How px dynamics handles personal data in the customer portal and the API. Last updated 14 October 2026.
px dynamics GmbH, Reichenberger Str. 113a, 10999 Berlin, Germany, represented by the managing director Steffen Krutzinna. Email: mail@pxdynamics.com. No data protection officer is appointed; with fewer than twenty employees and no processing that would require one, none is required.
The customer portal at portal.pxdynamics.com and the API at api.pxdynamics.com. The public website at pxdynamics.com has its own notice at pxdynamics.com/privacy.
In most cases we created your login at the request of the contact person at your employer, who gave us your work email address. Otherwise you entered it yourself when you registered or requested a password reset.
Account data. Your login email address, your password (stored only as a hash), invitation and password reset tokens (stored as hashes) and the times you log in. We process this to give you access to the service your employer has contracted with us, which is our legitimate interest in performing that contract, Art. 6(1)(f) GDPR, and the performance of the contract itself, Art. 6(1)(b), where you are the contracting person.
Cookies and browser storage. The portal sets two cookies, both strictly necessary: a session cookie that keeps you logged in and a CSRF token cookie that protects that session. There are no analytics, no tracking and no third-party embeds. The browser additionally stores the date you last opened the news page and a one-time reload flag locally; neither leaves your browser.
Activity log. Which page or endpoint you opened, the action, the chart range, your IP address and the time. We keep this to keep the service secure and to see how it is used, Art. 6(1)(f).
API request log. Endpoint, response status, your IP address, the time and the request parameters of every API call, on the same basis.
Web server access log. The web server in front of the portal and the API records IP address, URL, time and browser identification of every request, for security, Art. 6(1)(f).
Email. Invitation and password reset emails are sent through Google Workspace.
On our own servers hosted by Hetzner Online GmbH in Germany. Email is sent through Google (USA, under the EU-US Data Privacy Framework). Nobody else receives your data.
Account data for as long as your login exists; sessions and tokens are deleted with the login. Portal activity for 60 days. The web server access log for about six months. Server logs for 30 days. For the API request log no retention period is set today, and its rows are not deleted with the account; a retention rule for it is planned.
You have the right to access, correct and delete your data, to restrict its processing, to receive it in a portable form and to object to processing based on our legitimate interest. Write to mail@pxdynamics.com; we answer within 30 days. You may also complain to the supervisory authority, the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen.
When this notice changes, the date at the top changes with it.