Privacy policy

1. Collection and processing of personal data

We collect and process the personal data you provide when placing an order, opening a customer account or for any other purpose (e.g. name, address, email address, telephone number, payment details) in principle only if and to the extent that you have given your consent or another legal basis under Art. 6 GDPR applies.

In addition, the user's IP address is recorded on our websites for technical reasons.

2. Disclosure of personal data to third parties

Your personal data is disclosed to third parties in principle only where this is necessary to provide our services, where you have expressly consented, or where we are legally entitled or obliged to do so.

3. SpeamCore app (Android and iOS)

This section applies to the mobile app “SpeamCore” of Speam GmbH for Android and iOS. The app is used by companies (tenants) that use SpeamCore and by their field staff. The respective company is responsible for its employees’ data; Speam GmbH processes it on the company’s behalf (Art. 28 GDPR).

3.1 Which location data the app processes

The app accesses the precise device location (GPS). On Android this also happens in the background, i.e. even when the app is closed or not in use. On iOS the app uses the location only while it is open.

3.2 Arrival reminder (Android only, background location)

• The app records the location even when the app is closed or not in use.
• Purpose: when an employee arrives at the job site of a work order assigned to them, the app reminds them to record their working time.
• The location is compared with the day’s job sites on the device only. For this function the location is neither stored nor transmitted to us or to third parties.
• Nothing is booked automatically. The app only shows a reminder; whether and when time is recorded is decided by the employee.

3.3 Location while the app is open

While the app is open and in use, it uses the location for the following functions:

• Signatures with location (e.g. acceptance or work records)
• Floor plans and protected objects (recording and displaying the position of systems and objects)
• Commissioning of a SpeamBox

This location data is transmitted to the server of the respective company (tenant) and stored together with the respective record.

3.4 Who is affected

Affected are field staff whose company uses the SpeamCore app and for whom the company requires the location permission on the device. Customers and other persons are not located by the app.

3.5 Other data in the app

In addition to location data, the app processes the following data as far as necessary for working with SpeamCore:

• Name, email address, telephone number and user ID of the employee
• Addresses (e.g. job sites and customer addresses)
• Photos and files recorded or uploaded in the app (e.g. documentation of work and defects)
• In-app messages
• Device ID or device token for push notifications

Push notifications: Notifications are delivered through Firebase Cloud Messaging (FCM) of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. For this, a device token is processed that identifies your device for receiving notifications. A transfer to Google LLC in the USA cannot be ruled out in this context; Google is certified under the EU-US Data Privacy Framework.

3.6 Disclosure

Location data and other app data are not disclosed to third parties for advertising purposes and are not sold. The app contains no advertising. We use the following processors, who process data only on our instructions:

• Hosting provider for operating the SpeamCore servers on which the tenants’ data is stored
• Google Ireland Limited (Firebase Cloud Messaging) for delivering push notifications

3.7 Retention and deletion

Location data from the arrival reminder (3.2) is not stored. Location data stored with a record (3.3) is kept by the respective company for as long as the record is kept, i.e. generally until the statutory retention and documentation obligations for the order have expired. If the company’s contract with Speam GmbH ends, the data is deleted after it has been returned to the company.

You can request deletion of your data from your employer, who is stored in the app as the company. You can also contact us directly (see “Data protection contact”); we will then forward your request to the responsible company.

3.8 Your control over the location permission

You can withdraw or restrict the location permission at any time in your device settings:

• Android: Settings › Apps › SpeamCore › Permissions › Location
• iOS: Settings › Privacy & Security › Location Services › SpeamCore

Without background location you will no longer receive an arrival reminder. Without any location permission, signatures are stored without location, positions on floor plans and for protected objects are no longer recorded automatically, and commissioning a SpeamBox may not be possible. All other functions of the app remain usable.

3.9 Legal basis

Location data of employees is processed on the basis of Art. 88 GDPR in conjunction with Section 26 of the German Federal Data Protection Act (BDSG) where necessary for carrying out the employment relationship (time recording, proof of services rendered at the job site), and on the basis of Art. 6(1)(f) GDPR. The company’s legitimate interest lies in proving and documenting work carried out at the customer’s premises. Processing in the background serves only to remind the employee and takes place exclusively on the device, so that no monitoring by the company takes place. Existing works agreements of the respective company remain unaffected.

4. Retention period

The retention period is determined by the applicable legal basis, the purpose of processing and — where relevant — statutory retention periods (e.g. under commercial and tax law).

Where processing is based on consent (Art. 6 (1) (a) GDPR), the data is stored until the data subject withdraws that consent.

5. Your rights

You have the right at any time to request information free of charge about the data collected about you, to request its correction, deletion or restriction, and to object to processing.

6. Website speam.io: hosting, reach measurement, form and embedded content

This section describes which data is processed when you visit the website speam.io (as of 04.11.2026). The website itself does not set any cookies.

6.1 Hosting and server log files

The website is operated by Speam GmbH on a server of Hetzner Online GmbH in Germany.

On every request the server processes technically necessary data: IP address, date and time, page requested, amount of data transferred, referrer URL, and browser and operating system. This data is stored in server log files to deliver the website securely and reliably and to detect faults or misuse. The log files are continuously overwritten and are not combined with other data sources.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and error-free operation of the website.

6.2 Reach measurement without cookies

We count page views to understand which content is used. We set no cookies for this and store nothing in your browser. From the IP address and browser identifier, together with a random value that changes daily, an identifier is formed. The random value is deleted at the end of the day, after which the identifier can no longer be assigned to a person, not even across days. The IP address itself is not stored for this purpose.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in designing our offering to meet demand.

6.3 Contact form

If you write to us through the contact form, we process your details (name, email address, optionally company, and your message) to handle your enquiry. The details are stored on the website’s server and forwarded to us by email. To protect against misuse, your IP address is stored only in encrypted form (as a hash value) in order to detect too many requests in a short time.

The form data stored on the server is deleted automatically after 180 days at the latest. We keep your message in our email inbox for as long as is necessary to handle your enquiry and any resulting business relationship, or as long as statutory retention periods apply.

The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract or pre-contractual measures, and otherwise Art. 6(1)(f) GDPR. Our legitimate interest lies in answering your enquiry. We do not pass your data on to third parties without your consent.

6.4 Browser storage and cookie settings

In your browser’s local storage we store only what you choose yourself: whether the website is shown in light or dark mode, and which external content you have allowed in the cookie settings. This information does not leave your device. You can delete it at any time via your browser settings.

The legal basis is Section 25(2) no. 2 TDDDG, because the storage is strictly necessary for the display you requested or for retaining your choice. You can change or withdraw your choice at any time via the link “Cookie settings” at the bottom of every page.

6.5 Videos from Vimeo

On the SpeamPlan page we show a video from the service Vimeo (Vimeo.com, Inc., 330 West 34th Street, 5th Floor, New York, NY 10001, USA). The video is only loaded when you click “Load content from Vimeo” or allow Vimeo in the cookie settings. Before that, no connection to Vimeo is established.

After your consent, data such as your IP address, information about your browser and device, and the page requested are transmitted to Vimeo; Vimeo may use cookies or similar technologies. A transfer to the USA may take place. For details see Vimeo’s privacy policy: vimeo.com/privacy.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG; for the transfer to the USA additionally Art. 49(1)(a) GDPR). You can withdraw it at any time with effect for the future via the cookie settings.

6.6 Fonts

The website uses the system fonts available on your device. No font files are loaded from third-party servers, such as Google.

6.7 Links to other providers

The website links to appointment booking via Microsoft Bookings, to the SpeamCore app in the App Store, to the websites of partners and customers, and to our profiles on social networks. These are simple links: no data is transmitted to these providers when you open our pages. Only when you follow a link do the privacy terms of the respective provider apply.

7. Data security

Your personal data is transmitted over the internet encrypted via SSL. We protect our website and systems with technical and organizational measures against loss, unauthorized access, alteration or distribution.

8. Minimum age

We offer our services and products only to users who are at least 16 years old.

9. Data protection contact

10. Controller