Privacy Policy

RMB Networking UG (haftungsbeschränkt): Internal Finance Management Application

Last updated: 10 September 2026

1. Introduction

This Privacy Policy describes how RMB Networking UG (haftungsbeschränkt) ("RMB", "we", "us") processes personal data in connection with our internal finance management application (the "Application"). The Application is an internal tool used exclusively by RMB Networking UG to manage and monitor the company's own business bank accounts. It is not offered to the general public.

We process personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and applicable German data protection law (Bundesdatenschutzgesetz, "BDSG").

2. Data Controller

The controller within the meaning of Art. 4(7) GDPR is:

Data protection inquiries can be directed to contact@rmb-networking.com.

3. Scope of the Application

The Application connects to the business bank accounts held by RMB Networking UG (and, where applicable, affiliated companies under common management) in order to retrieve account information for internal accounting, liquidity management, and financial reporting purposes. Access to the Application is restricted to authorized personnel of RMB.

4. Open Banking Access via Enable Banking

To retrieve account information, the Application uses the account information services of:

Enable Banking Oy is a registered account information service provider (AISP) under the EU Second Payment Services Directive (PSD2), supervised by the Finnish Financial Supervisory Authority (Finanssivalvonta).

When an authorized representative of RMB connects a bank account, they are redirected to the authentication interface of the respective bank and authorize access in accordance with PSD2. Enable Banking processes the data required to establish and maintain this connection under its own privacy policy, available at https://enablebanking.com/privacy/. We recommend reviewing it.

We do not receive or store online banking credentials at any time. Authentication takes place directly between the account holder's representative and the bank.

5. Automated Processing by AI Models

To reduce manual bookkeeping effort, the Application sends selected content to large language models. This happens for the following tasks:

Matching bank transactions to vouchers: deterministic rules run first, using amount, direction, date, voucher number and contact name. Only where several vouchers remain equally plausible are the payment reference and counterparty name of the transaction sent to a model, together with a shortlist of candidate vouchers.

Reading receipts and invoices: uploaded documents are transcribed and their key fields extracted.

Classifying expenses: assigning an accounting category to an incoming voucher.

Assembling travel and hospitality files: where an email forms part of the evidence, an excerpt of its text is included, because the business purpose of a trip is usually stated only there.

An assignment requires at least two independent features: the amount and either the voucher number or the counterparty's name in the payment text. Where the rules alone are conclusive, no model is involved. Where several vouchers remain plausible, a model chooses among them; it cannot assign a voucher that has not already passed these checks. Every automatic assignment records what it was based on, can be reversed, and once reversed is not made again. This does not constitute a decision producing legal or similarly significant effects on a natural person within the meaning of Art. 22 GDPR.

Service provider. Requests are routed through OpenRouter, Inc. (United States), which forwards each request to the model provider selected for the task. The providers currently used are Google, OpenAI and Meta. OpenRouter acts as a processor under Art. 28 GDPR. Routing is restricted to providers that do not retain request content for training purposes.

What we store ourselves. For each request we record metadata only: task, model, token count, cost, duration, and whether it succeeded. Request content is not stored. Model responses are stored only where the response itself is the feature the user asked for, and are removed once no longer needed.

Legal basis. Art. 6(1)(f) GDPR (legitimate interest in keeping our own books efficiently and correctly).

Access by assistants. Authorized personnel can connect an AI assistant to the Application through a dedicated read-only interface (Model Context Protocol). Each assistant has its own revocable key, and every access is logged. Data retrieved this way, which may include names of counterparties and payment references, is processed by the provider of the respective assistant, acting as a processor under Art. 28 GDPR. Records cannot be created, changed or deleted through this interface.

6. Categories of Data Processed

Through the Application, we process the following categories of data:

Account information retrieved via Enable Banking: account identifiers (e.g. IBAN), account names and currency, account balances, and transaction data (booking date, amount, counterparty name and IBAN, payment reference). Because the connected accounts are business accounts of RMB, this data is primarily company data; however, transaction records may contain personal data of natural persons (e.g. names of counterparties, employees, or business contacts appearing in payment references).

Accounting records retrieved read-only from Lexoffice (Haufe-Lexware GmbH & Co. KG), which RMB uses as its accounting system: vouchers, invoices and contacts. Incoming invoices and receipts may contain personal data of third parties, such as names, addresses and VAT identification numbers of suppliers and customers.

User data of authorized personnel operating the Application: name, business email address, authentication data (e.g. hashed credentials or SSO identifiers), and technical log data (timestamps and the actions performed) generated when using the Application. IP addresses of users are not recorded.

We do not process special categories of personal data (Art. 9 GDPR) through the Application, and we do not use the data for automated decision-making or profiling within the meaning of Art. 22 GDPR.

7. Purposes and Legal Bases of Processing

We process the data described above for the following purposes:

Financial management and accounting: retrieving and displaying account balances and transactions of RMB's own accounts for bookkeeping, reconciliation, liquidity planning, and internal reporting. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the orderly administration of our own finances) and, where processing is necessary to comply with statutory accounting and retention obligations (e.g. under the German Commercial Code (HGB) and Fiscal Code (AO)), Art. 6(1)(c) GDPR.

Operation and security of the Application: user authentication, access control, and logging to ensure the security and integrity of the system. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in securing our IT systems).

Compliance with legal obligations: fulfilment of retention, tax, and audit obligations. Legal basis: Art. 6(1)(c) GDPR.

8. Recipients of Data

Personal data is disclosed only to the extent necessary: to Enable Banking Oy as account information service provider (see Section 4); to hosting and IT infrastructure providers engaged by RMB, which act as processors under Art. 28 GDPR on the basis of data processing agreements; to OpenRouter, Inc. and the model providers it routes to, for the automated processing described in Section 5; to tax advisors, auditors, and public authorities where required by law; and to the connected banks, which process data as independent controllers when executing the PSD2 authorization.

We do not sell personal data and do not share it with third parties for marketing purposes.

9. International Data Transfers

The Application is hosted in Germany (Hetzner Online GmbH, Nuremberg). Enable Banking Oy processes data within the EU/EEA.

Data is transferred outside the EU/EEA in one case: the AI processing described in Section 5. OpenRouter, Inc. and the model providers it routes to are established in the United States. These transfers are based on the EU Standard Contractual Clauses (Art. 46 GDPR) agreed in the providers' data processing terms and, where the recipient is certified, on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR).

10. Retention

Account and transaction data used for accounting purposes is retained for the statutory retention periods under German commercial and tax law (currently eight years for accounting vouchers and ten years for books and annual financial statements, Sec. 257 HGB, Sec. 147 AO). Technical log data is retained for a short period appropriate to its security purpose and then deleted. Bank connections established via Enable Banking are subject to the consent validity periods under PSD2 (typically up to 180 days) and can be revoked at any time by the account holder; upon revocation, no further data is retrieved. Data that is no longer required for the purposes described above and not subject to statutory retention is deleted.

11. Data Security

We implement appropriate technical and organizational measures (Art. 32 GDPR) to protect the data processed through the Application, including encrypted transmission (TLS with HSTS), two-factor authentication available for all user accounts, encryption at rest of the database, uploaded documents and backups (LUKS2, with the key held by an authorized representative and not stored on the server), access controls, and logging of sign-ins and of changes to accounting records. The Application is hosted on dedicated infrastructure that serves no other purpose; it does not share a server, a database, or a hosting provider with our public website. Access to the Application is limited to authorized personnel of RMB who are bound by confidentiality.

12. Your Rights

Individuals whose personal data we process have the following rights under the GDPR, subject to the applicable legal conditions: the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and the right to object to processing based on legitimate interests (Art. 21).

To exercise these rights, please contact contact@rmb-networking.com.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The supervisory authority responsible for RMB is the Hessischer Beauftragter für Datenschutz und Informationsfreiheit (HBDI), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.

13. No Cookies / Tracking

The Application is an internal tool and does not use marketing or analytics cookies. Only technically necessary session mechanisms required for authentication and operation of the Application are used.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example when the Application's functionality or the legal framework changes. The current version is available to all users of the Application; the date of the last revision is indicated at the top of this document.

15. Contact

For any questions regarding this Privacy Policy or our data processing practices: