Beacon Privacy

Beacon Terms · Beacon Subprocessors · Beacon Data Processing Agreement · Beacon · German version (binding)

This notice describes how Wilken UG (haftungsbeschränkt), Braugasse 14C, 50859 Cologne, Germany (“Wilken”, “we”), processes personal data in connection with Beacon, the CRM at beacon.wilken.solutions.

Two roles apply. For CRM data about the customer’s contacts, the customer is the controller and Wilken is the processor. For the purposes below, Wilken is itself the controller. Cookies and analytics on wilken.solutions are described in the Privacy Policy. The legal notice has the mandatory company details. No data protection officer is appointed.

Privacy contact: info@wilken.solutions.

As controller, Wilken processes the data it needs for the contract with the customer, for security of the service, and for the global suppression list. That is names and email addresses of users, workspace membership, role, sign-ins, technical logs (IP address, time, errors), and the suppression list (email address and the fact of suppression, not the body of the original message).

Legal bases are Article 6(1)(b) GDPR for the contract, Article 6(1)(c) GDPR for legal duties, in particular the ban on unwanted advertising, and Article 6(1)(f) GDPR for security and for the suppression list beyond a strict legal duty. The interest is to run Beacon safely and not to email people who have objected.

The pages at wilken.solutions/en/beacon/ and the related legal pages run on wilken.solutions. That site’s rules on server logs, cookies, and optional analytics apply. Beacon does not add its own tracking on these pages.

The customer decides which data it stores in Beacon. Typical data are names, business contact details, company data, deals, notes, tasks, email content, attachments, phone numbers, call recordings, transcripts, and field notes about the customer’s contacts.

Wilken processes that data only on the customer’s instructions in order to provide Beacon. The Data Processing Agreement covers subject matter, instructions, deletion, and subprocessors. The Subprocessor List names them.

Special-category data under Article 9 GDPR is not intended. The customer must not submit it without a prior written instruction.

When a workspace uses calling, we process the phone numbers involved, the recording, the transcript, notes typed during the call, follow-up tasks, and an unsent email draft. Voicemails may also be emailed to the workspace owner with links to the matching CRM records.

Twilio carries the call. The recording stays at Twilio only until Beacon has copied it into its own storage and deleted the Twilio copy. Google Gemini creates the transcript. Beacon does not play a recording notice on the call. The customer must have the legal basis toward the person called.

Email may be sent and received through Resend or through the user’s connected Google or Microsoft mailbox. Recipients, content, attachments, and technical sending data are passed to that service. When a user connects a mailbox, they grant Wilken the access covered by the Google or Microsoft sign-in, including draft and calendar sync where the feature needs it.

The customer remains responsible for a legal basis for advertising and for honouring objections.

AI features send the content needed for the task to Google Gemini, for example to draft text, classify replies, transcribe calls, and enrich records. Wilken uses the API so that, under Google’s API terms, Google does not use that content to train its general models. Wilken does not train its own models on it.

Field planning may send place data to Google Maps. Optional checks may send page addresses to Google PageSpeed and DataForSEO. WhatsApp messages go to Meta only if a workspace uses that feature. Form forwarding through Make.com goes to Make only if such a scenario is set up.

AI output can be wrong. It does not replace the customer’s review.

As controller, Wilken stores a suppression list that applies across workspaces. It stores the email address and the fact that it must not be emailed, including a short reason such as an objection or a legally significant reply. The message body is not copied into the list.

The list applies to every workspace Wilken operates so that an objection is not bypassed in another workspace. Workspace administrators cannot lift entries of legal severity. The legal basis is Article 6(1)(c) and (f) GDPR. People may object to storage that is not legally required. An objection to advertising does not remove the suppression.

Beacon’s production database and files are at Supabase in Frankfurt. The application runs on Google Cloud in Frankfurt (europe-west3). HTTPS access uses a Google load balancer.

Google (Gemini, Gmail, Maps, PageSpeed, Cloud), Microsoft, Twilio, Resend, and where used Meta or Make may process data outside the EU, in particular in the United States. Where no adequacy decision applies, the transfer uses standard contractual clauses and, where the provider participates, the EU-US Data Privacy Framework. A residual risk remains that authorities in a third country may demand access. The customer informs its own contacts where it is required to do so.

Wilken keeps CRM data for the contract term and afterwards for the return or deletion period in the Data Processing Agreement. Contract and invoice data are kept while commercial and tax retention periods run. Security logs are deleted once they are no longer needed to investigate incidents, usually after 90 days. Suppression entries stay while the suppression is needed to prevent another approach.

Towards Wilken as controller, people have the rights of access, rectification, erasure, restriction, portability, and objection, the right to withdraw consent, and the right to lodge a complaint with a supervisory authority.

For CRM data, the customer is the contact for the data subject. Wilken assists the customer under the Data Processing Agreement. If a person contacts Wilken, Wilken forwards the request to the customer where Wilken can match the workspace.

The supervisory authority for Wilken’s seat in Cologne is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.

We update this notice when Beacon, the providers, or the law change. The current version is this page. The German version is binding.