PRIVACY NOTICE
28.10.2026

As a leading European provider of open solutions for Building Information Modeling (BIM), we are aware of our data protection responsibilities toward our customers and their employees. Therefore, we process personal data exclusively in accordance with applicable legal provisions.

Preamble
In the following, we would like to inform you about the collection (and processing) of personal data when using the following software products and services (hereinafter referred to as “our software products and services”):
- Allplan products
- FRILO products
- DC products
- SCIA products
- SDS2 products
According to the legal definition, personal data is any data relating to an identified or identifiable natural person (e.g., name, address, email address, IP address, user behavior).
You are under no legal or contractual obligation to provide us with your personal data. However, providing certain personal data may be necessary in order to fully utilize our software products and services.

I. Data Controller
The data controller pursuant to Article 4(7) of the EU General Data Protection Regulation (GDPR) with respect to our software products and services is
Allplan GmbH
Konrad-Zuse-Platz 1
81829 Munich
Germany
Email:info@allplan.com
 You can contact our Data Protection Officer at DATAPROTECTIONOFFICER[AT]Allplan.COM or by mail, marked “Attn: Data Protection Officer.”

II. Data Collection When Using Our Software Products and Services
1. Activation / Transfer / Offline Activation of Our Software Products

1.1. To use your Allplan software product up to version 2024-1-x or the service in accordance with your license agreement, you must activate your license online using the product key (26-character string) provided to you. Activation can take place during installation or later. Activation links the license to your computer or CM Stick, and you can launch the Allplan software product on that computer or on a computer to which the CM Stick is connected.
To verify your contractual entitlement to the Allplan software product and to activate your license, the 26-character product key and your system data—including your hostname and IP address—are transmitted to our license servers and stored there along with the date and time of activation and a container number/CM-Stick number assigned to you.
The aforementioned data is collected during each reactivation (license return and reactivation) as well as during offline activation (including offline reactivation).
The legal basis for the aforementioned data processing is Article 6(1)(b) of the GDPR.
Our license servers are operated within the EU; no transfer to third countries takes place, nor is one planned for the future. To protect your personal data, we have entered into data processing agreements with our service providers in accordance with the requirements of Article 28 of the GDPR.
Your personal data will be stored only for as long as necessary to fulfill our license agreement, provided that no statutory retention requirements prevent its deletion.

1.2. Regarding the use of your Allplan software product (version 2024-2 or later), Frilo software products (version 2026 or later), and/or SCIA ID login
When activating an Allplan, Frilo, or SCIA product, the user’s Allplan or SCIA ID (first name, last name, email address) is transmitted, along with certain technical data (e.g., timestamp, IP address, license details), to our identity and license management service provider (www.10Duke.com) to verify eligibility for the service. No other personal data is transmitted to Allplan, SCIA, or other parties.
We process personal data solely for the purpose of authenticating your Allplan or SCIA ID.

The legal basis for the aforementioned data processing is Article 6(1)(b) of the GDPR.
Our license servers are operated within the EU; no transfer to third countries takes place, nor is one planned for the future. To protect your personal data, we have entered into data processing agreements with our service providers in accordance with the requirements of Article 28 of the GDPR.
Your personal data will be stored only for as long as necessary to fulfill our license agreement, and statutory retention requirements do not preclude its deletion.

1.3. To use your FRILO software product, version 2025 or earlier
To activate a FRILO product, the customer number is used and sent to the licensing system. When a license is used, a unique hardware ID is sent to the license server. Optionally, the hostname and username can also be sent if the user has enabled this feature.

Updating the License
From time to time, it may be necessary to update the license key. In this case, the data listed above is transmitted to our license server to verify eligibility for the update.

2. Updating the Software Product
In order for your computer to connect to our update servers to check for and download updates, it is technically necessary for your IP address to be transmitted to our update servers.
The legal basis for the above-mentioned data processing is Article 6(1)(b) of the GDPR.
Our update servers are operated within the EU; no transfer to third countries takes place, nor is one planned for the future. To protect your personal data, we have entered into data processing agreements with our service providers in accordance with the requirements of Article 28 of the GDPR.
Your IP address is stored on our update servers only for as long as is necessary to search for and download updates, but no longer than 30 days after the completion of the respective update process.
Without the transmission of the IP address, a connection to our update servers cannot be established.

3. Crash Reports
If a program or software error (crash) occurs while using your Allplan or Frilo software product, a dialog box will ask you if you would like to send us a crash report.

Submitting a crash report is voluntary. You decide for yourself whether to send us the crash report by clicking the “Send Crash Report” button. If you do not submit the crash report, this will not affect your use of your Allplan or Frilo software product. However, without the crash report, we cannot analyze and resolve the crash in question.

When you click the “Send Crash Report” button, various pieces of information about you (customer number, computer name, username, and various technical details) are collected in a file, compressed, and transmitted in encrypted form to our server so that we can analyze and resolve the crash in question. Providing your email address so we can contact you with questions is also voluntary and not a prerequisite for submitting the crash report.

The legal basis for the processing is your consent pursuant to Article 6(1)(a) of the GDPR, which you provide by clicking the “Send Crash Report” button. You may refuse to submit the crash report at any time. The lawfulness of the processing carried out prior to your refusal remains unaffected.
Our server is operated within the EU; no transfer to third countries takes place, nor is one planned for the future.
Crash reports are stored on our server only for as long as necessary to analyze and resolve the respective crash, but no longer than until a new version of your Allplan software product is released.
Without the transmission of the information mentioned above, the respective crash cannot be analyzed and resolved .

4. Support Requests
To enable our support team to identify you as our customer, contact you, and respond to your support request in accordance with the contract, you must provide an address, your name or the name of a contact person, and a direct phone number.
The legal basis for the above-mentioned data processing is Article 6(1)(f) of the GDPR.
Our support server is operated within the EU; no transfer to a third country takes place, nor is one planned for the future.
Your data will be stored only for as long as necessary to respond to your support request and provided that statutory retention requirements do not preclude its deletion.
Without your contact address, name, and direct phone number, our support team cannot respond to your support request.

5. Help Function
You can access our online help in your browser via the “Help” dialog box or by pressing the F1 key in your software product (link).
If you would like to learn more about the collection and processing of data in connection with our online help, please refer to our relevant privacy notices, which you can find on our help website.

6. Add-ons

If you use an add-on with our software products, the add-on may request certain information from or transmit certain information to our software products or services. This may include, in particular, information regarding license authorization and technical usage, such as the license container code, the license or product ID, customer number, technical data regarding the Allplan ID, the product version, information about the device or workstation being used, as well as the date and time of access. The specific information processed in each case depends on the respective add-on and its functions. Personal data is processed only to the extent necessary to provide the add-on, verify usage and license authorization, provide technical support, or ensure security and functionality.

The use of an add-on may involve the transfer of personal data to the respective add-on provider or to service providers engaged by that provider. Data is transferred only to the extent necessary for the respective add-on function and provided there is a corresponding legal basis under data protection law. In doing so, we generally transfer only the data necessary for the respective purpose. Content that you create or edit using the add-on is not transferred by us to the add-on provider, unless this is expressly required for the respective add-on function.

The allocation of roles under data protection law depends on the specific nature of the respective processing. To the extent that a corporate customer determines the purposes and means of the processing of personal data, the corporate customer is the data controller for this processing. To that extent, we process the relevant personal data as a data processor for the corporate customer. In this case, the add-on provider is either involved as an additional data processor for the corporate customer or processes the data as an independent data controller, provided that it determines the purposes and means of the processing itself. To the extent that we determine the purposes and means of the processing, we are the data controller. To the extent that the add-on provider processes personal data on our behalf and in accordance with our instructions, it is our data processor. The applicable division of roles is specified in more detail in the privacy policy or other contractual documents applicable to the relevant add-on.

To the extent that an add-on provider processes personal data as an independent data controller, it is responsible for this processing itself. The add-on provider’s privacy policy applies to this processing. We recommend that you read this privacy policy before using the add-on. To the extent that the add-on provider acts as a data processor, the processing is carried out on the basis of a data processing agreement or a corresponding arrangement in accordance with Article 28 of the GDPR. Additional data processors may only be engaged to the extent permitted for this purpose.

The legal basis for the respective processing is determined by the specific allocation of roles and the respective purpose of processing. To the extent that we process personal data to fulfill a contract to which the data subject is a party, or to take pre-contractual measures at the data subject’s request, the processing is based on Article 6(1), sentence 1, letter b of the GDPR. In all other cases, processing is carried out on the relevant legal basis, in particular Article 6(1), first sentence, letter f of the GDPR or—where necessary—on the basis of your consent pursuant to Article 6(1), first sentence, letter a of the GDPR. The use of an add-on may be subject to consent if the specific add-on function requires it. The use of our other software products and services remains unaffected by this, provided that the add-on is not necessary for their use.

To the extent that personal data is transferred to recipients outside the European Union or the European Economic Area or made accessible from there, we will inform you of the applicable safeguards and the relevant legal basis for the transfer in the privacy policy for the add-on in question or in other relevant privacy policies. This may include, in particular, an adequacy decision pursuant to Article 45 of the GDPR or appropriate safeguards pursuant to Article 46 of the GDPR, such as standard data protection clauses.

We store personal data related to add-ons only for as long as is necessary for the respective purpose. To the extent that statutory retention obligations or the assertion, exercise, or defense of legal claims require longer storage, the storage period may be extended accordingly. Once the respective purpose no longer applies, the data will be deleted or anonymized, provided there is no legal obligation or legally permissible reason for further storage.

The processing of personal data in connection with add-ons is carried out in compliance with applicable data protection requirements and appropriate technical and organizational measures. Details regarding the processing—in particular the specific categories of data, purposes, recipients, retention periods, and international data transfers—can be found in the privacy policy of the respective add-on and its manufacturer.

7. Integration of the AI Visualizer

In Allplan, it is possible to use an interface to the AI Visualizer. This integration enables seamless communication, allowing users to have sketches, plans, or other graphics created in Allplan graphically enhanced or redesigned via the AI Visualizer using screenshots.

To do this, the screenshots and the prompts entered by the user are sent to the application hosted by AWS in the United States. The application is not designed to process personal data contained in the prompts; therefore, such use is expressly prohibited in our Terms of Service. For the purpose of user identification, the application receives the user’s IP address, name, and email address via an access token.

Since the application is hosted by Amazon Web Services, Inc. in the United States, this constitutes a transfer of personal data to a third country. The transfer to Amazon Web Services, Inc. is based on the EU-U.S. Data Privacy Framework.

The transfer of personal data to Vectorworks Inc. in the United States is governed by the European Commission’s Standard Data Protection Clauses pursuant to Implementing Decision (EU) 2021/914, Module 1 (Transfer from Controller to Controller).

Allplan will not disclose any data without the user’s action.

The legal basis for accessing your data is your consent pursuant to Section 25(1) of the TDDDG. The legal basis for the data processing described is your consent pursuant to Article 6(1), sentence 1, subparagraph (a) of the GDPR.

The AI Visualizer is not permanently linked to your account; you can terminate the connection at any time by closing your browser. From that point on, no further data can be transmitted to the AI Visualizer.

The purpose of the data transfer is to facilitate data usage across platforms so that you can work more efficiently with the solutions offered by Allplan and Vectorworks Inc. Allplan and Vectorworks Inc. are joint controllers within the meaning of Article 26 of the GDPR with respect to the processing of personal data associated with the use of the AI Visualizer. The respective roles and responsibilities are set forth in an agreement pursuant to Article 26 of the GDPR; the key provisions of this agreement are made available to data subjects.

For more information about the AI Visualizer and the respective retention periods for the collected data, please refer to Vectorworks Inc.’s Privacy Policy. There you will also find further information on joint controllership and transfers to third countries.

8. Recording of the Use of Our Software and Services

8.a) Program to Improve the Customer Experience

To continuously improve our software and services, we may collect usage data regarding our products and services if you have enabled the improvement program. In this case, we collect the following data:

·        IP address,

·        User ID,

·        Date and time of access,

·        Function calls / user commands,

·        Customer number,

·        Workstation,

·        Allplan product and product version

·        Project-related information

We use this data exclusively to ensure the smooth operation of the software product, to evaluate program security and stability, and to further develop our solutions.

The legal basis is our legitimate interest pursuant to Article 6(1)(f) of the GDPR in ensuring the smooth operation of the software product, evaluating program security and stability, and further developing our solutions. You may object to this processing at any time for reasons arising from your particular situation, in accordance with Article 21 of the GDPR. You may also disable the improvement program in the settings of your software product. The lawfulness of the processing carried out prior to the objection taking effect or the program being disabled remains unaffected.

We store the data only for as long as necessary to achieve the respective purpose, generally for a maximum of 12 months.

8.b) Detection and Tracking of Unlicensed Use

Our Allplan software products contain technical measures to verify whether a valid license is being used for the respective Allplan software product and whether the agreed-upon license terms are being complied with (double or multiple use). If it is determined that the binary files responsible for license enforcement have been modified or replaced, or that unauthorized double or multiple use is occurring, the following information is documented and transmitted to us:

 

·       Name of the user or the company using the software

·       Start and end of use

·       Nature and scope of usage activities

·       Date and time of access

·       IP address and MAC address

·       Information about the detected changes to the license-relevant binary files

We use this information to identify the responsible user or company, to assert our civil claims arising from unauthorized use, and, if necessary, to initiate criminal proceedings.

Furthermore, in geographically defined countries outside the European Union where civil enforcement of our license claims is effectively impossible, we are technically capable of remotely deactivating the affected software instance as soon as a license violation as described above is detected. As a result of this deactivation, access to the software’s functions and, where applicable, to content uploaded in connection with the use of the software—which may also contain personal data—is no longer possible.

No decision based solely on automated processing within the meaning of Article 22 of the GDPR is made; each suspected case is individually reviewed by qualified employees before any legal action or remote deactivation is initiated.

The legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest stems from the need to protect our software products from unauthorized use, to safeguard our claims for compensation, and to protect our intellectual property rights.

We use Flexera Software LLC, d/b/a Revenera (headquarters: 300 Park Boulevard, Suite 500, Itasca, IL 60143, USA) as a data processor for the technical detection of unlicensed use. Flexera, in turn, engages additional sub-processors; the current list is available at https://community.flexera.com/s/Sub-Processors. Since Flexera and a significant portion of its sub-processors are located outside the European Union or the European Economic Area, the use of this service provider involves the transfer of your personal data to third countries. The transfer is based on the EU Standard Contractual Clauses (Module 2, Controller to Processor). We have entered into a data processing agreement with Flexera in accordance with Article 28 of the GDPR. Other recipients may include our external attorneys, courts, and law enforcement agencies, to the extent necessary to enforce claims or due to legal obligations . You may request a copy of the appropriate safeguards from our Data Protection Officer.

We store the information only for as long as necessary to achieve the respective purpose, but generally for a maximum of 60 days in the case of unconfirmed suspected violations and for a maximum of three years after the conclusion of legal proceedings in the case of confirmed violations, unless statutory retention requirements or the defense against legal claims require longer storage.

Pursuant to Article 21 of the GDPR, you have the right to object at any time to the aforementioned processing on grounds relating to your particular situation.

III. Data Collection When Using Allplan Services
You can connect to our (online) platforms, Allplan Services, via your Allplan software product. This occurs automatically when you are using a valid Allplan ID.
In order for your Allplan software product to establish a connection to our (online) platforms, it is technically necessary for your IP address to be transmitted to our servers each time you log in or use the product.
The legal basis for the aforementioned data processing is Article 6(1), sentence 1, lit. b) of the GDPR.
Our servers are operated within the EU; no transfer to third countries takes place, nor is one planned for the future. To protect your personal data, we have entered into data processing agreements with our service providers in accordance with the requirements of Article 28 of the GDPR.
Your IP address is stored on our servers only for as long as is necessary for the respective connection, but no longer than 60 days after the connection ends.
A connection to our servers cannot be established without transmitting the IP address.
If you would like to learn more about the collection and processing of data in connection with our (online) platforms Allplan Connect/Allplan Campus and Allplan Cloud, please refer to our respective privacy notices, which you can find on the relevant websites.

IV. Other Processing or Transfer of Personal Data
As a general rule, we do not disclose your personal data to third parties for purposes other than those mentioned above.
Your personal data will only be disclosed for purposes other than those mentioned above if
- you have given your (prior) express consent to such disclosure,
- the disclosure is necessary to assert, exercise, or defend legal claims, and there is no reason to believe that you have an overriding legitimate interest in preventing the disclosure of the data in question,
- there is a legal obligation to disclose the data, or
- the disclosure is permitted by law and necessary for the performance of the contractual relationship with you.

V. Rights of the Data Subject
In general, you have the right:
- pursuant to Article 15 of the GDPR, to request information about the personal data we process,
- pursuant to Article 16 of the GDPR, to request the rectification of your personal data stored by us,
- pursuant to Article 17 of the GDPR, to request the erasure of your personal data stored by us,
- pursuant to Article 18 of the GDPR, to request the restriction of the processing of your personal data,
- pursuant to Article 20 of the GDPR, to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, or to request that it be transmitted to another controller.
The right of access and the right to erasure are subject to the restrictions set forth in Sections 34 and 35 of the BDSG.

VI. Right to Object
If your personal data is processed on the basis of legitimate interests pursuant to Article 6(1)(f) of the GDPR, you have the right to object to the processing of your personal data pursuant to Article 21 of the GDPR, provided there are grounds for doing so arising from your particular situation. When exercising such an objection, we ask that you explain the reasons why we should not process your personal data as described by us. In the event of a justified objection, we will review the situation and either cease or adjust the data processing or explain our compelling and legitimate reasons to you. If you wish to exercise your right to object, simply send an email to DATAPROTECTIONOFFICER[AT]Allplan.COM.

VII. Withdrawal of Consent
You may withdraw your consent to the processing of your personal data at any time. Please note that the withdrawal applies only prospectively; therefore, the processing that has taken place up to that point remains lawful. If you wish to withdraw your consent in a specific case, simply send an email to DATAPROTECTIONOFFICER[AT]Allplan.COM.

Withdrawal of consent results in our ceasing the respective processing based on that consent with future effect. You will no longer be able to use the relevant feature (e.g., AI Visualizer, Improvement Program, Recommendations) thereafter. The use of your software product in all other respects remains unaffected by this; in particular, consent to the Improvement Program and the Recommendations is not a prerequisite for using your licensed software product

VIII. Complaint Procedure
In accordance with Article 77 of the GDPR, you have the right to lodge a complaint with the competent data protection supervisory authority regarding the processing of your personal data. This is generally the data protection supervisory authority of your habitual place of residence or of our corporate headquarters.

X. Changes to the Privacy Policy
We reserve the right to change or amend this Privacy Notice at any time in accordance with applicable data protection regulations. You can also access the current Privacy Notice at any time (i) for Allplan products via the “Allplan Privacy Notice” dialog box in your Allplan software product or via the following link:
- https://help.allplan.com/legal/1033-allplan-privacy.html