EU law
General Data Protection Regulation (GDPR) – Regulation (EU) 2016/679
What the law requires
Personal data may only be processed on a legal basis, for a specific purpose, with data minimisation and securely. Data subjects have rights of access, rectification, erasure, data portability and objection, and must be informed transparently about the processing.
How we implement it
Our privacy policy states purposes, legal bases, recipients and retention periods. Customers can export their data themselves in the customer portal. Central retention rules delete legacy and log data automatically; the connection is protected by TLS and HSTS, and the customer portal offers two-factor login.
Digital Services Act (DSA) – Regulation (EU) 2022/2065
What the law requires
Hosting providers must designate a single point of contact for authorities and users (Art. 11, 12), provide an easily accessible notice-and-action mechanism for illegal content (Art. 16) and give reasons for their decisions (Art. 17).
How we implement it
The point of contact is stated in the legal notice (e-mail and contact form, German and English). Via "Report illegal content" we receive notices with location and reasons, confirm receipt with a reference number and communicate our decision with reasons.
Data Act – Regulation (EU) 2023/2854, Chapter VI switching between providers
What the law requires
Providers of data processing services (hosting, cloud) must enable customers to switch to another provider or to their own systems – with short deadlines, data export in common formats and, from 12 January 2027, without switching charges.
How we implement it
Our page "Switching providers & data export" describes deadlines (notice of switching at most two months, transition period at most 30 days, retrieval at least 30 days), formats and charges, and contains the request form. Section 12 of our terms governs switching; customer and contract data can be exported at any time in the customer portal.
Artificial Intelligence Act (AI Act) – Regulation (EU) 2024/1689
What the law requires
AI systems that interact with people or generate content must be recognisable as such (Art. 50 transparency). Deployers must ensure sufficient AI literacy of the persons using AI systems (Art. 4).
How we implement it
We do not use any AI systems towards customers: no chatbot, no automated decisions on contracts or prices, no AI advice. Internally, we use an AI-based text recognition tool (Anthropic Claude) solely to pre-capture receipts in our bookkeeping; every result is checked by a person before it is adopted. Should we publish AI-generated content or use AI systems in customer contact in future, we will label this in accordance with Art. 50. Training of the persons involved under Art. 4 is being implemented internally.
NIS 2 Directive – Directive (EU) 2022/2555 and the German NIS 2 Implementation Act (BSIG)
What the law requires
Important and essential entities must demonstrate risk management, incident handling with reporting to the BSI, business continuity, supply chain security and training.
How we implement it
Whether INX System Solution falls under the registration obligation depends on size and sector and is being reviewed. Regardless, we align our security processes with NIS 2: security headers (HSTS, Content Security Policy), two-factor login in the customer portal, regular backups, documented incident handling and a public reporting channel for vulnerabilities.
Cyber Resilience Act (CRA) – Regulation (EU) 2024/2847
What the law requires
Manufacturers of products with digital elements must handle vulnerabilities, provide security updates and, from 11 September 2026, report actively exploited vulnerabilities to ENISA and the national authority; the remaining obligations apply from 11 December 2027.
How we implement it
For our software (QuantumShield SDK) and our services we operate coordinated vulnerability disclosure: the "Report a vulnerability" form with confirmation of receipt and a security.txt under RFC 9116 at /.well-known/security.txt. The remaining CRA obligations will be implemented by the deadlines.
Accessibility Strengthening Act (BFSG) – implementing the European Accessibility Act, Directive (EU) 2019/882
What the law requires
Since 28 June 2025, e-commerce services for consumers must be accessible (perceivable, operable, understandable, robust) and provide an accessibility statement.
How we implement it
Our website is aligned with WCAG 2.1 Level AA: keyboard operation, skip link to content, contrast, alternative texts, light and dark mode. The accessibility statement gives the review status, known limitations and a feedback channel.
Geo-blocking Regulation – Regulation (EU) 2018/302
What the law requires
Customers from other EU Member States must not be blocked, redirected or disadvantaged in prices and payment conditions when accessing online offers because of their nationality, place of residence or place of establishment.
How we implement it
Our website and customer portal are open in all 24 official EU languages at the same prices and conditions. The language is only suggested and can be freely chosen at any time; there is no blocking or redirection based on country of origin.
ePrivacy Directive – Directive 2002/58/EC (privacy in electronic communications)
What the law requires
Regulates across Europe the confidentiality of communications, cookies and access to terminal equipment, and unsolicited advertising by e-mail; implemented in Germany by the TDDDG and the UWG.
How we implement it
Consent before non-essential cookies, newsletter only after double opt-in, and encrypted transmission of all pages and forms.
German law
Federal Data Protection Act (BDSG)
What the law requires
Supplements the GDPR in Germany, among other things on data protection supervision, employee data and the appointment of a data protection officer.
How we implement it
We process data in accordance with the GDPR and the BDSG. Please send data protection requests to the contact address given in the privacy policy; we answer them within the statutory period.
Telecommunications Digital Services Data Protection Act (TDDDG), Section 25 – cookies and access to terminal equipment
What the law requires
Information may only be stored on or read from the user's device (for example cookies) with consent, unless this is strictly necessary for the service explicitly requested.
How we implement it
Without consent, our cookie banner sets only technically necessary cookies (session, CSRF protection, consent storage). Audience measurement runs only after the "Statistics" category is switched on – without IP address or user agent. The choice can be changed at any time via "Cookie settings". We do not load external fonts or third-party trackers.
Digital Services Act (DDG, Germany), Section 5 – legal notice requirement (successor to the TMG)
What the law requires
Providers of digital services must keep their name, address, contact details, VAT identification number and other mandatory information easily recognisable, directly accessible and permanently available.
How we implement it
Our legal notice contains all information required by Section 5 DDG and Section 18(2) MStV and can be reached from every page with one click.
German Civil Code (BGB), Sections 312 et seq. – distance contracts, order button (Section 312j), right of withdrawal (Sections 355, 356a)
What the law requires
Consumers must be clearly informed before concluding a contract, the order button must clearly state the obligation to pay, and contracts concluded online can be withdrawn within 14 days; since 19 June 2026 a withdrawal button is mandatory for this.
How we implement it
The order button reads "Order with obligation to pay". Our terms contain the withdrawal instruction and the model withdrawal form. Via "Withdraw from contract" consumers can declare withdrawal without logging in and receive a confirmation of receipt with a reference number on a durable medium.
BGB Section 312k – cancellation button
What the law requires
Anyone offering consumers continuing obligations online must provide a permanently available, clearly legible cancellation button with a confirmation page and confirm receipt of the cancellation electronically.
How we implement it
The button "Cancel contracts here" is in the footer of every page. Cancellation is possible without logging in; date, time and reference number are shown immediately and confirmed by e-mail.
Price Indication Ordinance (PAngV)
What the law requires
Towards consumers, total prices including VAT and all other price components must be stated; for price reductions, the lowest price of the last 30 days must be given.
How we implement it
All prices on our product pages and in the configurator are final prices including 19 % VAT; the note appears next to the prices and in the footer of every page. Billing period and term are stated with the price.
Act against Unfair Competition (UWG)
What the law requires
Prohibits misleading advertising and unacceptable nuisance, in particular advertising e-mails without prior express consent (Section 7 UWG).
How we implement it
We send our newsletter only after double opt-in and with an unsubscribe link in every issue. We phrase statements on security and compliance as "aligned with …" as long as no certificate is available.
Consumer Dispute Resolution Act (VSBG), Section 36 – information on dispute resolution
What the law requires
Businesses must inform consumers whether they are willing or obliged to participate in dispute resolution proceedings before a consumer arbitration board.
How we implement it
We are neither willing nor obliged to participate in dispute resolution proceedings before a consumer arbitration board. The former EU online dispute resolution (ODR) platform was discontinued on 20 July 2025.
Commercial Code (HGB) Section 257, Fiscal Code (AO) Section 147 and GoBD – retention obligations
What the law requires
Invoices, accounting records, commercial letters and books must be retained unchanged and traceably for six to ten years; since 2025 businesses must be able to receive electronic invoices.
How we implement it
We retain invoices and accounting records in our invoicing system for the statutory period; they are expressly excluded from the automatic deletion routines. We provide invoices as PDF. The retention periods for all other data are documented.