Skip to content
5sDesk

Privacy Policy

Last updated: 12 October 2026

This is a translation for convenience. The German version is legally binding.

1. Controller

The controller within the meaning of the GDPR is:
SWT Media & Software GmbH
Nürnberger Str. 7, 15738 Zeuthen, Germany
Email: info@5sdesk.com

Further details can be found in our Imprint. No data protection officer has been appointed at present.

2. General information on data processing

We process personal data of our website visitors and customers only to the extent necessary to provide this website and 5sDesk, or where you have consented to the processing.

3. Provision of the website and creation of log files

When you visit this website, our hosting provider (Hetzner Online GmbH, Gunzenhausen, data centre in Nuremberg) automatically collects technical data (IP address, date and time, page requested, referrer, browser type) and stores it briefly in log files. The legal basis is our legitimate interest in the technically sound and secure operation of the website (Art. 6 (1) (f) GDPR).

4. Cookies, fonts and audience measurement on the website

The font used is served from our own server; no fonts are loaded from Google or other third parties. A notice that you close on the website is recorded only in your browser's session storage and is deleted when you close the browser.

Cookie consent

On your first visit, a cookie banner asks whether you allow cookies and similar technologies for statistics and marketing. Without your consent, only technically necessary technologies are used. Your choice is stored in your browser's local storage (180 days) and you can change or withdraw it at any time via the "Cookie settings" link in the footer.

When you make a choice in the cookie banner, we store the following data on a server of our service provider as proof of your consent (Art. 7 (1) GDPR): the time of the decision, a random identifier (UUID), the categories you chose, the banner version shown, your language setting, your browser (user agent) and a cryptographically hashed version of your IP address that cannot be traced back to you. The legal basis is our legal obligation to be able to demonstrate consent (Art. 6 (1) (c) in conjunction with Art. 7 (1) GDPR). This data is deleted automatically after three years. You can ask us to delete your entry at any time unless a legal retention obligation prevents us from doing so; contact info@5sdesk.com.

Google Tag Manager (statistics category)

With your consent we use Google Tag Manager, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to load audience measurement services. Tag Manager itself sets no cookies; the Google services loaded through it process usage data (pages viewed, time on page, truncated IP address, device data) and may transfer data to the USA. Google is certified under the EU-US Data Privacy Framework. The legal basis is your consent (Art. 6 (1) (a) GDPR, section 25 (1) of the German TDDDG). We use Google Consent Mode: without your consent no measurement or advertising cookies are set, and Google Ads only receives the cookieless signals described under "Google Ads".

Google Ads (marketing category)

With your consent we use Google Ads conversion tracking, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to measure whether a click on one of our ads led to a sign-up or a later subscription, and to target ads. After an ad click Google sets the cookies _gcl_aw and _gcl_gs containing a click identifier. When you complete the sign-up we report that event to Google together with a cryptographically hashed version of your e-mail address ("enhanced conversions"); Google does not receive the address itself. We store the click identifier with your account and later report a plan subscription to Google with its time and net amount, without any further personal data. Google may transfer data to the USA and is certified under the EU-US Data Privacy Framework. The legal basis is your consent (Art. 6 (1) (a) GDPR, section 25 (1) of the German TDDDG).

Without your consent we use Google Consent Mode in its so-called advanced mode: the Google Ads services are still loaded, but they set no cookies and read no click identifier. Instead your browser sends cookieless signals to Google, such as the time, the page visited, browser information, your IP address, whether the page was reached through an ad, your consent status and, for a sign-up, the fact that a sign-up took place – without your e-mail address or any other identifier. Google uses these signals to model conversions statistically and, according to Google, does not link them to a user profile. The legal basis is our legitimate interest in measuring the success of our ads (Art. 6 (1) (f) GDPR). Without your consent we do not store the click identifier with your account. You can object to this processing at any time, for example by e-mail to info@5sdesk.com.

Meta Pixel (marketing category)

With your consent we use the Meta Pixel, provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland, to measure the effectiveness of our ads on Facebook and Instagram and to target them. Page views, browser data and the cookies _fbp and _fbc are processed and transferred to Meta, including to the USA (Meta is certified under the EU-US Data Privacy Framework). We are joint controllers with Meta for this collection (Art. 26 GDPR); Meta publishes the agreement at facebook.com/legal/controller_addendum. The legal basis is your consent (Art. 6 (1) (a) GDPR, section 25 (1) of the German TDDDG).

When you sign in to the 5sDesk application, we set a technically necessary session cookie to keep you signed in during the session (Art. 6 (1) (b) GDPR); this does not require consent.

5. Contact form

If you use the contact form on this website, we process the details you enter (name, company, email address, message) in order to handle your enquiry. The form is provided by 5sDesk itself; your enquiry is stored as a ticket in our own 5sDesk system, which is operated in Germany. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures) or Art. 6 (1) (f) GDPR (responding to enquiries). The data is deleted once your enquiry has been dealt with in full and no statutory retention obligations stand in the way.

6. Bot protection (ALTCHA)

To protect registration, sign-in, the customer portal, forms and appointment booking against automated access, we use ALTCHA, an open-source method that runs entirely on our own infrastructure. No data is transferred to a third-party provider. The legal basis is our legitimate interest in a service that is protected against misuse (Art. 6 (1) (f) GDPR).

7. Connection to Microsoft 365 and Microsoft Teams

If an organisation connects its Microsoft 365 mailbox, its Microsoft calendar or Microsoft Teams to 5sDesk, 5sDesk accesses emails, calendars or Teams notifications on behalf of that organisation via the interfaces provided by Microsoft (Microsoft Graph, Azure Bot Service). These connections are authorised by the respective organisation itself and are additionally governed by its own contractual relationship with Microsoft Ireland Operations Limited.

8. Connection to Google Calendar

Members of an organisation can voluntarily connect their own Google Calendar to 5sDesk in order to use appointment booking. To do so, the person signs in with Google and expressly grants 5sDesk access. 5sDesk receives the following data from Google:

  • the email address, name and an internal identifier of the Google account, to attribute the connection;
  • the busy periods of the primary calendar (start and end only, no titles, locations or attendees), to offer only free time slots for booking and to show them as busy in the calendar view;
  • events that 5sDesk itself created, to reschedule or cancel them.

When a customer books an appointment, 5sDesk creates an event in the person's Google Calendar containing the booking details (name, email address, the customer's telephone number and message where provided, meeting link). For Google Meet appointments the customer is added as an attendee and receives the invitation from Google. The person's own calendar entries and planned sales actions from 5sDesk are also copied to Google Calendar as events. 5sDesk does not access any other events or calendars of the person.

5sDesk stores the access token in encrypted form, together with the email address, name and the identifiers of the events it created. The busy periods are not stored permanently. If the person disconnects, we delete the token and revoke it with Google; the email address and name remain stored for matching on a later reconnection, and events already created remain in Google Calendar. You can also revoke access at any time at myaccount.google.com/permissions.

We use data from Google services solely for appointment booking and the calendar view. We do not pass it on to third parties, do not use it for advertising, do not transmit it to AI services and do not use it to train AI models.

5sDesk's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The legal basis is the performance of the contract with the organisation (Art. 6 (1) (b) GDPR) and the person's consent when connecting (Art. 6 (1) (a) GDPR). The organisation's contractual relationship with Google Ireland Limited also applies.

Google Calendar (summary)

Agents can optionally connect their own Google Calendar to 5sDesk to offer appointment booking. With the agent's explicit consent, 5sDesk accesses the Google account's email address, name and account identifier (to link the connection), free/busy information of the primary calendar (start and end times only, no titles, locations or attendees, to offer only available time slots and to show busy times in the calendar view) and events that 5sDesk itself created (to reschedule or cancel them).

When a customer books an appointment, 5sDesk creates an event in the agent's Google Calendar containing the booking details (customer name, email, phone number and message if provided, meeting link). For Google Meet appointments the customer is added as an attendee and receives Google's invitation. Calendar entries and planned sales actions created in 5sDesk are copied to Google Calendar as well. 5sDesk never reads or modifies other events or calendars.

5sDesk stores the OAuth refresh token encrypted, plus the account's email address, name and the IDs of the events it created. Free/busy data is not stored persistently. When the agent disconnects, the token is deleted and revoked with Google; the email address and name are kept to match a later reconnection, and events already created remain in the calendar. Access can also be revoked at any time at myaccount.google.com/permissions.

Google user data is used solely to provide appointment booking and the calendar view. It is not shared with or sold to third parties, not used for advertising, not sent to AI services and not used to train AI or machine-learning models. 5sDesk's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

9. AI-assisted features

5sDesk offers optional AI features that each organisation can switch on (for example suggested wording for replies, ticket summaries, pre-filling of customer details), provided via the interfaces of Anthropic PBC or OpenAI (both USA). If an organisation activates this feature with its own API key, selected content of the ticket in question is transmitted to the chosen provider for that purpose. This constitutes a transfer to a third country; the organisation concludes the contract with the provider itself. Without activation, no transfer takes place. Every request is logged in 5sDesk.

10. Optional Freshdesk import

Organisations can import existing data from Freshdesk (Freshworks Inc.) by storing their own Freshdesk API key in 5sDesk. This import is triggered by the respective organisation itself and concerns only its own ticket and customer data.

11. Payment processing

Billing for the plans is handled by Paddle.com Market Ltd. as reseller (Merchant of Record). When a plan is booked, payment details are collected and processed directly by Paddle; 5sDesk does not receive complete payment details. Paddle's privacy notice applies.

12. Disclosure of data

We do not sell personal data. Data is disclosed only to the services named above, to hosting and infrastructure providers we use under a data processing agreement, or where we are legally obliged to do so.

13. Retention

We store personal data only for as long as is necessary for the purposes stated, or for as long as statutory retention obligations exist.

14. Rights of the data subject

Under the GDPR you have the following rights:

  • access to the data stored about you (Art. 15 GDPR)
  • rectification of inaccurate data (Art. 16 GDPR)
  • erasure of your data (Art. 17 GDPR)
  • restriction of processing (Art. 18 GDPR)
  • data portability (Art. 20 GDPR)
  • objection to processing (Art. 21 GDPR)
  • withdrawal of consent given, with effect for the future (Art. 7 (3) GDPR)
  • lodging a complaint with a data protection supervisory authority (Art. 77 GDPR)

To exercise these rights, an informal message to info@5sdesk.com is sufficient.

15. Changes to this privacy policy

We update this privacy policy whenever our data processing or the legal situation changes. The version currently published on this page applies.