Privacy Policy

Protecting your personal data is important to us. This Privacy Policy explains what personal data we collect when you use the Bonara website (bonara.app) and the Bonara web application (together, the "Service"), why we collect it, how we use it, and the rights you have. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable German data protection law.

1. Controller

The controller responsible for processing your personal data is L&P Enterprises Friebe Grawe GbR. You can reach us at hello@bonara.app or +49 30 8093 2806. Full provider details are set out in the imprint at the foot of this page.

2. What data we collect

• Account data — name, email address, and authentication identifiers when you sign up or sign in (for example via Microsoft, Google, or email).
• Organisation and plan data — information you enter to run bonus plans, such as employee names, roles, targets, actuals, currencies, and payout figures.
• Billing data — where you subscribe to a paid plan, the billing details needed to process payment (payment card data is handled by our payment processor, not stored by us).
• Usage and technical data — log data such as IP address, browser type, device information, and pages visited, collected automatically when you use the Service.
• Communications — the content of messages you send us by email or through the Service.

3. Why we use your data and legal bases

• To provide the Service (Art. 6(1)(b) GDPR — performance of a contract): creating and managing your account, running plans, and delivering features.
• To operate and secure our systems (Art. 6(1)(f) GDPR — legitimate interests): maintaining, troubleshooting, and protecting the Service against misuse.
• To comply with legal obligations (Art. 6(1)(c) GDPR): for example retention of billing records.
• With your consent (Art. 6(1)(a) GDPR): for any optional analytics or marketing communications, where applicable. You may withdraw consent at any time.

Where you upload personal data about your employees or other individuals, you act as the controller for that data and we process it on your behalf as a processor under Art. 28 GDPR; a data processing agreement is available on request.

4. Cookies

We use cookies and similar technologies that are strictly necessary to operate the Service (for example, to keep you signed in). Where we use any non-essential cookies (such as advertising or analytics), we ask for your consent first via our cookie banner, and you can decline or change your choice at any time. You can also control cookies through your browser settings.

4a. LinkedIn Insight Tag

On our marketing website we use the LinkedIn Insight Tag, an advertising and analytics technology provided by LinkedIn Ireland Unlimited Company (Wilton Plaza, Wilton Place, Dublin 2, Ireland). It helps us measure the performance of our LinkedIn advertising and reach relevant audiences. The tag can set cookies and process data such as your IP address (truncated/shortened by LinkedIn), device and browser characteristics, and pages you visit on our site.

The LinkedIn Insight Tag loads only after you give consent through our cookie banner. If you decline, the tag is not loaded and the website works fully without it. Where data is processed by LinkedIn outside the EU/EEA, this is based on appropriate safeguards such as the EU Standard Contractual Clauses. You can withdraw your consent at any time by clearing the site's stored preference or via your browser settings. For details on how LinkedIn processes data, see LinkedIn's own Privacy Policy at linkedin.com/legal/privacy-policy.

5. Hosting and third-party processors

We use carefully selected service providers to host and run the Service (for example, cloud hosting, authentication, and payment providers). These providers process data only on our instructions and under appropriate data protection agreements. Where data is transferred outside the EU/EEA, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

6. How long we keep data

We keep personal data only as long as necessary for the purposes described above, for the duration of your account, and thereafter as required to meet legal, accounting, or reporting obligations. When data is no longer needed, we delete or anonymise it.

7. Your rights

Subject to the conditions of the GDPR, you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate data;
• request erasure of your data ("right to be forgotten");
• request restriction of processing;
• object to processing based on legitimate interests;
• receive your data in a portable format (data portability);
• withdraw any consent you have given, at any time.

To exercise any of these rights, contact us at hello@bonara.app. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your residence or place of the alleged infringement.

8. Data security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. No method of transmission or storage is completely secure, but we work to protect your data using industry-standard safeguards.

9. Changes to this policy

We may update this Privacy Policy from time to time. The current version is always available on this page, with the "last updated" date shown above. Material changes will be communicated where appropriate.

10. Contact

For any questions about this Privacy Policy or your personal data, contact us at hello@bonara.app or by post at the address in the imprint below.