retain the right to modify or revise this Data Privacy Statement at our discretion. We recommend users regularly revisit this page to stay informed about any updates or alterations, ensuring awareness of our ongoing efforts to safeguard the personal data we gather.

10. Contact

10.1 Inquiries to AllocNow

For any inquiries or concerns related to data privacy or the processing of personal information at AllocNow, users are encouraged to contact us.

AllocNow GmbH, Friedrich-Ebert-Str. 17, 53177 Bonn, Germany

10.2 Data Protection Officer

We have appointed a data protection officer for our company.

Markus Knipp
permanIT GmbH
Bachstraße 32
53115 Bonn


10.3 Supervisory authority

Users have the right to contact the relevant data protection authorities in North Rhine-Westphalia, Germany, should they believe their data protection rights have been infringed. The local supervisory authority in North Rhine-Westphalia is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), and they can be contacted at We are committed to collaborating with users and relevant authorities to address any concerns and ensure compliance with applicable data protection laws.

bottom of page