aiio
DEEN

Legal

Privacy Policy

1. Controller and Data Protection Officer

Controller within the meaning of the General Data Protection Regulation (GDPR):

aiio GmbH Klausenerstraße 10a, 39112 Magdeburg, Germany Phone: +49 391 251 948 79 · Email: info@aiio.de Managing Directors: Dr. Christian Graup, Knut Köchli, Jobst von Heintze, Lars Bendler

Data Protection Officer: Mandy Herrmann, LGD Datenschutz GmbH Rogätzer Straße 8, 39106 Magdeburg, Germany Email: datenschutz@lgd-data.de

2. General information

This policy explains the nature, scope and purpose of the processing of personal data on www.aiio.de. aiio.de is the corporate website of aiio GmbH; no product use and no contract processing takes place here — those run on the product services (ProcessCollector, ProcessMagnet, ProcessForge), each with its own privacy policy.

Legal bases. We process personal data under Article 6(1) GDPR, depending on the context:

  • point (a) — your consent (for example analytics and marketing services);
  • point (b) — initiation or performance of a contract (for example handling your enquiry);
  • point (c) — legal obligation (for example documenting consent);
  • point (f) — legitimate interests (for example secure operation of the website and prevention of abuse).

For storing information on, or accessing information already stored in, your device, Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) applies in addition: access that is not strictly necessary occurs only with your consent via the consent banner (Section 25(1) TDDDG); strictly necessary access is based on Section 25(2) TDDDG.

Retention. We process personal data only for as long as it is required for the respective purpose. It is then deleted, unless a statutory retention obligation applies — in particular the commercial and tax retention periods of six and ten years that cover business correspondence and records. Consent records are retained for as long as we must be able to demonstrate them.

3. Your rights

You have the right at any time to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR).

You may withdraw any consent you have given at any time with effect for the future. For cookies and tracking you can do so directly via the „Privacy settings" link in the footer of every page, which reopens the consent banner.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection of Saxony-Anhalt (Landesbeauftragter für den Datenschutz Sachsen-Anhalt).

4. Hosting and technical operation

Vercel (hosting). This website is operated by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you access the site, Vercel as our processor collects technically necessary server log data (including IP address, date and time, resource requested, referrer, user agent) in order to deliver the site and to ensure security and stability. Legal basis: Art. 6(1)(f) GDPR. A data processing agreement is in place.

Neon (database). The contents of this website, as well as enquiries submitted through the contact form, are stored in a PostgreSQL database operated by Neon Inc. This database runs in the us-east-1 (USA) region. The data you enter in the form is therefore stored in the United States. Processor; legal basis Art. 6(1)(b) and (f) GDPR. On transfers to third countries, see section 8.

Vercel Blob (file storage). We use Vercel Blob (Vercel Inc.) to store media and documents. Processor; legal basis Art. 6(1)(f) GDPR.

5. Cookies and access to your device

5.1 Without consent — strictly necessary

The following are required to operate the website and take place without consent under Section 25(2) TDDDG:

  • Language setting (aiio-locale) — remembers the language you selected. Retention: one year.
  • Usercentrics consent record — remembers your decision on the consent banner so that it is not requested again on every visit. Retention: one year.
  • Cloudflare Turnstile — prevents automated submissions through the contact form. Only for the duration of the check.
  • Editorial session cookie — sign-in for staff. Does not affect website visitors and ends with the session.

5.2 Consent management

Usercentrics. To obtain and manage consent we use the consent management platform of Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany. Your decisions and technical data (including a truncated IP address, a consent identifier and a timestamp) are processed and logged so that consent can be demonstrated. Legal basis: Art. 6(1)(c) GDPR together with our legitimate interest in compliant consent management (Art. 6(1)(f) GDPR).

No contact with Google before you consent. We use Google Consent Mode v2; before you decide, all consent signals are set to „denied". Beyond that, the Google scripts on this website are not loaded at all until you have consented. As long as you have not, no connection to Google is established — not even a cookieless, aggregated ping. This goes further than consent mode alone would.

6. Contacting us and handling enquiries

www.aiio.de has one central contact form. If you use it, we process the details you provide (at minimum your name and email address, plus your message and any further voluntary information) in order to handle your enquiry and any follow-up. Legal basis: Art. 6(1)(b) GDPR for enquiries relating to a contract, otherwise Art. 6(1)(f) GDPR.

The following processors are involved in handling these enquiries:

  • Cloudflare Turnstile (Cloudflare, Inc.) — prevention of automated submissions. Legal basis Art. 6(1)(f) GDPR.
  • n8n — automation that forwards the form data to the systems below.
  • Zoho CRM (Zoho Corporation B.V.) — management and follow-up of your enquiry in our sales system.
  • Brevo (Brevo GmbH, Cologne, Germany) — delivery of the associated emails.

Your enquiry is also stored in the database named in section 4. If you have previously consented to marketing, the campaign identifiers described in section 7.2 are transmitted along with it.

7. Analytics and marketing — only with your consent

The following services are loaded only after you have consented (Art. 6(1)(a) GDPR; Section 25(1) TDDDG). They are embedded through Google Tag Manager (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland), which does not itself build profiles but manages the services listed below.

  • Google Analytics 4 — reach and usage analysis with a truncated IP address. Provider: Google Ireland Ltd. Sets the cookies _ga and _ga_<identifier> with a lifetime of two years.
  • Google Ads — conversion tracking. Measures the performance of our advertisements. Provider: Google Ireland Ltd. Sets _gcl_* cookies with a lifetime of up to 90 days.
  • Google Ads — enhanced conversions. In addition, when a conversion occurs we transmit hashed contact details to Google so that an ad click and an enquiry can be matched. What is transmitted is not plain text but a hash value that cannot be reversed.
  • LinkedIn Insight Tag — campaign measurement and audience building. Provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Dublin 2, Ireland.

7.1 Identifying companies from the IP address

Two services match your IP address to a company, so that we can see which organisations visit our website. Individual people are not identified. The IP address itself is nevertheless personal data and is transmitted to the respective provider.

Leadfeeder / Dealfront (Dealfront Group GmbH, Karlsruhe, Germany, and Liidio Oy, Helsinki, Finland) — processing within the EU. Sets the cookie _lfa with a lifetime of two years.

Lead Forensics (Lead Forensics Ltd., Portsmouth, United Kingdom) — the data transmitted comprises your IP address, the address requested, the page title, the previously visited page and your screen resolution. In return we receive details of the company identified, such as company name, address, telephone number, industry and size. Lead Forensics uses Demandbase, Inc. (USA) as a sub-processor.

Both services are currently in use in parallel during a transitional period.

7.2 Campaign identifiers

If you have consented to marketing, we store identifiers from advertisement clicks and campaign parameters in your browser's session storage for the duration of your visit. The purpose is to attribute a later enquiry to the campaign through which you found us; the values are then transmitted together with your enquiry to the systems named in section 6. Without marketing consent nothing is stored.

8. Transfers to third countries

Some of the services named above process data outside the European Union or allow access from outside it:

  • United States — Vercel (hosting and file storage), the database named in section 4, Google and LinkedIn as groups with US parent companies, Cloudflare, and Demandbase as a sub-processor of Lead Forensics. Where a provider is certified under the EU-U.S. Data Privacy Framework, transfers are made on that basis (Art. 45 GDPR). Otherwise we rely on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR) together with supplementary measures.
  • United Kingdom — Lead Forensics. An adequacy decision of the European Commission is in place for the United Kingdom (Art. 45 GDPR).

A residual risk of access by authorities in those countries cannot be entirely excluded.

9. Translation

We use the translation software DeepL (DeepL SE, Cologne, Germany) to produce content in other languages. Only editorial text is processed; no visitor data is involved. Legal basis Art. 6(1)(f) GDPR.

10. Changes to this privacy policy

We update this privacy policy whenever changes to our processing activities make it necessary. The version published on this page at the time applies.

Last updated: 31 July 2026

Note on language. This is a translation provided for convenience. In the event of any discrepancy, the German version of this privacy policy prevails.