Privacy policy

1 · Controller

Represented by the partners Dennis Dörfl and Thomas Müller
Email: info@auffindbar.ai

We have not appointed a data protection officer. The conditions of Art. 37 GDPR and § 38 BDSG do not apply to us.

2 · Your rights at a glance

As a data subject you have the following rights:

• Access to the data we store about you (Art. 15 GDPR)
• Rectification of inaccurate or incomplete data (Art. 16 GDPR)
• Erasure under the conditions of Art. 17 GDPR
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to the processing (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7 (3) GDPR)

To exercise these rights, an email to info@auffindbar.ai is sufficient.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Saxon Data Protection Commissioner, Devrientstraße 5, 01067 Dresden. You may also contact the authority at your place of residence or work.

3 · Right to object under Art. 21 GDPR

Where we process data on the basis of legitimate interests under Art. 6 (1) (f) GDPR, you can object to this processing. We will then no longer process the data, unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to assert or defend legal claims.

You can submit your objection by email to info@auffindbar.ai.

4 · Visiting our website and server log files

You do not have to provide any personal data to visit our website.

When you visit our website, your browser automatically transmits certain data, which our hosting provider stores in server log files:

• Date and time of the request
• The page accessed
• Browser type and version
• Operating system used
• Referrer URL, i.e. the page you visited immediately beforehand
• Host name of the computer accessing the website
• IP address
• Amount of data transferred

This data is technically necessary to deliver the website. We also use it to ensure the security and stability of our website, for example to detect and defend against attacks.

Legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in the technically error-free provision and the security of our website.

Hosting. Our website is operated by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. The data is processed in data centres within the European Union. We have concluded a data processing agreement with IONOS under Art. 28 GDPR.

Storage period. The log files are automatically deleted after 30 days at the latest.

5 · No cookies, no web analytics

Our website sets no cookies, not even technically necessary ones. We use no web analytics, no tracking, no advertising pixels and no consent management, because there is no occasion for it.

We serve fonts and images from our own servers. There is no retrieval of Google Fonts or comparable services in which your IP address would be transmitted to third parties.

We embed no social-network content, no maps, no videos and no other third-party content in our pages.

For this reason there is no cookie banner on our website. There is nothing you need to consent to.

6 · Enquiry via our form

On our AI visibility assessment page you can submit an enquiry. When you submit an enquiry, we process the following information:

• First name and last name
• Company or organisation
• Email address
• Website address
• Phone number, optional

In addition, the page from which you submitted the enquiry is transmitted.

We use this data exclusively to process your enquiry and to get in touch with you.

Legal basis is Art. 6 (1) (b) GDPR, because the processing is necessary to take steps at your request prior to entering into a contract. Insofar as your enquiry has no contractual connection, the legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in answering enquiries addressed to us.

Service provider. The transmission, management and storage of enquiries takes place via HubSpot, Inc., 2 Canal Park, Cambridge, MA 02141, USA. We also use HubSpot for customer and contact management: your details are stored there as a contact so that we can keep track of our communications and business relationship. Within the EU, HubSpot Ireland Limited, 1 Sir John Rogerson’s Quay, Dublin 2, Ireland is the contracting party. We have concluded a data processing agreement with HubSpot under Art. 28 GDPR. Further details in section 9.

For the enquiry we load no HubSpot script and set no HubSpot cookie. Your details are transmitted only when you submit.

Storage period. How long we store your details depends on the further course:

• If your enquiry leads to no further contact, we delete it six months after the communication ends.
• If there is an ongoing interest in a business relationship, we store your details for as long as this interest exists, but at most two years after the last contact. Legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in maintaining business relationships. You can object to this storage at any time, see section 3.
• If a contract is concluded, we store your data for the duration of the cooperation and thereafter for as long as required under statutory retention obligations. Under commercial and tax law these are up to ten years.

7 · Booking an intro call

To arrange a free intro call we use HubSpot’s appointment scheduler. The scheduler is accessed at a HubSpot address; our website redirects you there.

On that page, HubSpot processes the details you provide for the booking, as well as the chosen appointment. HubSpot’s privacy notice applies: https://legal.hubspot.com/privacy-policy

We receive the booking data in order to carry out the appointment.

Legal basis is Art. 6 (1) (b) GDPR.

Following this link does not load a HubSpot script or set a cookie on our website. A transmission to HubSpot takes place only when you follow the link.

8 · Processing within our services

This section concerns clients, not visitors to our website.

The subject of our services is measuring the visibility of businesses in AI systems. For this we process business data: company names, service descriptions, competitors, publicly accessible website content and answers generated by AI systems. This information is generally not personal data.

The question catalogue and the evaluation relate to businesses and offers, not to individuals.

This may include publicly available personal data, for example the names of contact persons on an assessed website or individuals mentioned in AI-generated answers. We do not deliberately collect such information, assess it in relation to individuals, or use it beyond what is necessary to perform the assignment. Legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in performing the commissioned service.

We process personal data within an assignment only insofar as the cooperation requires it, in particular the contact details of the contact persons. Insofar as we process personal data on your behalf, we conclude a data processing agreement with you under Art. 28 GDPR. The sub-processors we use are named therein.

Legal basis for processing contact-person data is Art. 6 (1) (b) GDPR.

Confidentiality. Independently of data protection, we treat our clients’ measurement and competitive data confidentially. We do not use results as a reference or case study without asking first.

9 · Recipients and transfer to third countries

Within our company, only those persons have access to your data who need it to process your request.

In addition, we pass data on to the following recipients:

Processors under Art. 28 GDPR

We have concluded a data processing agreement under Art. 28 GDPR with each of these service providers. The agreements require the providers to process personal data in accordance with the applicable data protection requirements.

Other recipients who determine the purposes and means of processing independently:

Authorities and public bodies, insofar as we are legally obliged to disclose.

Transfer to the USA

Three of the named processors, HubSpot, Google and Notion, are based in the USA or process data there.

On 10 July 2023, the European Commission adopted its adequacy decision for the EU–US Data Privacy Framework under Art. 45 GDPR. Under this decision, personal data may be transferred to US organisations participating in the Framework. Where the relevant US entity is covered by the Framework, the transfer may rely on that adequacy decision. We also have Standard Contractual Clauses in place with the providers under Art. 46 GDPR.

You can find the list of certified companies at https://www.dataprivacyframework.gov/

10 · Data security

We take technical and organisational measures to protect your data against loss, destruction, manipulation and unauthorised access. Data transmitted to our website is encrypted using HTTPS.

We point out that data transmission over the internet may be subject to security risks despite these measures. Complete protection against access by third parties is not possible.

11 · Changes to this policy

We adapt this privacy policy when the legal situation, our service providers or the processing itself change. The ‘last updated’ date above states the date of the latest version.