Data protection

All information in accordance with § 5 DDG

preamble

Note on the validity of the GDPR and Swiss DSG: This data protection notice is intended both to provide information in accordance with the Swiss Federal Data Protection Act (Swiss DSG) and the General Data Protection Regulation (GDPR). For this reason, please note that the terms of the GDPR are used due to the wider geographical application and comprehensibility. In particular, instead of the terms “processing” of “personal data”, “overriding interest” and “particularly sensitive personal data” used in the Swiss DSG, the terms “processing” of “personal data” as well as “legitimate interest” and “special categories of data” are used. However, within the scope of the Swiss DSG, the legal meaning of the terms continues to be determined in accordance with the Swiss DSG.

With the following privacy policy, we would like to explain to you what types of your personal data (hereinafter also referred to as “data”) we use for what purposes and to what extent as part of providing the application nele.ai process.

The privacy policy applies to all processing of personal data carried out by us, both as part of the provision of nele.ai and in particular on the websites and functions associated with nele.ai (hereinafter collectively referred to as “online offer”).

The terms used are not gender-specific.

Status: April 10, 2024

Table of contents

person responsible

As part of our business activities, we use additional services, platforms, interfaces or plug-ins from third-party providers (“services” for short) in compliance with legal requirements. Their use is based on our interests in the proper, lawful and economic management of our business operations and internal organization.

GAL Digital GmbH
Unter den Linden 26
35410 Hungen-Obbornhofen
germany

email address: info@gal-digital.de

Contact data protection officer

As part of our business activities, we use additional services, platforms, interfaces or plug-ins from third-party providers (“services” for short) in compliance with legal requirements. Their use is based on our interests in the proper, lawful and economic management of our business operations and internal organization.

Dr. Thomas Schwenke, contact: datenschutz@gal-digital.de.

Overview of processing

The following overview summarizes the types of data processed and the purposes of their processing and refers to the persons concerned.

Types of data processed

• inventory data.
• payment details.
• contact details.
• Content data.
• Contract data.
• usage data.
• Meta, communication and procedural data.

Categories of affected persons

• customers.
• interested parties.
• communication partner.
• user.
• Business and contract partners.
• Third people.

Purposes of processing

• Provision of contractual services and fulfilment of contractual obligations.
• Contact requests and communication.
• safety measures.
• direct marketing.
• Range measurement.
• Tracking.
• Conversion measurement.
• Office and organizational procedures.
• Target group building.
• Affiliate tracking.
• Managing and responding to inquiries.
• feedback.
• marketing.
• Profiles with user-related information.
• Provision of our online offering and user-friendliness.
• Information technology infrastructure.

Relevant legal bases

As part of our business activities, we use additional services, platforms, interfaces or plug-ins from third-party providers (“services” for short) in compliance with legal requirements. Their use is based on our interests in the proper, lawful and economic management of our business operations and internal organization.

Relevant legal bases under the GDPR: The following is an overview of the legal bases of the GDPR, on the basis of which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection requirements may apply in your or our country of residence or place of residence. Should more specific legal bases also apply in individual cases, we will inform you of these in the privacy policy.

Consent (Article 6 (1) (a) GDPR) - The data subject has given consent to the processing of personal data concerning him or her for a specific purpose or several specific purposes.
‍
‍Contract performance and pre-contractual inquiries (Art. 6 (1) (b) GDPR) - Processing is necessary for the performance of a contract to which the data subject is a party or to carry out pre-contractual measures taken at the request of the data subject.
‍
‍Legal obligation (Art. 6 (1) (c) GDPR) - Processing is necessary to fulfill a legal obligation to which the person responsible is subject.

‍Legitimate interests (Art. 6 (1) (f) GDPR) - Processing is necessary to protect the legitimate interests of the controller or of a third party, provided that the interests, fundamental rights and freedoms of the data subject, which require the protection of personal data, do not prevail.

National data protection regulations in Germany: In addition to the data protection regulations of the GDPR, national regulations on data protection apply in Germany. This includes in particular the Act on Protection against Misuse of Personal Data in Data Processing (Federal Data Protection Act — BDSG). In particular, the BDSG contains special rules on the right to information, the right to deletion, the right of objection, the processing of special categories of personal data, processing for other purposes and transmission and automated decision-making in individual cases, including profiling. In addition, state data protection laws of the individual federal states may apply.
‍
Relevant legal bases under Swiss Data Protection Act: If you are in Switzerland, we process your data on the basis of the Federal Data Protection Act (“Swiss DSG” for short, applicable from September 1, 2023). This also applies if our processing of your data otherwise affects you in Switzerland and you are affected by the processing. Unlike, for example, the GDPR, the Swiss DSG does not in principle require a legal basis for processing personal data. We only deal with the latter if the processing is carried out in good faith, is lawful and proportionate (Art. 6 (1) and (2) of the Swiss DSG). In addition, personal data is only obtained by us for a specific purpose that is identifiable to the data subject and only processed in a way that is compatible with this purpose (Article 6 (3) of the Swiss DSG).

Note on the validity of the GDPR and Swiss DSG: This data protection notice is intended both to provide information in accordance with the Swiss Federal Data Protection Act (Swiss DSG) and the General Data Protection Regulation (GDPR). For this reason, please note that the terms of the GDPR are used due to the wider geographical application and comprehensibility. In particular, instead of the terms “processing” of “personal data”, “overriding interest” and “particularly sensitive personal data” used in the Swiss DSG, the terms “processing” of “personal data” as well as “legitimate interest” and “special categories of data” are used. However, within the scope of the Swiss DSG, the legal meaning of the terms continues to be determined in accordance with the Swiss DSG.

Safety measures

In accordance with legal requirements, taking into account the state of the art, implementation costs and the nature, scope, circumstances and purposes of processing as well as the different probabilities of occurrence and the extent of the threat to the rights and freedoms of natural persons, we take appropriate technical and organizational measures to ensure a level of protection appropriate to the risk.
‍
The measures include, in particular, ensuring the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as the access, input, transfer, availability and separation of data relating to it. We have also set up procedures that ensure the exercise of data subject rights, the deletion of data and responses to the data being compromised. In addition, we take the protection of personal data into account when developing or selecting hardware, software and processes in accordance with the principle of data protection, through technology design and through privacy-friendly default settings.
‍
Securing online connections using TLS/SSL encryption technology (HTTPS): In order to protect user data transmitted via our online services from unauthorised access, we use TLS/SSL encryption technology. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are the cornerstones of secure data transmission on the Internet. These technologies encrypt the information that is transferred between the website or app and the user's browser (or between two servers), which protects the data from unauthorized access. TLS, as the more advanced and secure version of SSL, ensures that all data transmissions meet the highest security standards. When a website is secured by an SSL/TLS certificate, this is signaled by the display of HTTPS in the URL. This serves as an indicator for users that their data is transmitted securely and encrypted.

Transfer of personal data

As part of our processing of personal data, it may be transferred to or disclosed to other bodies, companies, legally independent organizational units or persons. Recipients of this data may include, for example, service providers tasked with IT tasks or providers of services and content that are integrated into a website. In such cases, we comply with legal requirements and, in particular, conclude appropriate contracts or agreements with the recipients of your data that serve to protect your data.

International data transfers

Data transfer within the organization: Data transfer within the group of companies: We may transfer personal data to other companies within our group of companies or grant them access to it. If the transfer of data is for administrative purposes, it is based on our legitimate entrepreneurial and business interests or takes place if it is necessary to fulfill our contract-related obligations or if the data subject has the consent of the person concerned or a legal permission.

‍Data processing in third countries: If we process data in a third country (i.e. outside the European Union (EU), the European Economic Area (EEA)) or processing takes place as part of the use of third-party services or the disclosure or transfer of data to other persons, bodies or companies, this is only done in accordance with legal requirements. If the level of data protection in the third country has been recognized by means of an adequacy decision (Art. 45 GDPR), this serves as the basis for data transfer. In addition, data transfers only take place if the level of data protection is otherwise ensured, in particular by standard contractual clauses (Art. 46 para. 2 lit. c) GDPR), express consent or, in the case of contractual or legally required transfer (Art. 49 para. 1 GDPR). In addition, we will provide you with the principles of third-country transfers with the individual providers from the third country, with the adequacy decisions taking priority as the basis. Information on transfers to third countries and existing adequacy decisions can be found in the information offered by the EU Commission: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en?prefLang=de.

EU-US Trans-Atlantic Data Privacy Framework: As part of the so-called “Data Privacy Framework” (DPF), the EU Commission has also recognized the level of data protection as secure for certain companies from the USA as part of the adequacy decision of 10.07.2023. The list of certified companies and further information about the DPF can be found on the website of the US Department of Commerce at https://www.dataprivacyframework.gov/ Remove (in English). As part of the data protection policy, we will inform you which service providers we use are certified under the Data Privacy Framework.

Disclosure of personal data abroad: In accordance with the Swiss Data Protection Act (DSG), we only disclose personal data abroad if adequate protection of data subjects is guaranteed (Art. 16 Swiss DSG). Unless the Federal Council has identified adequate protection (list: https://www.bj.admin.ch/bj/de/home/staat/datenschutz/internationales/anerkennung-staaten.html), we are taking alternative security measures. These may include international contracts, specific guarantees, data protection clauses in contracts, standard data protection clauses approved by the Federal Data Protection and Information Commissioner (FDPIC) or internal company data protection regulations approved in advance by the FDPIC or a competent data protection authority of another country.

According to Art. 16 of the Swiss DSG, exceptions may be allowed for the disclosure of data abroad if certain conditions are met, including consent of the data subject, contract execution, public interest, protection of life or physical integrity, publicly made data or data from a legally required register. These announcements are always made in accordance with legal requirements.

Deletion of data

The data processed by us will be deleted in accordance with legal requirements as soon as their consent permitted for processing is withdrawn or other permits no longer apply (e.g. if the purpose of processing this data has ceased to apply or they are not necessary for the purpose). Unless the data is deleted because it is necessary for other and legally permitted purposes, its processing will be limited to these purposes. This means that the data is blocked and not processed for other purposes. This applies, for example, to data that must be stored for commercial or tax reasons or whose storage is necessary to assert, exercise or defend legal claims or to protect the rights of another natural or legal person. As part of our data protection policy, we can provide users with further information about the deletion and storage of data that applies specifically to the respective processing process.

Rights of data subjects

We ask you to regularly check the content of our privacy policy. We will adjust the privacy policy as soon as changes to the data processing carried out by us make this necessary. We will inform you as soon as the changes require your cooperation (e.g. consent) or other individual notification.

If we provide addresses and contact information of companies and organizations in this privacy policy, please note that the addresses may change over time and please check the information before contacting us.

Rights of data subjects under the GDPR: As a data subject, you are entitled to various rights under the GDPR, which arise in particular from Articles 15 to 21 GDPR:

‍Right of objection: For reasons arising from your particular situation, you have the right to object at any time to the processing of personal data concerning you, which is carried out on the basis of Article 6 (1) (e) or (f) GDPR; this also applies to profiling based on these provisions. If the personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling, insofar as it is associated with such direct marketing.
Right of withdrawal in case of consent: You have the right to withdraw your consent at any time.
Right to information: You have the right to request confirmation as to whether the relevant data is being processed and for information about this data as well as further information and a copy of the data in accordance with legal requirements.
Right to rectification: In accordance with legal requirements, you have the right to request the completion of the data concerning you or the correction of incorrect data concerning you.
Right to delete and restrict processing: In accordance with legal requirements, you have the right to request that data concerning you be deleted immediately or, alternatively, to request that the processing of the data be restricted in accordance with legal requirements.
Right to data portability: You have the right to receive data concerning you that you have provided to us in a structured, common and machine-readable format in accordance with legal requirements or to request that it be transmitted to another person responsible.
Complaint to supervisory authority: In accordance with legal requirements and without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a data protection supervisory authority, in particular a supervisory authority in the Member State in which you habitually reside, the supervisory authority of your place of work or the place of the alleged infringement, if you believe that the processing of personal data relating to you is contrary to the GDPR.

Rights of data subjects under the Swiss DSG:
As a data subject, you have the following rights in accordance with the requirements of the Swiss DSG:
Right to information: You have the right to request confirmation as to whether personal data concerning you is being processed and to receive the information necessary to assert your rights under this Act and to ensure transparent data processing.
Right to release or transfer data: You have the right to request the release of your personal data, which you have provided to us, in a common electronic format.
Right to rectification: You have the right to request that incorrect personal data concerning you be corrected.
Right to object, delete and destroy: You have the right to object to the processing of your data and to request that the personal data relating to you be deleted or destroyed.

Business services

We process data from our contractual and business partners, e.g. customers and interested parties (collectively referred to as “contractual partners”), within the framework of contractual and comparable legal relationships and related measures and with regard to communication with the contractual partners (or pre-contractual), for example to answer inquiries.

We use this information to fulfill our contractual obligations. This includes in particular the obligations to provide the agreed services, any update obligations and remedies in the event of warranty and other performance problems. In addition, we use the data to protect our rights and for the purpose of administrative tasks associated with these obligations and corporate organization. In addition, we process the data on the basis of our legitimate interests both in proper and business management and in security measures to protect our contractual partners and our business operations from misuse, risk of their data, secrets, information and rights (e.g. to involve telecommunications, transport and other assistance services as well as subcontractors, banks, tax and legal advisors, payment service providers or tax authorities). Within the framework of applicable law, we only pass on the data of contractual partners to third parties to the extent necessary for the above purposes or to fulfill legal obligations. Contractual partners will be informed about other forms of processing, such as for marketing purposes, as part of this privacy policy.

We will inform the contractual partners which data is required for the above purposes before or as part of data collection, e.g. in online forms, through special identification (e.g. colors) or symbols (e.g. asterisks, etc.), or personally.

We delete the data after expiry of legal warranty and comparable obligations, i.e. in principle after four years, unless the data is stored in a customer account, e.g. as long as it must be kept for archiving legal reasons (e.g. for tax purposes, usually ten years). We delete data that has been disclosed to us as part of an order by the contractual partner in accordance with the requirements and generally after the end of the order.

Types of data processed: Inventory data (e.g. names, addresses); payment data (e.g. bank details, invoices, payment history); contact data (e.g. e-mail, telephone numbers); contract data (e.g. subject of contract, duration, customer category); usage data (e.g. websites visited, interest in content, access times). Meta, communication and procedural data (e.g. IP addresses, time information, identification numbers, consent status).
‍Affected persons: Customers; interested parties; business and contract partners. communication partner.
‍Purposes of processing: Provision of contractual services and fulfilment of contractual obligations; security measures; contact requests and communication; office and organizational procedures; administration and response to inquiries; direct marketing (e.g. by e-mail or post). Reach measurement (e.g. access statistics, recognition of returning visitors).
‍Legal bases: Contract performance and pre-contractual inquiries (Art. 6 para. 1 p. 1 lit. b) GDPR); legal obligation (Art. 6 para. 1 p. 1 lit. c) GDPR). Legitimate interests (Art. 6 (1) (f) GDPR).

Further information on processing processes, procedures and services:
‍
“nele.ai “: With nele.ai, we offer software that enables users to integrate AI software and create AI content via API access to AI-based services in various deployment scenarios. User input is not transmitted directly to AI providers, but processed on our servers. The processing is carried out to fulfill our contractual obligations, which include in particular the storage of user input and the filtering of content. User inputs are stored on our servers. This includes in particular user requests (prompts). Subject to the functions provided by the providers, we only use AI functions with the proviso that the user input may not be stored by the AI providers or used for learning purposes. Legal bases: Contract performance and pre-contractual inquiries (Art. 6 (1) (b) GDPR).
Customer account: Customers can create an account within our online offering (e.g. customer or user account, “customer account” for short). If it is necessary to register a customer account, customers will be notified of this as well as the information required for registration. Customer accounts are not public and cannot be indexed by search engines. As part of registration and subsequent logins and uses of the customer account, we store the customer's IP addresses and access times in order to be able to prove registration and prevent possible misuse of the customer account. If the customer account has been terminated, the customer account data will be deleted after the time of termination, unless they are stored in the customer account for purposes other than provision or must be kept for legal reasons (e.g. internal storage of customer data, order processes or invoices). It is the responsibility of customers to secure their data when canceling the customer account; Legal bases: Contract performance and pre-contractual inquiries (Art. 6 (1) (b) GDPR).
Brevo: email delivery and automation services; Service provider: Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin, Germany; Legal bases: legitimate interests (Art. 6 (1) (f) GDPR); Site: https://www.brevo.com/; Privacy statement: https://www.brevo.com/legal/privacypolicy/; Order processing contract: Provided by service provider. Basis for transfers to third countries: Switzerland - Adequacy Decision (Germany).

Vendors and services used in the course of business

As part of our business activities, we use additional services, platforms, interfaces or plug-ins from third-party providers (“services” for short) in compliance with legal requirements. Their use is based on our interests in the proper, lawful and economic management of our business operations and internal organization.
‍
‍Types of data processed: Inventory data (e.g. names, addresses); payment data (e.g. bank details, invoices, payment history); contact data (e.g. e-mail, telephone numbers); content data (e.g. entries in online forms); contract data (e.g. contract subject, duration, customer category). usage data (e.g. websites visited, interest in content, access times).
‍Affected persons: Customers; interested parties; users (e.g. website visitors, users of online services); business and contract partners. Third people.
‍Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; office and organizational procedures; provision of our online offering and usability. Information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.).).
‍Legal bases: Legitimate interests (Art. 6 (1) (f) GDPR).

‍Further information on processing processes, procedures and services:
OpenAI API: Interface access (so-called “API”) to AI-based services that are designed to understand and generate natural language and associated inputs, analyze information and make predictions (“AI”, i.e. “artificial intelligence”, is understood in the respective applicable legal sense of the term). The provision of AI services includes processing (including collection, storage, organization, and structuring) of personal data as part of a natural language-based machine learning process; carrying out activities to verify or maintain the quality of the services; identifying and correcting errors that interfere with existing intended functionality, and helping to ensure the security and integrity of the AI services; Service provider: OpenAI Ireland Ltd, 117-126 Sheriff Street Upper, D01 YC43 Dublin 1, Ireland; Legal bases: legitimate interests (Art. 6 (1) (f) GDPR); Site: https://openai.com/product; Privacy statement: https://openai.com/de/policies/eu-privacy-policy; Order processing contract: https://openai.com/policies/data-processing-addendum; Basis for transfer to third countries: EU/EEA - standard contractual clauses (https://openai.com/policies/data-processing-addendum), Switzerland - Adequacy Decision (Ireland). Objection option (opt-out): https://docs.google.com/forms/d/e/1FAIpQLSevgtKyiSWIOj6CV6XWBHl1daPZSOcIWzcUYUXQ1xttjBgDpA/viewform‍.

Microsoft Azure OpenAI Service: Interface access (so-called “API”) to AI-based services that are designed to understand and generate natural language and associated inputs, analyze information and make predictions (“AI”, i.e. “artificial intelligence”, is understood in the respective applicable legal sense of the term). The provision of AI services includes processing (including collection, storage, organization, and structuring) of personal data as part of a natural language-based machine learning process; carrying out activities to verify or maintain the quality of the services; identifying and correcting errors that interfere with existing intended functionality, and helping to ensure the security and integrity of the AI services; Service provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; Legal bases: legitimate interests (Art. 6 (1) (f) GDPR); Site: https://azure.microsoft.com/de-de/products/ai-services/openai-service; Privacy statement: https://privacy.microsoft.com/de-de/privacystatement; Order processing contract: https://azure.microsoft.com/de-de/support/legal/. Basis for transfer to third countries: EU/EEA - Data Privacy Framework (DPF), Switzerland - Adequacy Decision (Ireland).

Claude 3 API: Interface access (so-called “API”) to AI-based services that are designed to understand and generate natural language and associated inputs, analyze information and make predictions (“AI”, i.e. “artificial intelligence”, is understood in the respective applicable legal sense of the term). The provision of AI services includes processing (including collection, storage, organization, and structuring) of personal data as part of a natural language-based machine learning process; carrying out activities to verify or maintain the quality of the services; identifying and correcting errors that interfere with existing intended functionality, and helping to ensure the security and integrity of the AI services; Service provider: Anthropic PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, United States; Legal bases: legitimate interests (Art. 6 (1) (f) GDPR); Site: https://www.anthropic.com/; Privacy statement: https://www.anthropic.com/legal/privacy; Order processing contract: https://www.anthropic.com/legal/commercial-terms. Basis for transfers to third countries: EU/EEA - Standard Contractual Clauses (https://www.anthropic.com/legal/commercial-terms), Switzerland - Standard Contractual Clauses (https://www.anthropic.com/legal/commercial-terms).

Payment procedure

As part of contractual and other legal relationships, due to legal obligations or otherwise based on our legitimate interests, we offer data subjects efficient and secure payment options and use other service providers in addition to banks and credit institutions (collectively “payment service providers”).
‍
The data processed by payment service providers includes inventory data, such as name and address, bank details, such as account numbers or credit card numbers, passwords, TANs and checksums, as well as contract, sum and recipient-related information. The information is required to carry out the transactions. However, the data entered is only processed by payment service providers and stored by them. In other words, we do not receive any account or credit card information, but only information with confirmation or negative information of the payment. Payment service providers may transfer the data to credit agencies. The purpose of this transfer is to verify identity and credit. In this regard, we refer to the terms and conditions and the data protection information of the payment service providers.
‍
Payment transactions are subject to the terms and conditions and data protection notices of the respective payment service providers, which are available within the respective websites or transaction applications. We also refer to these for further information and to assert revocation, information and other data subject rights.

‍Types of data processed: Inventory data (e.g. names, addresses); payment data (e.g. bank details, invoices, payment history); contract data (e.g. subject matter of contract, duration, customer category); usage data (e.g. websites visited, interest in content, access times); meta, communication and procedural data (e.g. IP addresses, time information, identification numbers, consent status). Contact details (e.g. email, telephone numbers).
‍Affected persons: customers; prospects. Business and contract partners.
Purposes of processing: Provision of contractual services and fulfilment of contractual obligations. Office and organizational procedures.
‍Legal bases: Contract performance and pre-contractual inquiries (Art. 6 (1) (b) GDPR). Legitimate interests (Art. 6 (1) (f) GDPR).

Further information on processing processes, procedures and services:

Stripe: payment services (technical integration of online payment methods); Service provider: Stripe, Inc., 510 Townsend Street, San Francisco, CA 94103, United States; Legal bases: contract performance and pre-contractual inquiries (Art. 6 (1) (b) GDPR); Site: https://stripe.com; Privacy statement: https://stripe.com/de/privacy. Basis for transfer to third countries: EU/EEA — Data Privacy Framework (DPF).

Pathway solutions: Retrieving and processing orders, customer data and payment data from shop systems and other transaction platforms via interfaces. The collected data is then converted into booking information optimized for booking processes; Service provider: Pathway Solutions GmbH, Alstertwiete 3, 20099 Hamburg, Germany; Legal bases: legitimate interests (Art. 6 (1) (f) GDPR); Site: https://www.pathway-solutions.de/; Privacy statement: https://www.pathway-solutions.de/pages/datenschutzerklaerung. Order processing contract: Provided by service provider. Basis for transfers to third countries: Switzerland - Adequacy Decision (Germany).

Provision of online services and web hosting

We process user data in order to be able to provide them with our online services. For this purpose, we process the user's IP address, which is necessary to transfer the content and functions of our online services to the user's browser or device.

Types of data processed: Usage data (e.g. websites visited, interest in content, access times); meta, communication and process data (e.g. IP addresses, time information, identification numbers, consent status). Content data (such as entries in online forms).
‍Affected persons: users (e.g. website visitors, users of online services). Business and contract partners.
Purposes of processing: Provision of our online offering and user-friendliness; information technology infrastructure (operation and provision of information systems and technical devices (computers, servers, etc.); security measures. Office and organizational procedures.
Legal bases: Legitimate interests (Art. 6 (1) (f) GDPR).

Further information on processing processes, procedures and services:
‍
Brevo: sending emails; Legal bases: legitimate interests (Art. 6 (1) (f) GDPR); Order processing contract: Is provided by the service provider; Service provider: Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin, Germany; Site:https://www.brevo.com/; Privacy statement: https://www.brevo.com/legal/privacy-policy/. Basis for transfers to third countries: Switzerland - Adequacy Decision (Germany).
Provision of online services on rented storage space: To provide our online service, we use storage space, computing capacity and software, which we rent or otherwise obtain from an appropriate server provider (also known as a “web host”); Legal bases: Legitimate interests (Art. 6 (1) (f) GDPR).
Collection of access data and log files: Access to our online offering is logged in the form of so-called “server log files.” The server log files may include the address and name of the retrieved websites and files, date and time of retrieval, amount of data transferred, notification of successful retrieval, browser type and version, the user's operating system, referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider. The server log files can be used, on the one hand, for security purposes, e.g. to avoid overloading the servers (in particular in the case of abusive attacks, so-called DDoS attacks) and, on the other hand, to ensure the workload of the servers and their stability; Legal bases: Legitimate interests (Art. 6 (1) (f) GDPR). Deletion of data: Log file information is stored for a maximum of 30 days and then deleted or anonymized. Data whose further storage is necessary for evidentiary purposes is excluded from deletion until the respective incident has been finally clarified.
Hetzner: services in the area of providing information technology infrastructure and related services (e.g. storage and/or computing capacity); Service provider: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany; Legal bases: legitimate interests (Art. 6 (1) (f) GDPR); Site: https://www.hetzner.com; Privacy statement: https://www.hetzner.com/de/rechtliches/datenschutz; Order processing contract: https://docs.hetzner.com/de/general/general-terms-and-conditions/data-privacy-faq/. Basis for transfers to third countries: Switzerland - Adequacy Decision (Germany).
Webflow: creating, managing and hosting websites, online forms and other web elements; Service provider: Webflow, Inc. 208 Utah, Suite 210, San Francisco, CA 94103, United States; Legal bases: legitimate interests (Art. 6 (1) (f) GDPR); Site: https://webflow.com; Privacy statement: https://webflow.com/legal/eu-privacy-policy; Order processing contract: https://webflow.com/legal/sign-dpa. Basis for transfer to third countries: EU/EEA - Data Privacy Framework (DPF), Switzerland - Standard Contractual Clauses (https://webflow.typeform.com/to/nM8vLH).

Registration, login and user account

Users can create a user account. As part of registration, users are provided with the required mandatory information and processed for the purpose of providing the user account on the basis of contractual obligations. The processed data includes in particular login information (user name, password and an e-mail address).
‍
As part of using our registration and login functions and using the user account, we store the IP address and the time of the respective user action. The data is stored on the basis of our legitimate interests as well as those of users in protecting against misuse and other unauthorized use. In principle, this data will not be passed on to third parties, unless it is necessary to pursue our claims or there is a legal obligation to do so.

Users can be informed by email about processes that are relevant to their user account, such as technical changes.

Types of data processed: Inventory data (e.g. names, addresses); contact data (e.g. e-mail, telephone numbers); content data (e.g. entries in online forms). Meta, communication and procedural data (e.g. IP addresses, time information, identification numbers, consent status).
Affected persons: users (e.g. website visitors, users of online services).
Purposes of processing: Provision of contractual services and fulfillment of contractual obligations; security measures; administration and response to inquiries. Provision of our online offering and user-friendliness.
Legal bases: Contract performance and pre-contractual inquiries (Art. 6 (1) (b) GDPR). Legitimate interests (Art. 6 (1) (f) GDPR).

Further information on processing processes, procedures and services:
‍
Registration with real name: Due to the nature of our community, we ask users to use our offer only using real names. In other words, the use of pseudonyms is not permitted; Legal bases: Contract performance and pre-contractual inquiries (Art. 6 (1) (b) GDPR).
Users' profiles are not public: Users' profiles are not publicly visible and not accessible.
Deletion of data after termination: If users have cancelled their user account, their data with regard to the user account will be deleted, subject to legal permission, duty or consent of the users; Legal bases: Contract performance and pre-contractual inquiries (Art. 6 (1) (b) GDPR).
No obligation to store data: It is the responsibility of users to secure their data before the end of the contract in the event of termination. We are entitled to irretrievably delete all user data stored during the contract period; Legal bases: Contract performance and pre-contractual inquiries (Art. 6 (1) (b) GDPR).

Newsletters and electronic notifications

We only send newsletters, emails and other electronic notifications (hereinafter “newsletters”) with the consent of the recipients or legal permission. If the content of the newsletter is specifically described as part of a subscription to the newsletter, they are decisive for the consent of the users. In addition, our newsletters contain information about our services and ourselves.

In order to subscribe to our newsletter, it is generally sufficient to provide your e-mail address. However, we may ask you to provide a name for the purpose of personally addressing you in the newsletter or further information, provided that this is necessary for the purposes of the newsletter.
‍
Double opt-in process: Registration for our newsletter generally takes place in a so-called double opt-in process. This means that after registration, you will receive an email asking you for the appropriate confirmation. This is necessary so that no one can log in with foreign email addresses. Subscriptions to the newsletter are logged in order to be able to prove the registration process in accordance with legal requirements. This includes saving both the time of registration and confirmation as well as the IP address. Changes to your data stored with the shipping service provider are also logged.
‍
Deletion and restriction of processing: We can store the unsubscribed email addresses for up to three years on the basis of our legitimate interests before we delete them in order to be able to prove a previously given consent. The processing of this data is limited to the purpose of potentially defending against claims. An individual request for deletion is possible at any time, provided that the former existence of consent is confirmed at the same time. In the event of obligations to permanently comply with objections, we reserve the right to store the email address in a blocked list (so-called “block list”) for this purpose alone.

The registration process is logged on the basis of our legitimate interests for the purpose of proving that it has been completed correctly. Insofar as we commission a service provider to send emails, this is done on the basis of our legitimate interests in an efficient and secure delivery system.
‍
Content:
‍
Information about nele.ai, AI systems and our services.
Types of data processed: Inventory data (e.g. names, addresses); contact data (e.g. e-mail, telephone numbers); meta, communication and process data (e.g. IP addresses, time information, identification numbers, consent status). usage data (e.g. websites visited, interest in content, access times).
Affected persons: communication partner.
Purposes of processing: Direct marketing (e.g. via email or post). Reach measurement (e.g. access statistics, recognition of returning visitors).
Legal bases: Consent (Art. 6 (1) (a) GDPR). Legitimate interests (Art. 6 (1) (f) GDPR).
Objection option (opt-out): You can unsubscribe from our newsletter at any time, i.e. withdraw your consent, or object to further receipt. You will either find a link to cancel the newsletter at the end of each newsletter or you can otherwise use one of the contact options listed above, preferably e-mail.
‍
‍Further information on processing processes, procedures and services:
Measurement of open and click rates: The newsletters contain a so-called “web beacon”, i.e. a pixel-sized file that is retrieved from our or its server when the newsletter is opened, provided that we use a shipping service provider. As part of this retrieval, technical information, such as information about the browser and your system, as well as your IP address and the time of retrieval, are initially collected. This information is used to technically improve our newsletter based on technical data or target groups and their reading behavior based on their retrieval locations (which can be determined using the IP address) or access times. This analysis also includes determining whether and when the newsletters are opened and which links are clicked on. The information is assigned to individual newsletter recipients and stored in their profiles until deleted. The evaluations are used to identify the reading habits of our users and to adapt our content to them or to send different content according to the interests of our users. The measurement of opening and click rates and the storage of measurement results in user profiles and their further processing are based on user consent. Unfortunately, it is not possible to cancel the performance measurement separately; in this case, the entire newsletter subscription must be cancelled or objected to. In this case, the saved profile information is deleted; Legal bases: Consent (Art. 6 (1) (a) GDPR).
‍
Brevo: email delivery and automation services; Service provider: Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin, Germany; Legal bases: legitimate interests (Art. 6 (1) (f) GDPR); Site: https://www.brevo.com/; Privacy statement: https://www.brevo.com/legal/privacypolicy/; Order processing contract: Provided by service provider. Basis for transfers to third countries: Switzerland - Adequacy Decision (Germany).

Definitions of terms

This section provides an overview of the terms used in this privacy statement. Insofar as the terms are defined by law, their legal definitions apply. The following explanations, on the other hand, are primarily intended for understanding.
‍
Affiliate tracking: As part of affiliate tracking, links that the linking websites use to direct users to websites with product or other offers are logged. The operators of the respective linking websites can receive a commission if users follow these so-called affiliate links and then take advantage of the offers (e.g. buy goods or use services). This requires providers to be able to track whether users who are interested in certain offers then take advantage of them by initiating the affiliate links. For this reason, the functionality of affiliate links requires that they be supplemented with certain values, which become part of the link or are stored elsewhere, e.g. in a cookie. The values include in particular the source website (referrer), the time, an online identification of the operator of the website on which the affiliate link was located, an online identifier of the respective offer, an online identification of the user as well as tracking-specific values, such as advertising material ID, partner ID and categorizations.
Conversion measurement: Conversion measurement (also known as “visit action evaluation”) is a method that can be used to determine the effectiveness of marketing measures. For this purpose, a cookie is usually stored on the users' devices within the websites on which the marketing measures are carried out and then retrieved again on the target website. For example, this allows us to understand whether the ads we placed on other websites were successful.
‍Personal data: “Personal data” is any information relating to an identified or identifiable natural person (hereinafter “data subject”); an identifiable natural person is one who can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. cookie) or to one or more special characteristics that express the physical, physiological, genetic, psychological, economic, are the cultural or social identity of that natural person.
Profiles with user-related information: The processing of “profiles with user-related information”, or “profiles” for short, comprises any type of automated processing of personal data, which consists of using this personal data to analyze, evaluate or predict certain personal aspects relating to a natural person (depending on the type of profiling, this may include different information regarding demographics, behavior and interests, such as interaction with websites and their content, etc.) (e.g. interests in specific content or products, click behavior on a website or location). Cookies and web beacons are often used for profiling purposes.
Range measurement: Reach measurement (also known as web analytics) is used to evaluate the flow of visitors to an online offer and can include visitors' behavior or interests in certain information, such as the content of websites. With the help of reach analysis, operators of online offers can, for example, recognize at what time users visit their websites and what content they are interested in. This allows them, for example, to better adapt the content of the websites to the needs of their visitors. Pseudonymous cookies and web beacons are often used for audience analysis purposes to recognize returning visitors and thus obtain more detailed analyses of the use of an online offer.
Tracking: We speak of “tracking” when the behavior of users can be traced across several online offerings. As a rule, behavioral and interest information with regard to the online offers used is stored in cookies or on servers of the providers of tracking technologies (so-called profiling). This information can then be used, for example, to show users advertisements that are likely to match their interests.
‍responsible person: “Responsible person” is the natural or legal person, authority, agency or other body which, alone or together with others, decides on the purposes and means of processing personal data.
‍processing: “Processing” means any process carried out with or without the aid of automated procedures or any such series of processes in connection with personal data. The term is broad and covers virtually any handling of data, whether collection, evaluation, storage, transmission or deletion.
Target group formation: Target group building (English “custom audiences”) is when target groups are determined for advertising purposes, e.g. displaying advertisements. For example, based on a user's interest in specific products or topics on the Internet, it can be concluded that this user is interested in advertisements for similar products or the online shop in which he viewed the products. In turn, we speak of “lookalike audiences” (or similar target groups) when the content considered suitable is displayed to users whose profiles or interests presumably correspond to the users for whom the profiles were created. Cookies and web beacons are usually used for the purpose of creating custom audiences and lookalike audiences.

Cookie statement and settings