Privacy policy

1 · Controller

Represented by the partners Dennis Dörfl and Thomas Müller
Email: info@auffindbar.ai

We have not appointed a data protection officer. The conditions of Art. 37 GDPR and § 38 BDSG do not apply to us.

2 · Your rights at a glance

As a data subject, you have the following rights:

• Access to your personal data (Art. 15 GDPR)
• Rectification of inaccurate or incomplete data (Art. 16 GDPR)
• Erasure under the conditions of Art. 17 GDPR
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)
• Withdrawal of consent at any time, with effect for the future (Art. 7(3) GDPR)

To exercise these rights, an email to info@auffindbar.ai is sufficient.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Saxon Data Protection Commissioner, Devrientstraße 5, 01067 Dresden. You may also contact the authority at your place of residence or work.

3 · Right to object under Art. 21 GDPR

Where we process data on the basis of legitimate interests under Art. 6(1)(f) GDPR, you can object to this processing. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to assert or defend legal claims.

You can submit your objection by email to info@auffindbar.ai.

4 · Visiting our website and server log files

You do not have to provide any personal data to visit our website.

When you visit our website, your browser automatically transmits certain data, which our hosting provider stores in server log files:

• Date and time of the request
• Page accessed
• Browser type and version
• Operating system used
• Referrer URL, i.e. the page visited immediately beforehand
• Host name of the computer accessing the website
• IP address
• Amount of data transferred

This data is technically necessary to deliver the website. We also use it to ensure the security and stability of our website, for example to detect and defend against attacks.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically error-free provision and security of our website.

Hosting. Our website is operated by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. The data is processed in data centers within the European Union. We have concluded a data processing agreement with IONOS under Art. 28 GDPR.

Storage period. The log files are automatically deleted after 30 days at the latest.

5 · No cookies, no web analytics

Our website does not use cookies, including technically necessary cookies. We use no web analytics, tracking, advertising pixels or consent management because there is no occasion for it.

We serve fonts and images from our own servers. There is no retrieval of Google Fonts or comparable services that would transmit your IP address to third parties.

We embed no social network content, maps, videos or other third-party content in our pages.

For this reason, there is no cookie banner on our website. There is nothing you need to consent to.

6 · Inquiry via our form

On our AI visibility assessment page, you can submit an inquiry. When you do so, we process the following information:

• First name and last name
• Company or organization
• Email address
• Website address
• Phone number, optional

In addition, the page from which you submitted the inquiry is transmitted.

We use this data exclusively to process your inquiry and to contact you.

The legal basis is Art. 6(1)(b) GDPR because the processing is necessary to take steps at your request prior to entering into a contract. Where your inquiry has no contractual connection, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in responding to inquiries addressed to us.

Service provider. The transmission, management and storage of inquiries takes place via HubSpot, Inc., 2 Canal Park, Cambridge, MA 02141, USA. We also use HubSpot for customer and contact management: your details are stored there as a contact so that we can keep track of our communications and business relationship. Within the EU, HubSpot Ireland Limited, 1 Sir John Rogerson’s Quay, Dublin 2, Ireland is the contracting party. We have concluded a data processing agreement with HubSpot under Art. 28 GDPR. Further details are provided in Section 9.

For the inquiry, we load no HubSpot script and set no HubSpot cookie. Your details are transmitted only when you submit the form.

Storage period. How long we store your details depends on what happens next:

• If your inquiry leads to no further contact, we delete it six months after the communication ends.
• If there is an ongoing interest in a business relationship, we store your details for as long as this interest exists, but for no more than two years after the last contact. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in maintaining business relationships. You can object to this storage at any time; see Section 3.
• If a contract is concluded, we store your data for the duration of the cooperation and thereafter for as long as required under statutory retention obligations. Under commercial and tax law, these periods can be up to ten years.

7 · Booking an intro call

To arrange a free intro call, we use HubSpot’s appointment scheduler. The booking page is hosted by HubSpot and is accessed via a HubSpot address. Our website redirects you to that page.

On that page, HubSpot processes the details you provide for the booking, as well as the appointment you select. HubSpot’s privacy notice applies: https://legal.hubspot.com/privacy-policy

We receive the booking data in order to conduct the appointment.

The legal basis is Art. 6(1)(b) GDPR.

Following this link does not load a HubSpot script or set a cookie on our website. Data is transmitted to HubSpot only when you follow the link and use the booking page.

8 · Processing within our services

This section concerns clients, not visitors to our website.

The subject of our services is measuring the visibility of businesses in AI systems. For this purpose, we process business data: company names, service descriptions, competitors, publicly accessible website content and answers generated by AI systems. This information is generally not personal data.

The question catalog and evaluation relate to businesses and their offers, not to individuals.

This may include publicly available personal data, for example the names of contact persons on an assessed website or individuals mentioned in AI-generated answers. We do not deliberately collect such information, assess it in relation to individuals, or use it beyond what is necessary to perform the assignment. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in performing the commissioned service.

We process personal data within an assignment only to the extent required for the cooperation, in particular the contact details of contact persons. Where we process personal data on your behalf, we conclude a data processing agreement with you under Art. 28 GDPR. The subprocessors we use are named therein.

The legal basis for processing contact-person data is Art. 6(1)(b) GDPR.

Confidentiality. Independently of data protection requirements, we treat our clients’ measurement and competitive data as confidential. We do not use results as a reference or case study without asking first.

9 · Recipients and transfers to third countries

Within our company, only those persons have access to your data who need it to process your request.

In addition, we pass data on to the following recipients:

Processors under Art. 28 GDPR

We have concluded a data processing agreement under Art. 28 GDPR with each of these service providers. The agreements require the providers to process personal data in accordance with the applicable data protection requirements.

Other recipients who determine the purposes and means of processing independently

Transfer to the USA

Three of the processors named above, HubSpot, Google and Notion, are based in the USA or process data there.

On July 10, 2023, the European Commission adopted its adequacy decision for the EU–US Data Privacy Framework under Art. 45 GDPR. Under this decision, personal data may be transferred to US organizations participating in the Framework.

The relevant providers are certified under this Framework. The transfer may therefore rely on the adequacy decision under Art. 45 GDPR where the relevant US entity is covered by the Framework.

You can find the list of certified organizations at https://www.dataprivacyframework.gov/

In addition, the providers have agreed to the European Commission’s Standard Contractual Clauses with us under Art. 46 GDPR.

10 · Data security

We take technical and organizational measures to protect your data against loss, destruction, manipulation and unauthorized access. Data transmitted to our website is encrypted using HTTPS.

We point out that data transmission over the internet may be subject to security risks despite these measures. Complete protection against access by third parties is not possible.

11 · Changes to this policy

We adapt this privacy policy when the legal situation, our service providers or the processing itself changes. The “Last updated” date above indicates when this version of the privacy policy was last updated.