Your data. In Germany. Under your control.

The application and your data are held in data centres in Germany. If you also use the AI assistant LuCy, we set out in writing before the start where its processing takes place and on what contractual basis – or we switch the module off for your company.

Nobody without your instruction. For support or troubleshooting we access data only when you request it – tied to a named person, limited to the case and logged. You can end the access at any time.

Group structures, ownership, country-by-country reports, financial figures and tax positions – company data. Personal data is limited to your team’s user accounts: name, email address, role. Headcount enters only as a total per jurisdiction, as the substance test requires.

Yes. Every group works in its own data space with its own access. There is no exchange of data between companies – not in analyses or comparisons.

In transit via TLS, at rest encrypted on the data centre’s systems. Details of methods and key management are set out in the technical and organisational measures you receive with the contract.

LuCy answers questions about the field you are working in from a curated Pillar 2 knowledge base. It is a separate, optional module: which data it processes, where that happens and what happens to it is agreed with you in writing before the start. If you prefer not to use LuCy, we switch the module off for your company.

The application and your data are held in data centres in Germany. The only place where the question arises at all is the AI assistant – and that is optional. Which providers are involved there, in which region they process and on what contractual basis, we set out before the start; if you prefer not to use LuCy, you switch the module off.

A data processing agreement under Art. 28 GDPR, the description of the technical and organisational measures, the list of sub-processors with a right to object to changes, and on request a non-disclosure agreement before detailed discussions. All before signing.

The platform is backed up regularly. Frequency, retention and restore are part of the contract. Independently of that, you can export your data set yourself at any time as a project file.

You export your data completely – group structure, calculations, reports, evidence – as Excel, GIR XML and project file. That lets you meet your own tax retention obligations independently of us and of the software. We then delete your data including backups within the agreed period and confirm the deletion in writing. Where statutory retention obligations prevent deletion, we block the records concerned from further processing and delete them once the period has expired.

The data centres in which Pillarworks runs are certified to recognised standards such as ISO 27001. L+C Technology itself currently holds no certification of its own; instead we disclose our technical and organisational measures in full and answer your IT department’s audit questions directly.

We inform you without undue delay, name the scope and the data affected and agree the next steps with you. We receive vulnerability reports via the address in our security.txt and confirm receipt.

No. The demo and the first conversation run on the fictional group Aurora Energie SE. Your own data only comes into play when you decide – after coordination with your IT and data protection teams and on a contractual basis.