Privacy Policy

1. General information and mandatory disclosures

When you use this website, various personal data is collected. Personal data is data that can be used to identify you personally. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this happens.

Please note that data transmission over the internet (e.g. when communicating by email) may be subject to security vulnerabilities. Complete protection of data against access by third parties is not possible.

Controller

The controller within the meaning of the EU General Data Protection Regulation (GDPR) is:

You can reach our data protection officer, Florian Kaiser of datenschutzfrankfurt.de, as follows:

The controller is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data (e.g. names, email addresses, etc.).

Access, blocking, deletion

Within the scope of the applicable legal provisions, you have the right at any time to obtain free information about your stored personal data, its origin and recipients and the purpose of the data processing and, where applicable, a right to rectification, blocking or deletion of this data. For this purpose, as well as for further questions on the subject of personal data, you can contact us at any time at the address given in the legal notice.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in fulfilment of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done to the extent technically feasible.

Withdrawal of your consent to data processing

Many data processing operations are only possible with your express consent. You can withdraw consent you have already given at any time. An informal notification by email to us is sufficient. The lawfulness of the data processing carried out until the withdrawal remains unaffected by the withdrawal.

Right to lodge a complaint with the competent supervisory authority

In the event of breaches of data protection law, the data subject has the right to lodge a complaint with the competent supervisory authority. The competent supervisory authority for data protection matters is the state data protection commissioner of the German federal state in which our company is based. A list of the data protection officers and their contact details can be found at the following link: bfdi.bund.de.

Objection to promotional emails

We hereby object to the use of contact data published within the scope of our legal notice obligation for sending advertising and information material that has not been expressly requested. The operators of these pages expressly reserve the right to take legal action in the event of the unsolicited sending of advertising information, for example through spam emails.

Links

On our websites we offer you links to websites that may be of interest to you, the content of which we have no influence over – for example a link to the Google Maps map service for directions to our location. Only when you click such a link do you leave our website; no data is transferred to the linked providers when you merely visit our pages. We accept no liability for third-party content. The linked pages were checked for possible legal violations at the time the link was created. As soon as we become aware of legal violations on the linked websites, we will remove the affected links immediately.

SSL / TLS encryption

For security reasons and to protect the transmission of confidential content, such as inquiries you send to us as the site operator, this site uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line. When SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

2. Data collection on our website

Server log files

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

• Browser type and browser version
• Operating system used
• Referrer URL
• Host name of the accessing computer
• Time of the server request
• IP address

This data is not merged with other data sources. The basis for the data processing is Art. 6(1)(f) GDPR – our legitimate interest in the technically error-free presentation, stability and security of our website.

Cookies and consent management (consent banner)

Some of the websites use so-called cookies. Cookies do not damage your computer and do not contain viruses. Cookies serve to make our offering more user-friendly, effective and secure. Cookies are small text files that are placed on your computer and stored by your browser.

Most of the cookies we use are so-called "session cookies". They are automatically deleted at the end of your visit. Other cookies remain stored on your device until you delete them. These cookies enable us to recognize your browser on your next visit.

When you first visit our website, we ask you via a consent banner which cookie categories you wish to allow. Technically necessary cookies are stored on the basis of Art. 6(1)(f) GDPR – the website operator has a legitimate interest in the technically error-free and optimized provision of its services. All analytics and marketing cookies are set exclusively after your consent (Art. 6(1)(a) GDPR, Section 25(1) of the German TDDDG). You can change or withdraw your selection at any time via the cookie settings. You can also set your browser to inform you when cookies are set, to allow cookies only in individual cases or to exclude them in general. If cookies are deactivated, the functionality of this website may be restricted.

Individual reference links

In business communication (e.g. by email) we occasionally send individualized short links to reference pages of this website (recognizable by the address component "/l/"). When such a link is opened, we store the time of access and the identifier contained in the link and redirect you immediately to the respective reference page. This allows us to see whether an individually sent link was used.

No cookies are set and no IP addresses or device information are stored; the data is not merged with other usage data of this website. Storage takes place in our hosting environment (see the section "Hosting by Microsoft Azure"). The legal basis is Art. 6(1)(f) GDPR based on our legitimate interest in tracking the success of individually sent information in business initiation. You can object to this processing at any time (see "Right to object"); the regular reference pages can also be reached directly at cogitaris.de/referenzen without a short link.

Contact

If you send us inquiries via the contact form or by email, your details from the inquiry form or your email, including the contact data you provide there, will be stored by us for the purpose of processing the inquiry and in case of follow-up questions. We do not pass on this data without your consent.

The processing of the data entered in the contact form or sent by email is therefore based exclusively on your consent (Art. 6(1)(a) GDPR). You can withdraw this consent at any time. An informal notification via the contact form or by email to us is sufficient. The lawfulness of the data processing operations carried out until the withdrawal remains unaffected by the withdrawal.

The data you enter in the contact form or provide by email remains with us until you ask us to delete it, withdraw your consent to storage or the purpose for the data storage no longer applies. Mandatory legal provisions, in particular retention periods, remain unaffected.

Processing of data (customer and contract data)

We collect, process and use personal data only to the extent that it is necessary for the establishment, content or amendment of the legal relationship (inventory data). This is done on the basis of Art. 6(1)(b) GDPR. We collect, process and use personal data about the use of our websites (usage data) only to the extent necessary to enable the user to use the service or to bill for it.

The collected customer data is deleted after completion of the order or termination of the business relationship. Statutory retention periods remain unaffected.

3. Hosting and integrated services

Hosting by Microsoft Azure

This website runs on Microsoft Azure, provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland ("Microsoft"), in the Azure West Europe region. When you access our pages, technically necessary data, in particular the IP address, browser information, access time and requested URL, is processed by Microsoft and stored in server logs. This processing supports secure website operation and attack prevention on the basis of our legitimate interest (Art. 6(1)(f) GDPR).

The Microsoft Products and Services Data Protection Addendum, including its data processing terms under Art. 28 GDPR, applies to Microsoft's processing. Further information is available in Microsoft's privacy statement: microsoft.com/privacy.

Fonts (locally hosted)

For the uniform display of fonts, this website uses web fonts. All font files are stored locally on our own web server and delivered from there. No connection to servers of Google or other font providers is established when our pages are accessed; no personal data is transferred to third parties in the process.

Email delivery via Resend

For the automated sending of transactional emails – for example confirmation and notification emails in connection with contact forms, job applications, appointment bookings or case study downloads – we use the service Resend, operated by Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA ("Resend").

When sending, the contact data provided in the respective form (name, email address, phone number, company, position, where applicable) as well as the content of your message and any attached files are transmitted to Resend. Resend processes this data exclusively for the purpose of email delivery and technical delivery monitoring. We have concluded a data processing agreement with Resend in accordance with Art. 28 GDPR.

The processing is based on Art. 6(1)(b) GDPR (contract initiation or performance), and for job applications additionally on Section 26 of the German BDSG. The transfer to the USA is safeguarded by the EU-US Data Privacy Framework and standard contractual clauses in accordance with Art. 46(2)(c) GDPR. Resend stores the transmitted content for a short period for delivery logging and then deletes it in accordance with its own retention policies. Further information: resend.com/legal/privacy-policy and resend.com/legal/dpa.

Online appointment booking with Cal.com

For booking consultation and introductory calls via our website, we use the service Cal.com of Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA ("Cal.com"). We use the European instance of the service (cal.eu), where the booking data is stored on servers within the European Union. If you select an appointment via the embedded booking widget, the information required for this (in particular name, email address, phone number, company, preferred date and free-text notes, where applicable) is transmitted to Cal.com and stored there. Cal.com sends the appointment invitations and provides us with the booking details via a technical interface (webhook).

The processing is based on Art. 6(1)(b) GDPR (contract initiation) or Art. 6(1)(a) GDPR (consent through active booking). We have concluded a data processing agreement with Cal.com in accordance with Art. 28 GDPR. Insofar as data is transferred to the USA, this is safeguarded by the EU-US Data Privacy Framework and standard contractual clauses in accordance with Art. 46(2)(c) GDPR. Further information: cal.com/privacy.

Lead and inquiry management with Notion

Incoming inquiries, lead data and appointment bookings are additionally recorded in a database of the provider Notion Labs, Inc., 2300 Harrison Street, San Francisco, CA 94110, USA ("Notion") in order to process inquiries in an organized manner. The contact data provided in the respective form, the message content and, where applicable, booking or source information (landing page, Cal.com booking ID) are transferred.

The processing takes place to handle your inquiry and to maintain the business relationship on the basis of Art. 6(1)(b) GDPR or our legitimate interest in orderly sales and inquiry processing (Art. 6(1)(f) GDPR). We have concluded a data processing agreement with Notion in accordance with Art. 28 GDPR. The transfer to the USA is safeguarded by the EU-US Data Privacy Framework and standard contractual clauses in accordance with Art. 46(2)(c) GDPR. Further information: notion.com/privacy.

Code hosting and version control with GitHub

The source code of this website is versioned in a private repository at GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA ("GitHub"). Personal data of website visitors is not processed via GitHub – it is purely code management. We mention GitHub for reasons of transparency, as the provision of the website would not be possible without this service. Further information: docs.github.com/en/site-policy/privacy-policies.

4. Analytics, statistics and marketing services

All services described in this section are used exclusively if you have previously given your consent via our consent banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Before your consent, all analytics and marketing tags are blocked. You can withdraw your consent at any time with effect for the future via the cookie settings.

Google Tag Manager and Google Consent Mode

This website uses the Google Tag Manager of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The Google Tag Manager is a tag management system that can be used to integrate tracking and statistics tools as well as other technologies on the website. The Tag Manager itself does not collect any personal data, but only manages the tags delivered. Personal data is only processed by the individual services delivered via the Tag Manager – and only after your consent via our consent banner (Google Consent Mode v2).

Further information can be found in Google's privacy policy: policies.google.com/privacy.

Server-side tagging (Stape)

For the processing of measurement and marketing data, we additionally use a so-called server-side tagging container. The measurement data is not sent directly from your browser to the respective analytics services, but first transferred to a server controlled by us under our own subdomain (order.cogitaris.de). There, the data can be checked, shortened and filtered before it is forwarded to the downstream services. This improves control over the transferred data and data minimization.

The server container is operated via the service Stape of Stape, Inc., 8 The Green, Suite #12892, Dover, DE 19901, USA ("Stape"); the container is hosted in a data center within the European Union. We have concluded a data processing agreement with Stape in accordance with Art. 28 GDPR; any transfers to third countries are safeguarded by standard contractual clauses in accordance with Art. 46(2)(c) GDPR. The processing is based on your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Further information: stape.io/privacy-notice.

Google Analytics 4

This website uses functions of the web analytics service Google Analytics 4. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies and comparable technologies that enable an analysis of the use of the website. The information generated about your use of this website is usually transferred to a Google server and stored there; this may also involve a transfer to the USA. In Google Analytics 4, IP addresses are processed only in shortened form by default and are not stored.

We use the data to analyze usage behavior in order to make our website more appealing to you, to fix errors and to optimize our offering. The processing takes place exclusively after your consent via the consent banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). We have concluded a data processing agreement with Google. The transfer to the USA is safeguarded by the EU-US Data Privacy Framework and standard contractual clauses in accordance with Art. 46(2)(c) GDPR.

You can withdraw your consent at any time via the cookie settings. In addition, you can prevent collection by Google Analytics on the browser side by installing the following browser add-on: tools.google.com/dlpage/gaoptout. More information on the handling of user data in Google Analytics can be found in Google's privacy policy: support.google.com/analytics.

Microsoft Clarity

On this website we use Microsoft Clarity, a web analytics service of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA. Clarity helps us understand how visitors interact with our website – for example, which pages are particularly relevant and where there is potential for improvement. For this purpose, Clarity creates anonymized session recordings and aggregated heatmaps. Expressly, no keyboard entries (passwords, credit card data, form contents) and no sensitive content are recorded – Clarity masks these automatically.

The processing takes place only after your express consent via our consent banner on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG. We have concluded a data processing agreement with Microsoft in accordance with Art. 28 GDPR. The transfer to the USA is safeguarded by the EU-US Data Privacy Framework and standard contractual clauses in accordance with Art. 46(2)(c) GDPR. You can withdraw your consent at any time. Further information: privacy.microsoft.com/en-us/privacystatement.

Google Ads conversion tracking

This website uses Google Ads conversion tracking. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). If you reach our website through a Google advertisement and have consented through our consent banner, a cookie is stored on your device or the Google Click Identifier (GCLID) supplied by Google is retained for up to 90 days. This allows Google and us to recognize that a person clicked an advertisement and subsequently completed a predefined action, such as submitting a contact form or booking an appointment. We receive the aggregate number of users who clicked an advertisement and completed a conversion.

If you provide your email address as part of an inquiry or appointment booking and have consented to marketing cookies, it may be sent to Google in encrypted, hashed form to improve conversion attribution ("enhanced conversions"). Google uses SHA-256 for this purpose; the email address is converted into a non-reversible value on your device before transmission. We may also associate the stored GCLID with the subsequent progress of your inquiry in our CRM and later tell Google Ads whether the advertisement resulted in a business relationship (offline conversion import). Only the click identifier is sent to Google for this purpose, not your name or inquiry content.

Processing takes place only after your consent through the consent banner under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Data may be transferred to Google LLC in the USA; this transfer is safeguarded by the EU-US Data Privacy Framework and standard contractual clauses under Art. 46(2)(c) GDPR. You can withdraw your consent at any time through the cookie settings. Further information is available in Google's privacy policy: policies.google.com/privacy.

Microsoft Advertising (Universal Event Tracking)

This website uses the conversion tracking "Universal Event Tracking" (UET) from Microsoft Advertising. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. If you reached our website via a Microsoft Bing ad and have given your consent, a cookie is set on your device. This enables Microsoft and us to recognize that someone clicked on an ad, was redirected to our website and reached a previously determined target page (conversion). We only learn the total number of users who clicked on an ad – but no information with which users can be personally identified.

The processing takes place exclusively after your consent via the consent banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Data may be transferred to Microsoft Corporation in the USA; this is safeguarded by the EU-US Data Privacy Framework and standard contractual clauses in accordance with Art. 46(2)(c) GDPR. You can withdraw your consent at any time. Further information: privacy.microsoft.com/en-us/privacystatement.

Meta Pixel (Facebook)

This website uses the visitor action pixel ("Meta Pixel") of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta"). If you have given your consent, this can be used to track the behavior of visitors after they have been redirected to our website by clicking on a Facebook or Instagram ad. This allows the effectiveness of ads to be evaluated and advertising measures to be optimized. The collected data is anonymous to us – we cannot draw any conclusions about the identity of individual users. However, Meta can link the data to your Facebook account and use it for its own advertising purposes in accordance with Meta's data use policy.

Insofar as personal data is collected via the Meta Pixel and transferred to Meta, we and Meta are jointly responsible for this data processing (Art. 26 GDPR). The basis for this is an agreement on joint processing ("Controller Addendum"). The processing takes place exclusively after your consent via the consent banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG); you can withdraw it at any time. The transfer to the USA is safeguarded by the EU-US Data Privacy Framework and standard contractual clauses in accordance with Art. 46(2)(c) GDPR. Further information: facebook.com/privacy/policy.

5. Information on the processing of personal data

The protection of your personal data is taken into account in all our business processes. Below you will find a detailed overview of the processing of your personal data by us.

Personal data means all information relating to an identified or identifiable natural person. With this privacy information, we inform you about the type, scope and purposes of the collection of personal data by us and how we handle this data. You will also learn what rights you have with regard to the processing of your personal data. The following information applies to all natural persons whose personal data is processed by us.

Information for business partners and prospects

Voluntary nature of providing data

The provision of your personal data is generally voluntary. However, to conclude and carry out the business relationship, it is imperative to process certain data about you.

General data from the business relationship

We process the data you provide to us in the course of our business relationship. This includes in particular: contact data of the business partner's contact person(s), in particular salutation, name, business address, phone number and email address; bank and billing data, master data changes made by you, e.g. address changes.

Data from other sources

We process personal data from publicly accessible sources (e.g. commercial register, authorities, internet) only to the extent legally permitted.

Purpose and legal basis of the processing

Business relationship: We collect and process your personal data in the course of establishing and fulfilling our contractual obligations towards you (Art. 6(1)(b) GDPR).

Legitimate interest: In addition, we process your personal data to the extent necessary to safeguard our legitimate interests or those of a third party (Art. 6(1)(f) GDPR).

Legal requirements: Furthermore, we process your data to the extent necessary to assert legal claims and defend ourselves in legal disputes (Art. 6(1)(c) GDPR).

Disclosure of data

We use processors to provide special services. Your data is passed on to them in strict compliance with the obligation of confidentiality and the requirements of the GDPR. Responsibility for the data processing remains with us in these cases.

Storage period

We process and store your personal data only as long as we need it to fulfil contractual, legal or internal process obligations. If there is no longer a legitimate interest, we will delete the data. The statutory retention obligations of 6 and 10 years for accounting and tax reasons are included therein.

Data processing on behalf of clients

In the case of commissioned data processing, we receive your data from our client and fulfil the contractual obligations agreed in each case under the data processing agreement (Art. 28 processor). In this case, your data is always processed under the instruction and control of the client (controller).

Information for applicants

We use your data exclusively for the purpose of the application. During the application process, there are clear access rights: only the case handlers and the decision-makers about the hiring see your application documents. Your application will only be passed on with your prior consent. If you are not hired, we delete your data after 6 months.

The controller collects, processes and uses the personal data you provide exclusively for application purposes (decision on the establishment of an employment relationship). Your data is required for carrying out and deciding on the establishment of an employment relationship (Section 26(1) BDSG).

When the online application form is sent, the transmitted data – including attached documents (e.g. CV, references) – is transferred to our email service provider Resend for delivery of the application email to our internal application address and for sending an automated confirmation of receipt to your email address (see the section "Email delivery via Resend"). Resend stores the content exclusively for delivery-related logging and then deletes it in accordance with its own retention policies. The actual application processing then takes place in our internal email inbox. We do not transmit your application documents to any other external recipients.

Information for employees

The processing of personal data in the context of the employment relationship is largely subject to the fulfilment of contractual requirements from the employment contract and regulatory tasks imposed on the employer to fulfil a legal obligation.

Your rights

With regard to the processing of your personal data, you have extensive rights:

• Right of access: You have the right to information about the data stored about you.
• Right to rectification: You can request the correction of inaccurate data.
• Right to erasure: You can request the deletion of your data, provided there are no statutory retention obligations.
• Restriction of processing: You can request the restriction of the processing of your data.
• Right to object: You can object to the processing of your data.
• Data portability: You have the right to receive your data in a common format.
• Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority.