Legal
Imprint (section 5 DDG)
VRtual X GmbH
Hegestraße 40
20251 Hamburg
Germany
Managing directors: Tim B. Frank, Matthias Wolk
Commercial register: Amtsgericht Hamburg, HRB 148847
VAT ID (section 27a UStG): DE314784704
Phone: +49 15679 111200 · x@vrtual-x.com · vrtual-x.com
We are neither willing nor obliged to take part in dispute resolution proceedings before a consumer arbitration board (section 36 VSBG).
Privacy in short
Anpacken stores what you and your colleagues enter, and what it needs to sign you in. Nothing else.
Your organisation decides what happens with its data; we only process it on instruction, on servers in Germany.
There is no tracking, no advertising and no cookie banner, because we only set cookies the application needs.
You can see, export and have deleted everything about you; the full statement below says how.
Privacy statement
Controller
The controller within the meaning of Art. 4 No. 7 GDPR for the operation of this application and for customer account data is VRtual X GmbH, Hegestraße 40, 20251 Hamburg, Germany, represented by its managing directors. Contact: x@vrtual-x.com.
Roles
For the content data entered by a customer organisation (contacts, users, later recordings and invoices), that organisation is the controller and VRtual X GmbH acts as processor under Art. 28 GDPR on the basis of a data processing agreement. For the data of the customer accounts themselves (name, address, billing data, operator accounts) VRtual X GmbH is the controller.
Data and purposes
Account data (e-mail address, name, language, time zone, password hash, second-factor secret in encrypted form), session data (session identifier, hashed IP address, browser identification), paired devices, notification channels, invitations, and the content data of the organisation. Purposes: providing the application (Art. 6 (1) b GDPR), securing the sign-in and preventing abuse (Art. 6 (1) f), meeting statutory retention duties (Art. 6 (1) c). Sign-in attempts with a hashed IP address are kept for seven days.
Cookies
The application only sets cookies that are strictly necessary for the service you request (section 25 (2) No. 2 TDDDG): the sign-in session, the working token per area, the protection against cross-site requests, your language choice and, if you request it, the remembered device. No consent is required and no consent banner is shown. The full list is available under Settings, Privacy.
Recipients (Art. 13 (1) e GDPR)
| Recipient | Purpose | Data | Basis |
|---|---|---|---|
| Hetzner Online GmbH, Gunzenhausen (DE) | Hosting, storage, backups in Germany | all data of the application, encrypted at rest per organisation | processor under Art. 28 GDPR |
| Cloudflare, Inc. (US) | Domain name resolution (DNS) only | domain name requests of your browser; no content passes through Cloudflare | technically necessary, Art. 6 (1) f GDPR |
| Mail provider of VRtual X GmbH (as configured by the operator) | Sending invitations, password reset links and notifications | e-mail address, name, the content of the message | processor under Art. 28 GDPR |
Your rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). Requests can be raised with your organisation, which answers them through the application, or with the controller named above. You may lodge a complaint with a supervisory authority.
Retention
Content data are kept until the organisation deletes them or ends its contract; after the end of a contract they are kept for 90 days for export and then destroyed together with the organisation's encryption key. Audit logs are kept for 24 months, sign-in attempts for 7 days, sessions and tokens until they expire.
Supervisory authority
The Hamburg Commissioner for Data Protection and Freedom of Information (Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit), Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany.
Status: 8 September 2026. Written to the best of our knowledge; a legal review is planned before the first paying customer.