Privacy Policy

This privacy policy informs you about the processing of your personal data under the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). The German version is the legally binding version; this English text is provided for convenience.

1. Scope

This policy applies to the marketing website awareto.com and the product dashboard app.awareto.com. It explains the nature, scope, and purposes of processing personal data when you visit these services and during your contractual relationship with Awareto.

Where Awareto processes personal data of business customers' website visitors on their behalf (data processing on behalf), the separate Data Processing Agreement (DPA / AVV) governs, including its sub-processor list and TOMs.

2. Controller

A data protection officer is not required by law (§ 38 BDSG). Please direct privacy questions to the email address above.

3. Legal bases for processing

We process personal data on one of the following legal bases:

• Art. 6(1)(a) GDPR – consent (e.g. newsletter, optional cookies)
• Art. 6(1)(b) GDPR – performance of a contract or pre-contractual measures (demo requests, account, billing)
• Art. 6(1)(c) GDPR – legal obligations (e.g. commercial and tax retention)
• Art. 6(1)(f) GDPR – legitimate interest (security, reach measurement after consent, B2B direct marketing)
• § 25(1) TDDDG – consent for storing/reading information on your end device

4. Server logs and hosting

When you visit awareto.com, technically required data is processed in server logs (IP address, date/time, requested URL, browser type, operating system, referrer). Legal basis: Art. 6(1)(f) GDPR; the legitimate interest is the operation, security and stability of the website. Logs are deleted after 7 days.

Hosting awareto.com: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Delivery is via EU edge nodes, but a data transfer to the United States cannot be ruled out. EU Standard Contractual Clauses (SCC) are in place, and Vercel is certified under the EU-US Data Privacy Framework (DPF).

Hosting app.awareto.com / product dashboard: Hetzner Online GmbH (Germany) and Supabase Inc. (database/auth, EU region). Details on processing under data-processing-on-behalf are set out in the separate DPA.

5. Cookies, tracking and consent

We use strictly necessary cookies required for the operation of the website (e.g. storing your cookie choice). Legal basis: § 25(2)(2) TDDDG.

Beyond that, we use the following services only with your express consent (§ 25(1) TDDDG; Art. 6(1)(a) GDPR). No scripts from these providers are loaded and no cookies are set until you consent. You can withdraw your consent at any time via the “Cookie settings” link in the footer.

Google Analytics 4

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent: Google LLC, USA). Data processed: truncated IP address, device and browser information, usage behaviour, pseudonymous IDs. Retention: 14 months. Transfers to the United States possible; safeguarded by SCC and Google's DPF certification. Tracking ID: G-KH14QYKFJG.

Microsoft Clarity

Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (parent: Microsoft Corporation, USA). Data processed: mouse movements, clicks, scroll depth, session recordings (with masking of sensitive fields), device and browser information. Retention: 1 year. Transfers to the United States possible; safeguarded by SCC and DPF. Project ID: vppoemrjo8.

6. Contact, demo and newsletter requests (Brevo)

When you submit a contact, demo or newsletter form on awareto.com, we process the data you provide (at minimum your email address; optionally name, company, request source, language) to handle your request and – for newsletter signups – to send the requested emails.

We use Brevo (Sendinblue SAS, 106 Boulevard Haussmann, 75008 Paris, France) for contact management and transactional email. Processing takes place within the EU. A data processing agreement with Brevo is in place.

Newsletter / email sequences: Sign-up uses double opt-in – after submission you receive a confirmation email. The sequence comprises max. 4 emails over 7 days. You can unsubscribe at any time via the link in each email or by message to [email protected]. Legal basis: Art. 6(1)(a) GDPR.

B2B contact-request leads are kept for up to 24 months after last contact (Art. 6(1)(f) GDPR – B2B business development) and then deleted, unless a contractual or statutory retention obligation applies.

7. Chat widget on awareto.com

On awareto.com we embed our own AI-powered chat widget so that visitors can ask questions about our product. When used, we process the content of your messages, timestamps, the calling page and technical browser data. Legal basis: Art. 6(1)(b) GDPR (pre-contractual communication) and Art. 6(1)(f) GDPR (improving our offering).

To generate responses we use AI APIs from the following providers: Anthropic PBC (San Francisco, USA) and Google Ireland Ltd. / Google LLC (Gemini API). Both providers are contractually bound not to use your inputs for training (zero-retention configuration). Transfers to the United States are based on EU SCC and DPF.

Notice under EU AI Act, Art. 50: You are interacting with an AI system. Responses are generated automatically and may be incorrect or incomplete.

Chat conversations on awareto.com are stored in plain text for a maximum of 90 days and then anonymised or deleted.

8. Account, authentication and billing (app.awareto.com)

On registration in the product dashboard we process email address, encrypted password and, where applicable, name and company data. Authentication is via Supabase (Supabase Inc., USA; processing in EU region; SCC + DPF; DPA in place). Legal basis: Art. 6(1)(b) GDPR.

Payment processing uses Stripe Payments Europe Ltd. (Dublin, Ireland). Stripe processes payment and invoicing data as an independent controller; see Stripe's privacy policy at stripe.com/privacy. Invoicing data is retained for up to 10 years under German commercial and tax law (§ 257 HGB, § 147 AO).

9. Appointment booking (Calendly)

For booking demo appointments we use Calendly LLC, 271 17th Street NW, Atlanta, GA 30363, USA. On booking, name, email address, preferred time and any pre-qualification answers are transmitted to Calendly. Transfers to the United States are based on SCC and DPF. More information: calendly.com/privacy. Legal basis: Art. 6(1)(b) GDPR.

10. Transfers to third countries

As stated above, transfers to third countries (in particular the United States) may occur. We use only providers with whom EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914) are concluded and who – where applicable – are certified under the EU-US Data Privacy Framework. For each US transfer we have performed a Transfer Impact Assessment and implemented supplementary safeguards (encryption, purpose limitation, pseudonymisation).

11. Your rights as a data subject

Under the GDPR you have the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR) – in particular against direct marketing at any time without giving reasons
• Right to withdraw consent (Art. 7(3) GDPR) – without affecting the lawfulness of processing prior to the withdrawal

To exercise your rights please contact: [email protected].

You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority for our seat is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, [email protected].

12. Retention periods

• Server logs: 7 days
• Lead / contact requests: up to 24 months after last contact
• Newsletter data: until consent is withdrawn
• Account data: for the duration of the business relationship plus statutory retention periods
• Invoices / billing data: 10 years (§ 257 HGB, § 147 AO)
• Chat conversations on awareto.com: max. 90 days plain text, then anonymisation / deletion
• Cookies: lifetime as stated in the cookie banner / the respective provider's privacy notice

13. Changes to this privacy policy

We update this privacy policy whenever the actual processing changes or legal requirements demand it. The current version is available at this URL.

Last updated: April 2026