--- title: "Privacy Policy – Octily" source: https://octily.com/privacy-policy/ description: "Learn how Octily handles your personal data. GDPR-compliant privacy policy covering data collection, cookies, analytics, and your rights." --- # Privacy Policy Last updated: October 15, 2026 ## Privacy settings Measure my visit On: we measure your visit storage-free (see section 5). Turn it off to object; we then send no analytics data and no chatbot page visits from this browser. Push notifications are only active if you turned them on yourself. You can turn them off with any of our push buttons or in your browser settings. ## 1. An overview of data protection ### General information The following information will provide you with an easy to navigate overview of what will happen with your personal data when you visit this website. The term “personal data” comprises all data that can be used to personally identify you. For detailed information about the subject matter of data protection, please consult our Data Protection Declaration, which we have included beneath this copy. ### Data recording on this website #### Who is the responsible party for the recording of data on this website (i.e., the “controller”)? The data on this website is processed by the operator of the website, whose contact information is available under section “Information about the responsible party (referred to as the ‘controller’ in the GDPR)” in this Privacy Policy. #### How do we record your data? We collect your data as a result of your sharing of your data with us. This may, for instance be information you enter into our contact form. Other data shall be recorded by our IT systems automatically or after you consent to its recording during your website visit. This data comprises primarily technical information (e.g., web browser, operating system, or time the site was accessed). This information is recorded automatically when you access this website. #### What are the purposes we use your data for? A portion of the information is generated to guarantee the error free provision of the website. Other data may be used to analyze your user patterns. #### What rights do you have as far as your information is concerned? You have the right to receive information about the source, recipients, and purposes of your archived personal data at any time without having to pay a fee for such disclosures. You also have the right to demand that your data are rectified or eradicated. If you have consented to data processing, you have the option to revoke this consent at any time, which shall affect all future data processing. Moreover, you have the right to demand that the processing of your data be restricted under certain circumstances. Furthermore, you have the right to log a complaint with the competent supervising agency. Please do not hesitate to contact us at any time if you have questions about this or any other data protection related issues. #### Analysis tools and tools provided by third parties There is a possibility that your browsing patterns will be statistically analyzed when you visit this website. Such analyses are performed primarily with what we refer to as analysis programs. For detailed information about these analysis programs please consult our Data Protection Declaration below. ## 2. Hosting We are hosting the content of our website using the following providers: ### Lovable (Deployment and Hosting) This website is deployed and hosted via Lovable (Lovable AB, Stockholm, Sweden). When you visit our website, your browser establishes a connection to Lovable’s infrastructure. In the course of this, your IP address and other technical data (e.g., browser type, operating system, referring URL) may be processed. Lovable is used on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in a reliable and performant presentation of our website. If appropriate consent has been obtained, the processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and § 25(1) TDDDG, insofar the consent includes the storage of cookies or the access to information in the user’s end device (e.g., device fingerprinting) within the meaning of the TDDDG. This consent can be revoked at any time. ### Supabase (Database and Backend) We use Supabase (Supabase, Inc., San Francisco, CA, USA) for our database, authentication, and backend services. Supabase infrastructure runs on Amazon Web Services (AWS) in the EU region (Frankfurt, Germany). Your personal data processed through our website’s backend (e.g., form submissions, chatbot sessions) is stored on these EU-based servers. Supabase is used on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in using a reliable and scalable backend infrastructure. Data transfers to Supabase, Inc. in the United States are covered by the EU–US Data Privacy Framework (DPF), under which Supabase is certified. ### Cloudflare (Edge network and bot protection) Requests to our website pass through the edge network of Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA) before they reach our hosting provider. Cloudflare processes the technical data of each request – in particular your IP address, the requested URL, browser and device information – in order to deliver the site, apply redirects and protect it against misuse. In our “Get in Touch” form we additionally use Cloudflare Turnstile, which checks whether a submission comes from a human by evaluating technical browser signals; Turnstile does not use tracking cookies and does not show you a puzzle. Cloudflare is used on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in a fast, reliable and abuse-resistant delivery of our website. Data transfers to Cloudflare, Inc. in the United States are covered by the EU–U.S. Data Privacy Framework and by the EU standard contractual clauses. #### Data processing We have concluded data processing agreements (DPA) with our hosting providers. These are contracts mandated by data privacy laws that guarantee that they process personal data of our website visitors only based on our instructions and in compliance with the GDPR. ## 3. General information and mandatory information ### Data protection The operators of this website and its pages take the protection of your personal data very seriously. Hence, we handle your personal data as confidential information and in compliance with the statutory data protection regulations and this Data Protection Declaration. Whenever you use this website, a variety of personal information will be collected. Personal data comprises data that can be used to personally identify you. This Data Protection Declaration explains which data we collect as well as the purposes we use this data for. It also explains how, and for which purpose the information is collected. We herewith advise you that the transmission of data via the Internet (i.e., through email communications) may be prone to security gaps. It is not possible to completely protect data against third-party access. ### Information about the responsible party (referred to as the “controller” in the GDPR) The data processing controller on this website is: **Octily GmbH** Randolfstraße 18 12524 Berlin Germany Managing Director: Robert Bucher Email: [octily@octily.com](mailto:octily@octily.com) The controller is the natural person or legal entity that single-handedly or jointly with others makes decisions as to the purposes of and resources for the processing of personal data (e.g., names, email addresses, etc.). ### Storage duration Unless a more specific storage period has been specified in this privacy policy, your personal data will remain with us until the purpose for which it was collected no longer applies. If you assert a justified request for deletion or revoke your consent to data processing, your data will be deleted, unless we have other legally permissible reasons for storing your personal data (e.g., tax or commercial law retention periods); in the latter case, the deletion will take place after these reasons cease to apply. ### Revocation of your consent to the processing of data A wide range of data processing transactions are possible only subject to your express consent. You can also revoke at any time any consent you have already given us. This shall be without prejudice to the lawfulness of any data collection that occurred prior to your revocation. To withdraw your consent to push notifications, use “Turn off” at any of our push buttons or block notifications for this website in your browser settings. To object to our website analytics, use the privacy settings at the top of this page. To unsubscribe from the newsletter, use the unsubscribe link in any newsletter email. For all other cases, contact us at [octily@octily.com](mailto:octily@octily.com). ### Right of access (Art. 15 GDPR) You have the right to obtain confirmation as to whether personal data concerning you is being processed. Where that is the case, you have the right to access the personal data and the following information: the purposes of the processing; the categories of personal data concerned; the recipients or categories of recipient to whom the data have been or will be disclosed; the envisaged period for which the data will be stored; the existence of the right to request rectification or erasure or restriction of processing; the right to lodge a complaint with a supervisory authority; and any available information about the source of the data. You also have the right to be informed of any appropriate safeguards relating to the transfer of your data to a third country. You may request a copy of your personal data undergoing processing. Please contact us at [octily@octily.com](mailto:octily@octily.com). ### Right to erasure (Art. 17 GDPR) You have the right to demand the erasure of your personal data without undue delay. We are obligated to erase your data without undue delay if one of the following grounds applies: the data are no longer necessary for the purposes for which they were collected; you withdraw consent and there is no other legal basis for the processing; you object to the processing under Art. 21 GDPR and there are no overriding legitimate grounds; the data have been unlawfully processed. This right does not apply if the processing is necessary for compliance with a legal obligation, for the establishment, exercise, or defense of legal claims, or for reasons of public interest. ### Right to restriction of processing (Art. 18 GDPR) You have the right to demand the restriction of the processing of your personal data. You can request restriction in the following cases: if you contest the accuracy of your data, for a period enabling us to verify the accuracy; if the processing is unlawful and you oppose erasure and request restriction instead; if we no longer need the data for the purposes of processing but you require them for the establishment, exercise, or defense of legal claims; if you have lodged an objection pursuant to Art. 21(1) GDPR pending verification of whether our legitimate grounds override yours. ### Automated decision-making We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you. ### Right to object to the collection of data in special cases; right to object to direct advertising (Art. 21 GDPR) IN THE EVENT THAT DATA ARE PROCESSED ON THE BASIS OF ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT TO AT ANY TIME OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA BASED ON GROUNDS ARISING FROM YOUR UNIQUE SITUATION. THIS ALSO APPLIES TO ANY PROFILING BASED ON THESE PROVISIONS. IF YOU LOG AN OBJECTION, WE WILL NO LONGER PROCESS YOUR AFFECTED PERSONAL DATA, UNLESS WE ARE IN A POSITION TO PRESENT COMPELLING PROTECTION WORTHY GROUNDS FOR THE PROCESSING OF YOUR DATA, THAT OUTWEIGH YOUR INTERESTS, RIGHTS AND FREEDOMS OR IF THE PURPOSE OF THE PROCESSING IS THE CLAIMING, EXERCISING OR DEFENCE OF LEGAL ENTITLEMENTS (OBJECTION PURSUANT TO ART. 21(1) GDPR). IF YOUR PERSONAL DATA IS BEING PROCESSED IN ORDER TO ENGAGE IN DIRECT ADVERTISING, YOU HAVE THE RIGHT TO OBJECT TO THE PROCESSING OF YOUR AFFECTED PERSONAL DATA FOR THE PURPOSES OF SUCH ADVERTISING AT ANY TIME. THIS ALSO APPLIES TO PROFILING TO THE EXTENT THAT IT IS AFFILIATED WITH SUCH DIRECT ADVERTISING. IF YOU OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR DIRECT ADVERTISING PURPOSES (OBJECTION PURSUANT TO ART. 21(2) GDPR). ### Right to log a complaint with the competent supervisory agency In the event of violations of the GDPR, data subjects are entitled to log a complaint with a supervisory agency, in particular in the member state where they usually maintain their domicile, place of work or at the place where the alleged violation occurred. The right to log a complaint is in effect regardless of any other administrative or court proceedings available as legal recourses. ### Right to data portability You have the right to have data that we process automatically on the basis of your consent or in fulfillment of a contract handed over to you or to a third party in a common, machine-readable format. If you should demand the direct transfer of the data to another controller, this will be done only if it is technically feasible. ### SSL and/or TLS encryption For security reasons and to protect the transmission of confidential content, such as inquiries you submit to us as the website operator, this website uses either an SSL or a TLS encryption program. You can recognize an encrypted connection by checking whether the address line of the browser switches from “http://” to “https://” and also by the appearance of the lock icon in the browser line. If the SSL or TLS encryption is activated, data you transmit to us cannot be read by third parties. ## 4. Recording of data on this website ### Cookies and local storage Our website does not use tracking cookies and does not show a cookie banner: our website analytics store nothing on your device (see section 5), and the only service that needs your consent, push notifications, asks for it when you click its button. For site functions our website uses your browser’s local and session storage, which are managed by your browser and not sent with every request; session storage is cleared when you close the tab. Our edge network provider Cloudflare may set a technically necessary security cookie for bot protection (see section 2). We use these technologies for the following purposes: - Remembering your language setting and your saved topics - Keeping the chatbot open and your unsent message while you browse - Remembering your objection to analytics, if you turned measurement off in the privacy settings - Push notifications, only after you turned them on (see “Push notifications (OneSignal)”) The storage for the first three purposes is technically necessary to provide the functions you use (§ 25(2) No. 2 TDDDG); the related processing is based on Art. 6(1)(f) GDPR. Storage by OneSignal only happens with your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). #### Storage keys in detail - **Necessary** – `octily-language` (localStorage, persistent, Octily): stores your language. `octily-wishlist` (localStorage, persistent, Octily): stores the items you saved on our website. `octily-cornerstone-environment` (localStorage, persistent, Octily): remembers the Cornerstone environment you picked on our Cornerstone status page; only set when you pick one. `octily-wishlist-topics`, `octily-wishlist-topics-updated` (localStorage, Octily): store the topics you saved and when you last changed them; they are deleted 24 hours after your last change and as soon as you send the contact form. `octily-chat-sound` (localStorage, persistent, Octily): remembers whether chatbot sounds are on. `octily-analytics-optout` (localStorage, persistent, Octily): only set when you turn off “Measure my visit” in the privacy settings; stores your objection to analytics and chatbot page tracking and is removed when you turn measurement back on. `octily-chat-open`, `chatbot-draft`, `octily-chat-visitor-email` (sessionStorage, until the tab is closed, Octily): keep the chatbot open, your unsent message and the e-mail address you entered for a transcript. `octily-stale-build-reload`, `octily-boot-recover` (sessionStorage, until the tab is closed, Octily): prevent repeated reloads after a website update. `octily_pwa_enabled` (localStorage, persistent, Octily): stores whether our offline cache (service worker) is switched on for the site, so an outdated version is never served; it contains no information about you. `octily_is_staff` (localStorage, persistent, Octily): only set for signed-in Octily staff, so they always get the newest version of the site instead of the offline cache. - **Push notifications (only after you turn them on)** – when you allow notifications after clicking one of our push buttons, the OneSignal script registers a service worker (`/OneSignalSDKWorker.js`) and stores your push subscription and its settings in your browser’s IndexedDB and local storage (OneSignal, until you turn notifications off or clear your browser data). - **No longer used** – earlier versions of our website stored `octily-cookie-consent`, `octily_announcements`, `octily-analytics-known-visitor`, `octily-chat-session-id`, `octily-chat-session-key` (localStorage) and `octily-analytics-session`, `octily-onesignal-prompted` (sessionStorage). We no longer use them and delete them from your browser when you visit our website. ### Interactive migration checklist When you tick a task, we save only its completion state in `octily.guide.workforce-ai-migration-checklist.v1` (localStorage, Octily). This storage is necessary for the checklist you request (§ 25(2) No. 2 TDDDG). It stays until you reset the checklist or clear browser data. PDF downloads are generated on your device. If you request an email, the `email-migration-checklist` function sends your email address and task completion states to Resend solely to deliver your checklist (Art. 6(1)(b) GDPR; EU standard contractual clauses for US transfers). We do not save the email address or checklist on our servers, send a copy to our team, or subscribe you to marketing. While this guide is a staff-only draft, emails can only be sent to the requesting staff member’s verified account. ### Server log files The provider of this website and its pages automatically collects and stores information in so-called server log files, which your browser communicates to us automatically. The information comprises: - The type and version of browser used - The used operating system - Referrer URL - The hostname of the accessing computer - The time of the server inquiry - The IP address This data is not merged with other data sources. This data is recorded on the basis of Art. 6(1)(f) GDPR. The operator of the website has a legitimate interest in the technically error free depiction and the optimization of the operator’s website. In order to achieve this, server log files must be recorded. ### Get in Touch form If you submit inquiries to us via our “Get in Touch” form, the information provided in the form as well as any contact information provided therein will be stored by us in order to handle your inquiry and in the event that we have further questions. Your IP address is logged for anti-spam purposes. We will not share this information without your consent. The processing of these data is based on Art. 6(1)(b) GDPR, if your request is related to the execution of a contract or if it is necessary to carry out pre-contractual measures. In all other cases the processing is based on our legitimate interest in the effective processing of the requests addressed to us (Art. 6(1)(f) GDPR) or on your agreement (Art. 6(1)(a) GDPR) if this has been requested; the consent can be revoked at any time. Contact form submissions are automatically deleted after two years. IP addresses stored with the submission are deleted along with it. Submissions that our automated spam check holds back are stored separately, together with the reason, your IP address and browser identifier, so that a genuine inquiry can still be answered; these records are deleted after 90 days. To send you a confirmation of your inquiry and to notify our team, we use the e-mail service Resend (Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA). Resend processes your name, your e-mail address and the content of your message solely for the delivery of these e-mails and on our behalf. Data transfers to Resend, Inc. in the United States are covered by the EU standard contractual clauses. Apart from Resend and Anthropic (next paragraph), we do not pass your inquiry on to any other service. It is stored in our own database (Supabase, EU region, see section 2), where only our administrators can read it, and delivered by e-mail as described above. Members of our team receive a copy of the confirmation e-mail sent to you; you can see them in its CC line. If you also tick the newsletter option, we transmit your e-mail address to Mailchimp (see “Newsletter (Mailchimp)”). So that we can answer faster, your inquiry – the text of your message, your company name and the topics you selected (not your name or e-mail address) – is sent to Anthropic, PBC (see “Chatbot (Auto Mate)”), which writes a suggested reply for our team. This suggestion is only included in the internal notification to our team; it is never sent to you automatically. Your confirmation e-mail contains a personal link (“Continue with Auto Mate”): if you open it, our website loads your own inquiry (company, topics and message) into the Auto Mate chat and asks it there; from then on the chat is processed as described under “Chatbot (Auto Mate)”. The link works for 14 days and at most three times; we store only a hash of it, which is deleted after 30 days. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures at your request) and Art. 6(1)(f) GDPR (legitimate interest in answering inquiries quickly). So that we can answer knowledgeably and at a good time for you, the internal notification to our team also shows the context of your visit: your browser’s time zone and language setting, the country derived from your connection (determined by our Cloudflare proxy, only the two-letter country code), and – unless you objected to our website analytics – how this visit began (the referring page and campaign parameters of the first page), the pages you viewed in this visit and the answers you gave in our Inspiration Path. For this, the form sends the random identifier of this visit from our analytics (see “Self-hosted website analytics”). If you used the Auto Mate chat in the same visit, the notification includes that conversation. This context is not stored with your inquiry and nothing is stored on your device; the analytics and chat data themselves are kept as described in their sections. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in answering inquiries knowledgeably and promptly). ### Push notifications (OneSignal) If you ask for it, we send you browser push notifications when we publish new articles. For this we use OneSignal (OneSignal, Inc., 2194 Esperanca Avenue, Santa Clara, CA 95054, USA). Nothing from OneSignal is loaded until you click one of our push buttons: “Get notified about new articles” below our Insights articles, or “Turn On” behind the bell icon above the chat button. We never show a notification prompt on our own. After your click, your browser asks you for permission. Only if you allow it do we load the OneSignal script from cdn.onesignal.com; it registers a service worker and stores your subscription in your browser (see “Storage keys in detail”). When you subscribe, OneSignal processes a push subscription token issued by your browser, technical information about your browser and device, your IP address at the time of delivery, and whether a notification was displayed or clicked. The legal basis is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG, which you give with your click and your browser’s permission. You can withdraw it at any time with “Turn off” at any of our push buttons or by blocking notifications for this website in your browser settings; the withdrawal does not affect the lawfulness of processing carried out before it. Data transfers to OneSignal, Inc. in the United States are covered by the EU standard contractual clauses. ### Newsletter (Mailchimp) Our website offers a newsletter subscription. If you subscribe to our newsletter, your email address will be transmitted to and stored by Mailchimp, a service of Intuit Inc., 2700 Coast Avenue, Mountain View, CA 94043, USA. Mailchimp is used to manage our newsletter subscriber list and to send newsletters. When you subscribe, Mailchimp stores your email address and the date and time of your subscription. The legal basis is Art. 6(1)(a) GDPR (consent). You can revoke your consent at any time by unsubscribing from the newsletter via the unsubscribe link contained in every newsletter email, or by contacting us directly. Data transfers to Intuit Inc. in the United States are covered by the EU–US Data Privacy Framework (DPF), under which Intuit is certified. We have concluded a data processing agreement (DPA) with Mailchimp. For more information, see the [Mailchimp Privacy Policy](https://mailchimp.com/legal/privacy/). ### Book with me (Microsoft Bookings) Our website gives you the option to schedule appointments with us. We use Microsoft Bookings to book these appointments. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. To book an appointment, enter the requested data and the desired date in the form provided. The data entered will be used for planning, conducting and, if necessary, for the follow-up of the appointment. The appointment data will be stored for us on the servers of Microsoft Bookings. The legal basis for the processing of the data is Art. 6(1)(f) GDPR. The operator of the website has a legitimate interest in ensuring that appointments with customers and prospective customers can be scheduled as easily as possible. Meetings booked this way take place in Microsoft Teams and may be recorded and transcribed; see section 7 “Online meetings, recordings and transcripts”. ### Chatbot (Auto Mate) Our website features an AI-powered chatbot (“Auto Mate”) that allows you to ask questions about our services. In accordance with Art. 50(1) of the EU AI Act (Regulation (EU) 2024/1689), we inform you that Auto Mate is an artificial intelligence system. The chatbot is only active after you choose to open it. No data is collected before you interact with the chatbot. When you open the chatbot, an anonymous session is created using a randomly generated identifier (UUID) and a private session key. Both exist only in your browser’s memory and are never written to your device’s storage, so your conversation is gone when you reload or close the page. Your IP address is recorded alongside your chat messages for the purpose of preventing abuse and enforcing daily usage limits. No device fingerprints or user agent strings are collected. While the chatbot is open, we also record the pages you visit on our website along with an approximate scroll position, linked to the chat session. This data helps us provide contextually relevant answers during your conversation. You can object to this page tracking with the “Measure my visit” switch in the privacy settings at the top of this page. Your chat messages are processed by Anthropic, PBC (San Francisco, CA, USA) to generate AI responses. Anthropic processes the data as our processor under a data processing agreement and does not use your messages to train its models. The transfer of data to Anthropic in the USA is safeguarded by Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR. The chat messages, page visits, and session data are stored on Supabase servers (AWS, EU region). The legal basis for this processing is Art. 6(1)(f) GDPR (legitimate interest in providing helpful customer support through the chatbot). AI-generated responses may be inaccurate; please verify important information independently. If you ask for it, we send the transcript of your conversation to the e-mail address you enter, for example to keep it or to hand your question over to our team. The e-mail is delivered via Resend (see “Get in Touch form”), and our team receives a copy so that we can follow up. The legal basis is Art. 6(1)(b) GDPR (your request) and Art. 6(1)(f) GDPR (following up on your inquiry). To improve Auto Mate, we review conversations and use Anthropic to generate summaries of them. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the quality of our answers). IP addresses stored in connection with chatbot messages are automatically purged after 24 hours. Chat sessions inactive for more than 90 days are automatically deleted. The chatbot stores nothing in your browser, so there is nothing to delete on your device. To have your chatbot data deleted on our side, tell us roughly when you chatted and contact us at [octily@octily.com](mailto:octily@octily.com). ## 5. Analysis tools ### Self-hosted website analytics We measure how our website is used with our own analytics, without cookies and without storing anything on your device. We record the pages you view, interactions such as clicks, scroll depth and video playback, how long you stay on a page, the referring page or campaign parameters, your device type, and the country derived from your connection: when a page loads, our Cloudflare proxy reports the country of your IP address to your browser, which sends only the two-letter country code with the page view. Your IP address is not stored. All pages you view until you reload are grouped by a random session identifier that exists only in your browser’s memory: a reload or a new tab starts a new session, and we cannot recognize you on a later visit. If you are signed in to a partner or customer area, we add your user role, not your identity. Visits by our own team and recognizable bots are not recorded. The data is stored on Supabase servers (AWS, EU region, see section 2). If you send us our “Get in Touch” form during a visit, the pages of that visit are shown to our team together with your inquiry (see “Get in Touch form”). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to understand which content is useful and to improve our website. Because nothing is stored on or read from your device for this purpose, no consent under § 25(1) TDDDG is required. You have the right to object at any time (Art. 21 GDPR): turn off “Measure my visit” in the privacy settings at the top of this page. Your browser then sends no analytics data and no chatbot page visits. We remember your objection with the key `octily-analytics-optout` in your browser’s local storage, which is technically necessary for this purpose (§ 25(2) No. 2 TDDDG); if you clear your browser data, set the switch again. Analytics data is deleted after 12 months. ## 6. Plug-ins and tools ### YouTube with expanded data protection integration This website integrates videos from the YouTube website. The operator of the website is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. We use YouTube in extended data protection mode. According to YouTube, videos that are played in extended data protection mode are not used to personalize browsing on YouTube. Videos only load when you press play. Until then, we show a preview image from our own server, and the YouTube player is not loaded. When you press play, the video is loaded from youtube-nocookie.com. One exception: if our chatbot links to a YouTube video in one of its answers, your browser loads that video’s preview image from img.youtube.com (Google) when the answer is shown; this transmits your IP address to Google. The video itself opens on youtube.com only when you click the link. The use of YouTube is based on our interest in presenting our online content in an appealing manner. Pursuant to Art. 6(1)(f) GDPR, this is a legitimate interest. ### Google Fonts (local embedding) This website uses so-called Google Fonts provided by Google to ensure the uniform use of fonts on this site. These Google fonts are locally installed so that a connection to Google’s servers will not be established in conjunction with this application. ## 7. Online meetings, recordings and transcripts ### Microsoft Teams We use Microsoft Teams for video conferences with customers, prospective customers and partners. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. When you take part in a meeting, we process your name, your e-mail address, the meeting details (date, time, duration, participants), and what is shared in the meeting: audio, video, screen content and chat messages. For details on Microsoft’s processing, please refer to the Microsoft privacy statement: [https://privacy.microsoft.com/en-us/privacystatement](https://privacy.microsoft.com/en-us/privacystatement) ### Recording and transcription Meetings may be recorded and transcribed so that we can provide accurate notes afterwards. We say so in the invitation and at the start of the meeting, and Microsoft Teams shows when a recording is running. If you’d rather not, just say so at the start; the meeting then takes place without a recording. Recordings and transcripts are created in Microsoft Teams, with the transcription feature of Notion (Notion Labs, Inc., 2300 Harrison Street, San Francisco, CA 94110, USA) or on our own devices. We write the meeting notes from them, partly with the help of an AI assistant (Claude, Anthropic, PBC, San Francisco, CA, USA), whose commercial terms exclude the use of the content for training AI models. The notes are kept in our Notion workspace. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is an accurate record of what was discussed and agreed. Where the meeting relates to a contract with you or to pre-contractual steps, the legal basis is Art. 6(1)(b) GDPR. You can object to the recording at any time (Art. 21 GDPR). Teams recordings are deleted automatically after 120 days. Transcripts and meeting notes are kept for as long as the project or business relationship requires, and afterwards in line with statutory retention periods. Data transfers to Microsoft and Notion in the United States are covered by the EU–U.S. Data Privacy Framework, under which both companies are certified; transfers to Anthropic are covered by the EU standard contractual clauses. ## 8. Handling applicant data We offer website visitors the opportunity to submit job applications to us (e.g., via email or postal services). We assure you that the collection, processing, and use of your data will occur in compliance with the applicable data privacy rights and all other statutory provisions and that your data will always be treated as strictly confidential. If you submit a job application to us, we will process any affiliated personal data (e.g., contact and communications data, application documents, notes taken during job interviews, etc.), if they are required to make a decision concerning the establishment or an employment relationship. The legal grounds for the aforementioned are § 26 BDSG according to German Law, Art. 6(1)(b) GDPR (General Contract Negotiations) and – provided you have given us your consent – Art. 6(1)(a) GDPR. If we are unable to make you a job offer or you reject a job offer or withdraw your application, we reserve the right to retain the data you have submitted on the basis of our legitimate interests (Art. 6(1)(f) GDPR) for up to 6 months from the end of the application procedure.