upload_vmm2smxxie2mlr2eqkcycgk5wm.pdf CARDILINK GMBH
1
CARDILINK GMBH
Platform Privacy Policy
Privacy information for users of the CardiLink Platform
Effective date: 18 September 2026
CardiLink GmbH
Bahnhofstraße 2
90402 Nürnberg
Germany
support@cardi-link.com
This Privacy Policy explains how CardiLink GmbH (“CardiLink”, “we”, “us”) processes personal data when an
individual accesses or uses the CardiLink web platform, including its login page, web dashboard and related
authenticated services (the “Platform”). It is intended to provide the information required by Articles 12–14 of the EU
General Data Protection Regulation (“GDPR”) for processing for which CardiLink acts as controller.
The Platform is primarily provided to organizations such as AED manufacturers, distributors, service organizations,
foundations, public authorities and other business or institutional customers. In some situations, the organization
through which you receive access determines the purposes and means of processing personal data within the
Platform. In those situations, that organization is the controller and CardiLink processes the data on its behalf as
processor under the applicable data processing agreement. Section 3 explains this distinction.
1. Controller and Contact
Where CardiLink determines the purposes and means of processing described in this Privacy Policy, the controller is:
CardiLink GmbH
Bahnhofstraße 2
90402 Nürnberg
Germany
Email: support@cardi-link.com
You may use the above email address for privacy and data-protection inquiries. If a data protection officer is
appointed and legally required to be identified, the applicable contact details will be made available through the
Platform or CardiLink’s legal information.
2. Scope of this Privacy Policy
This Privacy Policy applies to personal data processed in connection with user accounts, authentication, security,
administration and use of the Platform. It does not replace a privacy notice issued by your employer, customer
organization or other organization that has provided your account where that organization acts as controller.
Separate privacy information may apply to CardiLink’s public website, mobile applications or other services where the
processing differs materially from the Platform processing described here.
3. CardiLink as Controller and as Processor
CardiLink may act in different data-protection roles depending on the processing activity.
CardiLink generally acts as controller for processing necessary to administer Platform user accounts, authenticate
users, protect the security and integrity of the Platform, maintain technical and security logs, communicate with users
about their accounts or support requests, administer CardiLink’s contractual relationship, and comply with legal
obligations.
Where personal data is entered, imported, uploaded or otherwise processed in the Platform on behalf of a CardiLink
customer and that customer determines why and how the data is used, the customer generally acts as controller and
CardiLink acts as processor. Such processing is governed by the applicable agreement and Data Processing
CARDILINK GMBH
2
Agreement between CardiLink and the customer. Requests concerning such customer-controlled data may need to be
directed to the relevant customer organization.
4. Categories of Personal Data
Depending on how your account and organization use the Platform, CardiLink may process the following categories of
personal data:
•
Account and identity data, in particular the email address used as the username, together with the organization,
user ID, assigned role and permissions where these are associated with the account.
•
Authentication and security data, such as login events, authentication/session identifiers, failed login attempts and
security-related account information. CardiLink does not need to store a readable version of your password in
order to authenticate your account.
•
Technical data, such as IP address, browser type, operating system, device information, timestamps and
technical request or error information generated when the Platform is used.
•
Usage and audit data, such as actions performed in the Platform, changes to records, administrative events and
other information required for traceability, security and accountability.
•
User-entered service and communication data, such as service information, maintenance information,
notifications, support requests and information you provide when contacting CardiLink.
•
Organization and operational data associated with your use of the Platform, but only to the extent such
information relates to an identified or identifiable person.
5. AED, Location and Operational Data
The Platform processes device, location and operational data relating to AED infrastructure. This may include AED
self-test and status data, production and warranty data, maintenance and service records, addresses, GPS
coordinates, opening hours, accessibility information and optional installation-site images. Such data is generally non-
personal data. If and to the extent a particular data item can be linked to an identified or identifiable individual, it is
treated as personal data and the applicable provisions of this Privacy Policy apply.
These operational data may be generated continuously or on an event-driven basis by connected AEDs, including
through cellular or Wi-Fi connectivity, or entered manually by authenticated users. Customers have access to data
relating to their own devices, and CardiLink may access such data where required for service and support.
Information concerning access to and use of data generated by CardiLink connected products and related services
under Regulation (EU) 2023/2854 (EU Data Act) is provided separately in CardiLink’s EU Data Act information notice.
6. Purposes and Legal Bases
Purpose
Typical data
Legal basis
Account creation, authentication and
Platform access
Account, authentication and
technical data
Art. 6(1)(b) GDPR where processing
is necessary for a contract with the
user; otherwise Art. 6(1)(f) GDPR –
legitimate interests in providing
authorized Platform access and
administering customer
relationships.
Platform security, fraud/misuse
prevention, troubleshooting and
auditability
Authentication, technical, usage and
audit data
Art. 6(1)(f) GDPR – legitimate
interests in maintaining a secure,
reliable and traceable business
platform; where applicable, Art.
6(1)(c) GDPR for legal obligations.
User and organization administration
Account, role, permission and
organization data
Art. 6(1)(b) or Art. 6(1)(f) GDPR,
depending on the relationship with
the user.
Support and service
communications
Account, communication and
relevant technical data
Art. 6(1)(b) GDPR or Art. 6(1)(f)
GDPR – legitimate interests in
providing support and managing the
CARDILINK GMBH
3
service relationship.
Compliance with legal obligations
and establishment, exercise or
defense of legal claims
Relevant account, log,
communication and contractual data
Art. 6(1)(c) GDPR and, where
applicable, Art. 6(1)(f) GDPR.
Where CardiLink relies on legitimate interests, those interests are balanced against the rights and freedoms of the
affected individual. CardiLink does not rely on consent for technically necessary authentication/session cookies.
7. Source of Personal Data
We may receive personal data directly from you, from the organization that creates or administers your Platform
account, from other authorized users within that organization, or automatically from your use of the Platform and its
security infrastructure. Operational data within the Platform may also be generated automatically by connected AEDs
through cellular or Wi-Fi connectivity or entered manually by authenticated users, for example in connection with
service and maintenance activities.
8. Technically Necessary Cookies and Session Storage
The CardiLink login page and authenticated Platform use only technically necessary authentication/session cookies or
equivalent storage required to provide secure login, maintain an authenticated session, protect the Platform against
unauthorized access and provide the digital service requested by the user.
These technologies are not used on the login page for advertising, cross-site tracking or marketing analytics. Where
the storage of or access to information on the user’s terminal equipment is strictly necessary to provide the expressly
requested digital service, consent is not required under Section 25(2) No. 2 of the German Telecommunications
Digital Services Data Protection Act (TDDDG).
Session-related information is retained only for the period technically required for authentication, security and session
management, subject to any separate security-log retention required for legitimate security purposes.
9. Recipients and Service Providers
Personal data may be accessed by authorized CardiLink personnel where required for operation, service or support.
CardiLink does not disclose Platform users’ personal data to independent third parties for their own purposes. Where
CardiLink uses service providers acting on CardiLink’s behalf to operate, host, secure, maintain or support the
Platform, they may process personal data only as instructed by CardiLink and subject to appropriate contractual and
data-protection requirements.
Personal data may also be disclosed where required by law, court order or competent authority, or where necessary
to establish, exercise or defend legal claims. CardiLink does not sell Platform users’ personal data.
10. Processing Location
Personal data covered by this Privacy Policy is processed solely within the European Union/European Economic Area
(EU/EEA). CardiLink does not transfer this personal data to third countries outside the EU/EEA.
11. Retention
CardiLink retains personal data only for as long as necessary for the purposes described in this Privacy Policy,
including the duration of an active user account or customer relationship, applicable security and audit requirements,
contractual recordkeeping, legal retention obligations and the establishment, exercise or defense of legal claims.
Account data may be deleted or anonymized after access is terminated when it is no longer required. Security and
audit logs may be retained for a limited period after account termination where necessary to protect the Platform,
investigate incidents or demonstrate compliance. Customer-controlled data is retained and deleted in accordance with
the applicable customer agreement and Data Processing Agreement.
12. Security
CardiLink uses appropriate technical and organizational measures designed to protect personal data against
unauthorized or unlawful processing and against accidental loss, destruction, alteration or disclosure. Access to the
CARDILINK GMBH
4
Platform is role-based and security controls are maintained according to the nature of the service and the risks
involved.
No internet-based service can guarantee absolute security. Users must protect their credentials, use the Platform only
through authorized accounts and promptly report suspected unauthorized access.
13. Your GDPR Rights
Subject to the conditions and limitations of applicable law, you may have the right to request access to your personal
data, rectification of inaccurate data, erasure, restriction of processing, data portability where applicable, and to object
to processing based on legitimate interests.
Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of
processing before withdrawal. The processing described for technically necessary authentication/session cookies is
not based on consent.
To exercise rights relating to processing for which CardiLink is controller, contact support@cardi-link.com. If CardiLink
processes the relevant data solely on behalf of your organization, we may refer your request to that organization or
assist it in responding.
14. Right to Lodge a Complaint
You have the right to lodge a complaint with a competent data protection supervisory authority, in particular in the EU
Member State of your habitual residence, place of work or place of the alleged infringement. You may also contact the
supervisory authority competent for CardiLink in Germany.
15. Automated Decision-Making
CardiLink does not use the Platform account, authentication or usage data covered by this Privacy Policy to make
decisions based solely on automated processing that produce legal effects concerning you or similarly significantly
affect you.
16. Changes to this Privacy Policy
CardiLink may update this Privacy Policy where processing activities, legal requirements or the Platform change. The
current version will be made available through the Platform. Where required by law, material changes will be
communicated appropriately before they take effect.