Privacy Policy
Revision date: 12 September 2026
Introduction
I take the protection of your personal data very seriously and treat your personal data confidentially and in accordance with legal data protection regulations and this privacy policy. This privacy policy informs you pursuant to Art. 13 and 14 GDPR about the processing of your personal data.
External video recording
The knowledge hub and renovation page let you load public YouTube videos. Preview images are served by our website. No YouTube player is embedded before you activate playback or a chapter. Once activated, your browser loads the player from www.youtube-nocookie.com and sends its IP address, browser information and referring page to YouTube/Google. Privacy-enhanced mode does not promise anonymous playback. The close button removes the player from the page; it cannot recall information already sent. The text alternative on the renovation page and linked companion articles in the knowledge hub are available without loading the player. The provider’s privacy policy describes its further processing. Google privacy policy
Data Controller (Art. 4 No. 7 GDPR)
Data We Collect (Art. 13(1)(d) GDPR)
- •Contact form data: Name, email address, message, timestamp
- •Assessment data: Email, first name, company, and responses to 7 questions about the operational bottleneck
- •Homepage diagnostic: selected outcome path and six questions; contact data is collected only when the visitor voluntarily requests the private result link
- •Analytics data: Page views, clicks, scroll depth, time on page (anonymized)
- •Technical data: IP address (anonymized), browser type, operating system, device information
- •Cookies: Essential (session, deleted after browser close), Analytics (with consent, 14 months retention per Google Analytics standard)
How We Use Your Data (Art. 13(1)(c) GDPR)
- •Responding to inquiries and communication
- •Rule-based calculation and delivery of a diagnosis from four bottleneck classes: context, process, action, and decision
- •Displaying the complete directional diagnostic on the website and optionally delivering a private, expiring result link
- •Improving website performance and user experience
- •Analyzing user behavior for service optimization
- •Marketing communication only after separate consent and confirmed double opt-in; withdrawal is available through the supplied link or kontakt@aprixity.run
- •Internal notification and prioritization of new inquiries using a rule-based lead-fit score
Legal Basis (Art. 6 GDPR)
- •Consent (Art. 6(1)(a) GDPR) - for analytics and marketing, requested separately and voluntarily, with marketing activated only after double opt-in
- •Contract performance or steps requested before entering a contract (Art. 6(1)(b) GDPR) - for the requested assessment and delivery of its result
- •Legitimate interest (Art. 6(1)(f) GDPR) - for website operation, security, and internal processing and prioritization of inquiries; you may object to this prioritization
Separate communication purposes
Result delivery, finite result guidance, and the Aprixity Briefing are technically and legally separate purposes.
- •One-time result delivery sends only the requested private result link. It grants no permission for further messages.
- •Finite result guidance requires its own separate consent and confirmed double opt-in. It ends after the announced closed sequence and creates no briefing subscription.
- •The recurring Aprixity Briefing requires separate consent and confirmed double opt-in independent of finite guidance. Its topics are operating architecture, bottlenecks, AI-First practice, and dependable AI.
- •Withdrawal is available through the link in each authorized message or via kontakt@aprixity.run. Withdrawing one purpose does not change authority for the other purpose.
- •Unconfirmed contact data is erased when the confirmation window expires. After withdrawal, complaint, or suppression, the delivery address and send capability are erased; minimal consent and suppression evidence remains for compliance.
Third-Party Services and Data Processors
I use the following services that process personal data on my behalf:
Google Analytics 4
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Purpose: Website analytics and usage statistics
Data: Anonymized usage data, page views, events
Legal basis: Consent (Art. 6(1)(a) GDPR)
Data transfer: USA (EU-US Data Privacy Framework)
Privacy:Link
Opt-out: Cookie consent banner or browser plugin
Hotjar
Provider: Hotjar Ltd., Level 2, St Julian's Business Centre, Elia Zammit Street, St Julian's STJ 3155, Malta
Purpose: User behavior analysis (heatmaps, session recordings)
Data: Anonymized interaction data, mouse movements, clicks
Legal basis: Consent (Art. 6(1)(a) GDPR)
Data transfer: EU (Malta)
Privacy:Link
Opt-out: Cookie consent banner
n8n Workflow Automation
Provider: Self-hosted on own infrastructure (Hetzner Cloud, Germany)
Purpose: Automated processing of assessment requests, email sending, lead scoring
Data: Assessment data (email, name, company, responses)
Legal basis: Contract performance (Art. 6(1)(b) GDPR)
Data transfer: Germany (EU)
Privacy:Own infrastructure, no data sharing with n8n GmbH
Neo4j Database
Provider: Self-hosted on own infrastructure (Hetzner Cloud, Germany)
Purpose: Storage and management of lead data in graph database
Data: Contact data, assessment results, interaction history
Legal basis: Contract performance (Art. 6(1)(b) GDPR)
Data transfer: Germany (EU)
Google Sheets
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Purpose: Backup and overview of lead data for internal management to ensure data security and redundancy
Data: Email, name, company, assessment segment, timestamp
Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) - interest in data availability, redundancy, and proper documentation
Data transfer: USA (EU-US Data Privacy Framework per EU Commission adequacy decision of 10.07.2023, additionally secured by Standard Contractual Clauses per Art. 46(2)(c) GDPR)
Privacy:Link
Gmail / Google Workspace
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
Purpose: Sending assessment results and communication
Data: Email address, name, message content
Legal basis: Contract performance (Art. 6(1)(b) GDPR)
Data transfer: USA (EU-US Data Privacy Framework, Standard Contractual Clauses)
Privacy:Link
Anthropic Claude (possible downstream AI processing)
Provider: Anthropic PBC, 548 Market St, San Francisco, CA 94104, USA
Purpose: Possible downstream analysis for individual consulting; the displayed V6.1 diagnosis itself is calculated by rules without Claude
Data: If activated: assessment responses and only contact data necessary for the expressly described consulting purpose
Legal basis: Downstream AI processing requires its own documented legal basis before activation; the mandatory assessment checkbox does not provide blanket consent
Data transfer: Any transfer to the USA will be activated only after the applicable transfer safeguards have been documented
Privacy:Link
Note: Neither the website nor this notice asserts that a production Anthropic call occurs or what retention and training configuration currently applies.
Perplexity AI
Provider: Perplexity AI Inc., San Francisco, CA, USA
Purpose: AI-powered research to enrich company information (corporate data only) for personalized consulting
Data: Publicly available company information based on company name (no personal contact data)
Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) - interest in efficient sales preparation
Data transfer: USA (Standard Contractual Clauses)
Privacy:Link
Note: Research is limited to publicly available corporate data (industry, size, location). Personal data of contact persons is not collected.
Cal.com
Provider: Cal.com Inc., San Francisco, CA, USA
Purpose: Appointment booking for consultation calls
Data: Name, email address, selected appointment, optional notes
Legal basis: Contract performance (Art. 6(1)(b) GDPR)
Data transfer: USA (Standard Contractual Clauses)
Privacy:Link
Aprixity Conversation Edge
Provider: Self-hosted on Hetzner infrastructure in Germany
Purpose: Secure result and briefing intake, encrypted storage, private result link, separate consent evidence, double opt-in, and explicitly requested internal inquiry notification
Data: Name, email address, optional company, diagnostic answers, consent state, and technical security and delivery evidence; result tokens are stored only as hashes
Legal basis: Steps requested before entering a contract for result delivery; separate consent for finite result guidance and the Aprixity Briefing
Data transfer: Germany (EU); email delivery uses Resend as separately disclosed
Resend
Provider: Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA
Purpose: Transactional delivery of the private result link, explicitly requested internal inquiry notification, confirmed finite result guidance, and the confirmed Aprixity Briefing
Data: Email address, name, subject, message content, and delivery, bounce, and complaint status
Legal basis: Steps requested before entering a contract for result delivery; separate consent for confirmed result guidance and briefing communication
Data transfer: USA; DPA and Standard Contractual Clauses must be documented for the production account
Privacy:Link
Note: Result delivery, explicit human review, finite result guidance, and the Aprixity Briefing are technically separate purposes.
Cloudflare Turnstile
Provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA
Purpose: Abuse and bot protection for the public result and briefing forms
Data: IP address, browser and device signals, hostname, user agent, and challenge outcome; validation occurs server-side
Legal basis: Legitimate interest in secure form operation and abuse prevention (Art. 6(1)(f) GDPR)
Data transfer: USA; applicable transfer and contract records must be documented
Privacy:Link
Note: Turnstile is loaded solely as a security service, not as marketing analytics.
Hetzner Cloud (Hosting)
Provider: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany
Purpose: Hosting of website, databases, and automation workflows
Data: All data collected on the website is stored on Hetzner servers in Germany
Legal basis: Contract performance (Art. 6(1)(b) GDPR)
Data transfer: Germany (EU) - no third country transfer
Privacy:Link
Data Processing Agreements (Art. 28 GDPR)
Where a service provider processes personal data on my behalf, an appropriate contract and transfer record must be reviewed and archived before production use. The following list describes the required contract basis; it does not claim that every record has already been archived.
- •Google Ireland Limited: applicable DPA and transfer record required for each activated service
- •Hotjar Ltd.: DPA record required before activation
- •Anthropic PBC: accepted Commercial Terms/DPA version, SCC/TIA decision, and account configuration required before use
- •Perplexity AI Inc.: DPA and transfer record required before use
- •Cal.com Inc.: DPA and transfer record required before use
- •Plus Five Five, Inc. (Resend): DPA, SCCs, and production account configuration must be documented
- •Cloudflare, Inc.: applicable Turnstile contract and transfer record must be documented
- •Aprixity Conversation Edge: self-hosted processing; technical and organisational measures and the Hetzner processor agreement must be documented
- •Hetzner Online GmbH: processor agreement required for the hosting services actually used
You may ask kontakt@aprixity.run for information about recipients actually used and available records.
Data Transfer to Third Countries (Art. 44-49 GDPR)
When using certain services, your data is transferred to countries outside the EU/EEA:
- •USA: Google, Anthropic, Perplexity, Cal.com, Plus Five Five, Inc. (Resend), and Cloudflare - transfer basis per service actually activated: EU-US Data Privacy Framework and/or Standard Contractual Clauses (Art. 46(2)(c) GDPR)
The specific transfer basis and account configuration are documented for each recipient that is actually activated. This notice does not assert an unverified contract or SCC version.
Automated Decision-Making and Profiling (Art. 22 GDPR)
The homepage directional diagnostic and the existing V6.1 assessment are calculated by rules; no generative AI model is required for the displayed results. Apri is separately labelled as an AI assistant.
Purpose: The homepage diagnostic maps six questions to an intervention class. The existing assessment maps seven answers to bottleneck classes and may create an internal processing priority.
The diagnosis and priority have no legal or similarly significant effect. They do affect internal processing order and whether an appointment option is shown at a score of 4 or more.
Logik: Homepage rules assess frequency, outcome variance, decision type, data readiness, exception load, and human value. The result recommends removal, simplification, standardisation, instrumentation, automation, augmentation, deliberate preservation of human judgment, or capacity reallocation.
Erklärbarkeit: On request, I will explain the rules and data used for your diagnosis and internal prioritization.
Menschliche Überprüfung: Questions about the evaluation or requests for human review may be sent to kontakt@aprixity.run.
Widerspruchsrecht: You may object to internal sales prioritization based on legitimate interests. Contact: kontakt@aprixity.run.
Audit-Trail: Conversation Edge stores contact and answers encrypted, separates result and purpose, and records delivery and consent evidence. Private result tokens are stored only as hashes. Legacy assessment paths remain technically separate.
Kontakt: For questions about automated processing: kontakt@aprixity.run
Data Protection Impact Assessment and risk review (Art. 35 GDPR)
The need for a Data Protection Impact Assessment is reviewed again after material changes to the assessment process. No outdated assessment result is presented as current evidence for V6.1.
Umfang: Current review scope: rule-based bottleneck diagnosis, internal lead prioritization, and possible downstream recipients or AI processing.
Betroffene Personen: Categories of data subjects: Managing directors and decision-makers of SMEs in Germany who voluntarily participate in the assessment.
Empfänger: Recipients are listed above according to the processing that is actually activated.
No public DPIA conclusion is asserted without current process-specific documentation.
Current protection priorities:
- ✓No legal effect on data subjects - result is non-binding guidance
- ✓The rule-based logic and its practical consequence are disclosed
- ✓Marketing consent and privacy acknowledgement remain separate
- ✓Data minimization: only data required for each purpose is transferred
- ✓No sensitive categories of personal data (Art. 9 GDPR) are processed
- ✓Data-subject rights, objection, and a human contact channel remain available
Schutzmaßnahmen: Technical and organizational measures, recipient approvals, and contract records must be supported by current internal evidence; this notice does not replace that evidence.
Review status: V6.1 reassessment required after a material process change
Review again before activating additional AI recipients or materially changing the scoring logic
Privacy enquiries: kontakt@aprixity.run
Data Retention (Art. 13(2)(a) GDPR)
- •Assessment data: 3 years after last contact (reference date: Dec 31 of following year) or until deletion request
- •Homepage diagnostic: private result link, encrypted answers, and contact are removed at the configured expiry or earlier after withdrawal or a deletion request; the link can be revoked
- •Finite result guidance: unconfirmed contact data is erased when the confirmation window expires; confirmed authority ends on completion, withdrawal, or configured expiry
- •Aprixity Briefing: unconfirmed contact data is erased when the confirmation window expires; confirmed authority remains until withdrawal or suppression, with no claimed calendar deletion deadline
- •After withdrawal, complaint, or suppression, the delivery address and send capability are erased; minimal consent and suppression evidence remains to meet legal evidence duties
- •Contact form data: 3 years after processing the inquiry (reference date: Dec 31 of following year)
- •Analytics data: 14 months (Google Analytics standard, automatic deletion)
- •Booking data: According to legal retention requirements (up to 10 years for tax-relevant data per German fiscal code)
Retention period is determined by necessity for processing purpose and legal retention requirements. Deletion occurs at year-end after retention period expires.
Your Rights (GDPR Chapter III)
- •Right to access (Art. 15) - Receive a copy of your stored data
- •Right to rectification (Art. 16) - Correction of inaccurate data
- •Right to erasure (Art. 17) - 'Right to be forgotten'
- •Right to restriction of processing (Art. 18)
- •Right to data portability (Art. 20) - Receive your data in machine-readable format
- •Right to object (Art. 21) - Object to processing based on legitimate interests
- •Right to withdraw consent (Art. 7(3)) - At any time without giving reasons
- •Right to lodge complaint with supervisory authority (Art. 77) - Competent: State Commissioner for Data Protection Lower Saxony
Competent Supervisory Authority
State Commissioner for Data Protection Lower Saxony
Prinzenstrasse 5, 30159 Hannover, Germany
Phone: +49 511 120-4500
Email: poststelle@lfd.niedersachsen.de
https://lfd.niedersachsen.deContact for Data Protection Inquiries
Email: kontakt@aprixity.run
Subject: 'Data Protection Inquiry'
Response time: Maximum 30 days per GDPR Art. 12(3)
To process your request, I may require proof of identity.
Changes to this Privacy Policy
I reserve the right to adapt this privacy policy to comply with changed legal requirements or changes to the service and data processing. The current version can always be found on this page.