Privacy Policy for the Lumiform Website and the Lumiform App

Last Updated: August 6, 2026

This Privacy Policy applies to the processing of data by Lumiform GmbH (“Controller,” “we,” or “us”) as the data controller under data protection law when using the Lumiform app (“App”) and when visiting our website “https://lumiformapp.com” (“Website”).

Lumiform offers companies a platform for inspections, audits, and checklists to improve quality, safety, and efficiency (“Service”).

When you use our website or App, or utilize our Services, we process your personal data. Personal data refers to any information relating to an identified or identifiable natural person. When we process personal data, this means that we collect, store, transmit, delete, or otherwise use this data. When processing your personal data, we comply with applicable data protection laws, in particular the General Data Protection Regulation (“GDPR”) and the Federal Data Protection Act (“BDSG”).

The following privacy notice informs you about the nature, scope, and purposes of the collection, use, and other processing of personal data when you use our website and app, as well as when you use our services.

If the data processing activities we carry out change, we will update our privacy notice. We therefore ask that you review the content of our privacy notice regularly. If a change requires action on your part—such as providing consent—or requires other individual notification, we will inform you.

1. Data Controller

Lumiform GmbH is responsible for the processing of your data;
Address: Chausseestraße 57, 10115 Berlin
Email: contact@lumiformapp.com

2. Data Protection Officer

For any questions regarding data protection or the exercise of your rights as outlined in the “Your Rights” section in connection with the use of our website or our app, you may contact our Data Protection Officer at any time:

Name: Sebastian Schenk, acting on behalf of simply Legal GmbH
Address: Burkarderstraße 36, 97082 Würzburg
Phone: +49 931 90 87 95 20
Email address: info@dieter-datenschutz.de

3. Collection and Storage of Personal Data, as well as the Nature and Purpose of Its Processing and the Applicable Legal Basis

Below, we provide information about which personal data we process when you use our website or app and/or avail yourself of our services. We also explain the purpose for which we process your data and the legal basis on which we do so. To the extent that the processing of personal data is based on Article 6(1)(f) of the GDPR, the purposes stated also constitute our legitimate interests.

3.1 Visiting the Website

When you visit our website for informational purposes, we collect, store, and process so-called “log data.” We temporarily store this data as server log files on our web server to ensure that our website is displayed properly and to guarantee its stability and security.

This includes, for example:

Operating system and information about the internet browser used, including installed add-ons;
IP address (Internet Protocol address) of the device used to access the online service;
The Internet address of the website from which the online service was accessed (known as the referrer URL);
Name of the service provider through which access to the online service is made;
Name of the files or information accessed;
Date, time, and duration of the access.

Processing is based on our legitimate interest in the secure and stable provision of our website in accordance with Article 6(1)(f) of the GDPR.

3.2 Creating an Account and Subscribing

If your company wishes to use our service or a free trial account, Lumiform will set up the corresponding account. The designated users will then receive an invitation to use the app. In doing so, we process the following data in particular:

Your first and last name;
Your business email address;
Your phone number, if necessary;
the company you work for;
Information about your user account and the permissions assigned to you.

If your company purchases a paid subscription, we may also collect the following:

Your address;
your payment method and payment details.

We process the aforementioned data to conclude and fulfill the contract for the services offered, to set up and manage user accounts and trial accounts, and to enable the use of the app. The legal basis for data processing is Article 6(1)(b) of the GDPR, provided that you yourself are a party to the contract. If the contract is concluded with your company, processing is based on our legitimate interest in performing the contract and managing user accounts in accordance with Article 6(1)(f) of the GDPR.

3.3 Contact Form

On our website, you can book a demo, request a quote, contact us, or download specific content. Depending on the form you use, we process the following data in particular:

Your first and last name;
Your company;
Your business email address;
Your phone number;
Your title;
the size, industry, and website of your company;
Your country;
the desired number of users;
the planned implementation period;
Information on how you learned about Lumiform;
the content of your message.

The data will be used to answer your questions, process your demo or quote request, provide the requested content, and handle related communication. The data will not be shared with third parties unless expressly stated in this Privacy Policy.

We process the aforementioned data to respond to the questions or inquiries submitted via the respective forms. If your inquiry is aimed at entering into a contract, the processing is carried out for the purpose of taking pre-contractual measures in accordance with Article 6(1)(b) of the GDPR. In all other cases, the legal basis for data processing is our legitimate interest pursuant to Article 6(1)(f) of the GDPR.

3.4 AI-powered features

Lumiform provides AI-powered features within the app, in particular for creating and improving forms and texts, for translation, for analyzing content, and for checking images. The use of these features is initiated by the user in each case.

The AI-powered features are generally not intended for the processing of personal data. Users should therefore not submit any personal data in prompts, documents, images, or other inputs, unless this is necessary for the use of the respective feature.

If, in individual cases, inputs nevertheless contain personal data, such data will be processed exclusively to execute the AI-powered feature selected by the user and to provide the corresponding result. Depending on the feature used, the inputs may be transmitted to AI model providers engaged by Lumiform for this purpose. Further information about these recipients and any transfers to third countries can be found in the following sections of this Privacy Policy.

The AI systems used do not store inputs and outputs beyond the active processing operation. However, results generated by the AI may be stored within the subscriber’s workspace. Customer data is not used for training or fine-tuning shared AI models.

The results generated by the AI serve exclusively as supportive suggestions and must be reviewed by the user. The AI does not trigger any independent follow-up actions. No decision based solely on automated processing that produces legal effects concerning a data subject or similarly significantly affects them takes place.

To the extent that Lumiform is the data controller for the processing itself, it is carried out to provide the functionality requested by the user in accordance with Article 6(1)(b) of the GDPR or based on our legitimate interest in providing and improving our services in accordance with Article 6(1)(f) of the GDPR. To the extent that Lumiform processes personal data on behalf of a subscriber, the processing is carried out in accordance with the subscriber’s instructions; in this case, the subscriber is responsible for determining the legal basis.

3.5 Website Optimization, Analysis, and Marketing

3.6 Functional Cookies

Our website uses cookies. Cookies are text files that are stored in or by your web browser on your computer. A cookie contains a string of characters that enables your system to be uniquely identified when you revisit the website.

Most of the cookies we use (“session cookies”) and the data stored and transmitted by them are automatically deleted at the end of your visit. Other cookies (“persistent cookies”) remain stored on your device until you delete them.

You can configure your browser to notify you when cookies are set and to allow cookies only on a case-by-case basis, to block the acceptance of cookies in specific cases or generally, and to enable the automatic deletion of cookies when you close your browser. You can delete cookies that have already been stored at any time. Disabling cookies may limit the functionality of the website.

Some elements of our website require that the browser used to access the site can be identified even after changing pages. To this end, cookies may be stored that allow us to recognize your browser on your next visit.

To the extent that cookies or similar technologies are strictly necessary to provide you with our website or a feature you have expressly requested, the storage of information on your device or access to such information is based on Section 25(2)(2) of the German Telemedia Act (TDDDG). Any associated processing of personal data is based on our legitimate interest in the secure and functional provision of our website in accordance with Article 6(1)(f) of the GDPR.

3.7 Analytics and Marketing Cookies

When you visit our website, cookies are also set that enable us to analyze your use of the website for audience measurement and advertising purposes (“analytics cookies”).

We use analytics cookies exclusively based on your consent in accordance with Section 25(1) of the TDDDG and Article 6(1)(a) of the GDPR via our cookie banner. Through our cookie banner, you can access further information about the cookies we use and revoke your consent at any time with future effect.

(a) Google Analytics

To analyze your use of our website, we use “Google Analytics,” a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), based on a data processing agreement pursuant to Article 28 of the GDPR.

Google Analytics uses cookies. In particular, information about sessions, pages visited, interactions, the browser and device used, and the approximate location may be processed. Google uses an identifier stored in a cookie to distinguish between users and sessions.

The storage of Google Analytics cookies and the use of this analytics tool are based on your explicit consent in accordance with Section 25(1) of the German Telemedia Act (TDDDG) and Article 6(1)(a) of the GDPR. You may revoke your consent at any time via the settings in our cookie banner, effective for the future.

On our behalf, Google will use this information to evaluate your use of the website, compile reports on website activity, and provide us with other services related to website usage. Information on possible transfers to third countries can be found in the section “Is your data transferred to third countries or to international organizations?”

For more information about Google Analytics’ processing of user data, please visit: https://support.google.com/analytics/answer/6004245?hl=de.

(b) Plausible Analytics

In addition, we use “Plausible Analytics,” a web analytics service provided by Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia (“Plausible”), to statistically analyze the use of our website. In particular, page views, referral sources, duration of visit, and information about the browser, device, and approximate location used are analyzed in aggregated form.

According to the provider, Plausible does not use cookies or persistent user identifiers and does not create cross-website user profiles. Processing is based on our legitimate interest in data-minimal reach measurement and the improvement of our website in accordance with Article 6(1)(f) of the GDPR.

For more information on data protection at Plausible, please visit: https://plausible.io/privacy.

(c) HubSpot

For more information on the processing of personal data by HubSpot, please see the “Data Recipients” section under “HubSpot.”

4. Data Recipients

In addition to the service providers listed in this Privacy Policy, we also use services from external providers to process your personal data. In some cases, these third parties act as independent data controllers under data protection law; in others, they act as data processors on our behalf and in accordance with our instructions pursuant to Article 28 of the GDPR. To the extent that Lumiform processes personal data on behalf of a subscriber, the service providers listed below are also used only in accordance with the subscriber’s instructions.

Where this Privacy Policy refers to a data processing agreement, it refers to a contract for data processing pursuant to Article 28 of the GDPR.

4.1 Amazon Web Services

We process the data we store on servers operated by Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg (“AWS”). We store both data that you enter yourself on our website or within the app, as well as data that we collect automatically when you use our website or app. We have entered into a data processing agreement with AWS in accordance with Article 28 of the GDPR.

The server locations designated for hosting are in Germany. To the extent that data is transferred to a third country in connection with the provision or support of the services, the provisions set forth in the section “Is Your Data Transferred to Third Countries or International Organizations?” apply.

For more information on data protection at AWS, please visit https://aws.amazon.com/de/privacy/.

4.2 STACKIT

In addition, we use the services of STACKIT GmbH & Co. KG, Stiftsbergstraße 1, 74172 Neckarsulm (“STACKIT”) for the hosting and provision of our platform. In this context, the data processed within the app—including account, content, usage, and technical data—may be processed on servers in Germany. We have entered into a data processing agreement with STACKIT in accordance with Article 28 of the GDPR.

For more information on data protection at STACKIT, please visit https://www.stackit.de/de/datenschutz/.

4.3 ChartMogul

To analyze subscriptions and contract trends, we use ChartMogul, a service provided by ChartMogul GmbH & Co. KG, c/o WeWork, Kemperplatz 1, 10785 Berlin. In particular, this involves the processing of customer identifiers, contract and subscription data, agreed-upon fees, as well as the start, modification, and termination of a subscription. We have entered into a data processing agreement with ChartMogul in accordance with Article 28 of the GDPR.

Processing is based on our legitimate interest in analyzing and managing our subscriptions and business development in accordance with Article 6(1)(f) of the GDPR.

For more information on data protection at ChartMogul, please visit: https://chartmogul.com/privacy/.

4.4 HubSpot

We use the HubSpot service provided by HubSpot Ireland Limited, HubSpot House, One Sir John Rogerson’s Quay, Dublin 2, Ireland, to manage our relationships with customers and prospects, as well as for sales, support, and communication purposes.

In HubSpot, we process, in particular, your contact and company information, details regarding inquiries, quotes, and contracts, as well as the content and history of our communications with you. The data may also be used to assign inquiries, manage customer relationships, and document sales and support processes.

Processing is carried out to implement pre-contractual measures or a contract in accordance with Article 6(1)(b) of the GDPR, provided that you yourself are a party to the contract. Otherwise, processing is based on our legitimate interest in efficient customer, prospect, and communication management in accordance with Article 6(1)(f) of the GDPR.

To the extent that HubSpot is used on our website for analytics or marketing purposes, processing is based solely on your consent in accordance with Section 25(1) of the German Telemedia Act (TDDDG) and Article 6(1)(a) of the GDPR.

We have entered into a data processing agreement with HubSpot in accordance with Article 28 of the GDPR. Information on possible transfers to third countries can be found in the section “Is your data transferred to third countries or to international organizations?”

For more information on HubSpot’s privacy policy, please visit: https://legal.hubspot.com/de/privacy-policy.

4.5 Chargebee

We use Chargebee, a service provided by Chargebee Inc., to manage subscriptions, contract terms, and billing information. In particular, your contact and company data, customer and subscription IDs, contract, billing, and payment status data, as well as information regarding the start, modification, and termination of the subscription may be processed.

This processing is carried out for the purpose of managing and fulfilling the subscription. To the extent that you yourself are a party to the contract, it is based on Article 6(1)(b) of the GDPR. In all other cases, it is based on our legitimate interest in proper subscription and billing management pursuant to Article 6(1)(f) of the GDPR. To the extent that processing is necessary to fulfill commercial or tax law obligations, it is based on Article 6(1)(c) of the GDPR.

We have entered into a data processing agreement with Chargebee in accordance with Article 28 of the GDPR. Information on potential transfers to third countries can be found in the section on transfers to third countries.

For more information on data protection at Chargebee, please visit: https://www.chargebee.com/privacy/.

4.6 Twilio/SendGrid

To send transactional emails and other service-related messages, we use SendGrid, a service provided by Twilio Ireland Limited, 70 Sir John Rogerson’s Quay, Dublin 2, D02 R296, Ireland (“Twilio”). In particular, the recipient’s email address, the content of the message, and technical delivery, open, error, and log data are processed.

Processing is carried out, to the extent necessary for the provision of the service or for contractual communication, on the basis of Article 6(1)(b) of the GDPR or on the basis of our legitimate interest in reliable and traceable communication pursuant to Article 6(1)(f) of the GDPR.

We have entered into a data processing agreement with Twilio in accordance with Article 28 of the GDPR. Information on potential transfers to third countries can be found in the section on transfers to third countries.

For more information on data protection at SendGrid and Twilio, please visit: https://www.twilio.com/legal/privacy.

4.7 Usercentrics

We use the Usercentrics Consent Management Platform as a consent management tool on our website. The Usercentrics Consent Management Platform is a technology provided by Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich (“Usercentrics”).

Usercentrics enables us to inform you about the services on our website that require consent, to obtain and manage your selections, and to document whether you have granted or denied consent. In particular, your consent decision, the date and time of the decision, a consent identifier, and information about your device and browser are processed.

We have entered into a data processing agreement with Usercentrics in accordance with Article 28 of the GDPR. The use of Usercentrics and the storage of your consent decision are technically necessary. The processing is carried out to fulfill our legal obligations to provide evidence and information pursuant to Article 6(1)(c) of the GDPR in conjunction with Article 7(1) of the GDPR and Section 25(2)(2) of the TDDDG.

For more information on data protection at Usercentrics, please visit: https://usercentrics.com/de/datenschutzerklaerung/.

4.8 Vonage

To the extent provided for in the agreed scope of services—particularly for Enterprise subscriptions—we send service-related SMS notifications via Vonage. In particular, the recipient’s phone number, the content of the message, and technical delivery and log data are processed.

We have entered into a data processing agreement with Vonage in accordance with Article 28 of the GDPR. The processing is carried out to provide the notification feature selected by the subscriber. To the extent that Lumiform itself is the data controller, the processing is based on Article 6(1)(b) of the GDPR or on our legitimate interest in the reliable transmission of service-related notifications pursuant to Article 6(1)(f) of the GDPR. Information on possible transfers to third countries can be found in the section on transfers to third countries.

For more information on data protection at Vonage, please visit: https://www.vonage.com/legal/privacy-policy/.

4.9 Cloudflare

To protect our website and app from attacks and to ensure the secure and reliable provision of our online services, we use services provided by Cloudflare, Inc., 101 Townsend Street, San Francisco, California 94107, USA (“Cloudflare”). In particular, your IP address, information about your device and browser, visited web addresses, timestamps, and other technical connection and security data may be processed.

This processing is carried out to ensure the security, stability, and performance of our online services. To the extent that Lumiform is the data controller for this processing, it is based on our legitimate interest pursuant to Article 6(1)(f) of the GDPR. We have entered into a data processing agreement with Cloudflare in accordance with Article 28 of the GDPR. Information regarding transfers to the United States can be found in the section on transfers to third countries.

For more information on data protection at Cloudflare, please visit https://www.cloudflare.com/de-de/privacypolicy/.

4.10 Prismatic

To set up and manage integrations between the Lumiform platform and third-party systems used by subscribers, we use Prismatic, a service provided by Prismatic Software Inc., 5013 S Louise Avenue #122, Sioux Falls, South Dakota 57108, USA (“Prismatic”).

Depending on the specific integration set up, this may involve the processing of, in particular, account and connection identifiers, configuration and metadata, as well as the content transmitted via the integration. Processing is carried out exclusively for the purpose of setting up and executing the integration selected by the subscriber. We have entered into a data processing agreement with Prismatic in accordance with Article 28 of the GDPR. Information regarding transfers to the United States can be found in the section on transfers to third countries.

For more information on data protection at Prismatic, please visit https://prismatic.io/legal/privacy/.

4.11 Fathom

To record, transcribe, and summarize selected conversations with our sales and customer success teams, we use Fathom, a service provided by Fathom Video Inc., 2261 Market Street #4156, San Francisco, California 94114, USA (“Fathom”). In particular, the following may be processed: the names and contact information of the conversation participants, video and audio recordings, conversation content, transcripts, and automatically generated summaries.

Fathom is used only if the participants in the conversations have been informed of this in advance and, where necessary, have given their consent. Processing is based on your consent in accordance with Article 6(1)(a) of the GDPR. You may revoke your consent at any time with future effect. Information on transfers to the United States can be found in the section on transfers to third countries.

For more information on data protection at Fathom, please visit https://fathom.video/privacy.

4.12 Userflow

For interactive product tours, instructions on using the app, and communication with users within the app, we use Userflow, a service provided by Userflow Inc., 548 Market Street, PMB 69598, San Francisco, California 94104-5401, USA (“Userflow”).

In particular, this may involve the processing of user and account IDs, company information, the status of the onboarding process, interactions with product prompts, and technical usage data. The purpose of this processing is to familiarize users with the app and its features and to support them in using it.

To the extent that processing is necessary to provide the agreed-upon service, it is carried out in accordance with Article 6(1)(b) of the GDPR. Otherwise, it is based on our legitimate interest in providing a clear introduction to our app and efficient user support in accordance with Article 6(1)(f) of the GDPR. Information regarding transfers to the United States can be found in the section on transfers to third countries.

For more information on data protection at Userflow, please visit https://www.userflow.com/policies/privacy.

4.13 PostHog

For the technical management and provision of features in accordance with the subscription selected by the subscriber, we use PostHog, a service provided by PostHog, Inc., 2261 Market Street #4008, San Francisco, California 94114, USA (“PostHog”).

In particular, this may involve the processing of customer, account, and user IDs; details regarding the subscription purchased; activated features; and technical information about the access to and use of individual features.

This processing is carried out to provide the agreed-upon scope of features in accordance with Article 6(1)(b) of the GDPR, provided that you are a party to the contract. In all other cases, it is based on our legitimate interest in the contractual and secure management of the features available within the app in accordance with Article 6(1)(f) of the GDPR. Information on potential transfers to third countries can be found in the section on transfers to third countries.

For more information on data protection at PostHog, please visit https://posthog.com/privacy.

4.14 AI Model Providers

To provide the features described in the “AI-powered features” section, we use pre-trained AI models from OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland (“OpenAI”), and Anthropic Ireland, Limited (“Anthropic”).

The AI-powered features are not intended for the processing of personal data. However, if inputs in individual cases do contain personal data, such data may be transmitted to OpenAI or Anthropic for the purpose of executing the feature triggered by the user. Depending on the feature, this may include, in particular, text, prompts, documents, spreadsheets, images, and the information contained therein.

Processing is carried out exclusively for the purpose of generating the result requested by the user. The providers do not store the inputs and outputs beyond the active processing operation. Customer data is not used for training or fine-tuning shared AI models.

Information on potential processing outside the European Economic Area can be found in the section on transfers to third countries. For more information, visit https://openai.com/privacy and https://www.anthropic.com/legal/privacy.

5. Website and App Security

We employ appropriate technical and organizational security measures to protect stored personal data against manipulation, partial or complete loss, and unauthorized access by third parties. Our security measures are continuously improved in line with technological developments.

When selecting and implementing security measures, we take into account, in particular, the state of the art, the implementation costs, the nature, scope, circumstances, and purposes of the processing, as well as the varying probabilities of occurrence and severity of the risks to the rights and freedoms of data subjects.

Depending on the nature of the processing, our security measures include, in particular, access and authorization policies, the logical separation of data belonging to different subscribers, encryption measures, logging, and procedures to ensure the availability and resilience of our systems.

The server locations designated for hosting the platform are generally located in Germany. To the extent that individual service providers process personal data outside the EEA or can access data from there, the safeguards described in the section “Is Your Data Transferred to Third Countries or to International Organizations?” apply.

We use various service providers to maintain a high level of system security on our platform and to prevent or remedy disruptions. It is in our legitimate interest to continuously monitor and maintain the security and performance of our platform. This is also in the interest of our customers. The legal basis for data processing for this purpose is Article 6(1)(f) of the GDPR.

(a) Sentry

We use the error analysis service Sentry provided by Functional Software, Inc. dba Sentry, 45 Fremont Street, 8th Floor, San Francisco, California 94105, USA (“Sentry”). To ensure the technical stability of our services, system errors are logged using Sentry. In doing so, your IP address, information about your device and browser, user and session identifiers, log and error data, as well as technical information related to the error may be transmitted to Sentry. Depending on the nature of the error, this information may, in individual cases, also include personal data.

Processing is carried out on the basis of a data processing agreement pursuant to Article 28 of the GDPR. To the extent that Lumiform itself is the data controller, processing is based on our legitimate interest in error detection, troubleshooting, and the secure provision of our services in accordance with Article 6(1)(f) of the GDPR. For more information on data protection at Sentry, please visit: https://sentry.io/privacy/.

(b) Datadog

We use the Datadog service provided by Datadog, Inc., 620 8th Avenue, 45th Floor, New York, NY 10018, USA (“Datadog”) to monitor the security, stability, and performance of our platform. In particular, this may involve the processing of server and log data, your IP address, user and session IDs, information about the browser and device used, timestamps, accessed web addresses, and information about errors and security-related events.

Use of the service is based on a data processing agreement pursuant to Article 28 of the GDPR. To the extent that Lumiform itself is the data controller, processing is based on our legitimate interest in the secure, stable, and high-performance provision of our services pursuant to Article 6(1)(f) of the GDPR. Information regarding transfers to the United States can be found in the section on transfers to third countries.

For more information on Datadog’s collection and use of data, please visit: https://www.datadoghq.com/legal/privacy/.

6. Is your data transferred to third countries or to international organizations?

When using our services, personal data may be transferred to recipients outside the European Economic Area (“EEA”) or processed from there. This may also be the case even if the respective contractual partner is based in the EEA but uses affiliated companies, subcontractors, or support staff in a third country.

This applies in particular to the use of Amazon Web Services, Google, Cloudflare, Datadog, Sentry, HubSpot, Chargebee, Twilio/SendGrid, Vonage, Prismatic, Fathom, Userflow, PostHog, and the AI providers OpenAI and Anthropic. Details regarding the respective processing purposes and data categories can be found in the preceding sections.

For transfers to recipients in countries for which the European Commission has determined an adequate level of data protection, we base the transfer on the respective adequacy decision pursuant to Article 45 of the GDPR.

For transfers to companies based in the United States that are validly certified under the EU-U.S. Data Privacy Framework, the European Commission’s adequacy decision regarding the EU-U.S. Data Privacy Framework applies. This currently applies in particular to Google LLC, Cloudflare, Inc., Datadog, Inc., HubSpot, Inc., Twilio Inc., Fathom Video Inc., and Userflow Inc., provided that the respective certification covers the specific processing activity.

To the extent that no adequacy decision applies or the specific processing is not covered by certification under the EU-U.S. Data Privacy Framework, the transfer is generally carried out on the basis of the Standard Contractual Clauses adopted by the European Commission pursuant to Article 46(2)(c) of the GDPR. Where necessary, these are supplemented by additional contractual, technical, and organizational measures.

For customers based in the EEA, the contractual partner for OpenAI’s services is generally OpenAI Ireland Limited. To the extent that OpenAI transfers personal data to affiliated companies or subcontractors outside the EEA, this is done in accordance with OpenAI’s contractual provisions based on an adequacy decision or the Standard Contractual Clauses. Standard Contractual Clauses are agreed upon for transfers in connection with the use of Anthropic.

You may request further information about the transfer mechanisms used, as well as a copy of the relevant safeguards, using the contact details provided above.

7. When do we delete your data?

We delete your data when it is no longer needed for the purposes for which it was originally collected, provided that no legal retention obligations, legitimate interests in further storage, or other legal permissions preclude such deletion.

The specific retention period depends, in particular, on the type of personal data, the purpose of its processing, the duration of the contractual or business relationship, and the applicable statutory retention and statute of limitations periods.

Regardless of this, we store the data processed when you purchase our products or use our services until the expiration of the statutory or any applicable contractual warranty rights. After this period expires, we retain the information regarding the contractual relationship required under commercial and tax law for the periods specified by law. During this period, the data will be processed again solely in the event of an audit by the tax authorities.

Data associated with a user account or trial account is generally deleted or anonymized when the account is no longer needed and there are no legal or contractual grounds for further storage. We store data related to inquiries, offers, and customer communications for as long as necessary to process the respective inquiry, carry out the business relationship, or assert, exercise, or defend legal claims.

Technical log, security, and error data are stored only for as long as necessary to ensure the security and stability of our services, to analyze errors, or to investigate security-related incidents.

For data stored within a subscriber’s workspace, the retention period is generally determined by the duration of the contractual relationship, the settings configured by the subscriber, and the subscriber’s instructions.

8. Your Rights

With regard to our processing of your personal data, you are entitled to the following rights free of charge:

You have the right to receive information from us regarding whether and what data we process about you. This includes, among other things, details on how long and for what purpose we process the data, the source of the data, and the recipients or categories of recipients to whom we disclose it. In addition, you may request that we provide you with a copy of this data.

You have the right to have us correct any information about you that is inaccurate or no longer accurate without delay. You may also request that we complete any incomplete personal data about you. If required by law, we will also inform third parties of this correction, provided that we have disclosed your personal data to them.

You have the right to request that we erase your personal data without delay if any of the following applies:

Your data is no longer necessary for the purposes for which it was collected or otherwise processed, or the purpose has been fulfilled;
You withdraw your consent and there is no other legal basis;
Your personal data has been processed unlawfully;
The erasure of your personal data is necessary to comply with a legal obligation under European Union law or the law of a Member State to which we are subject.

Your right to erasure may be restricted based on statutory provisions. This includes, in particular, the restrictions listed in Article 17 of the GDPR and Section 35 of the BDSG.

You have the right to request that we restrict the processing of your personal data if any of the following grounds apply:

You contest the accuracy of your personal data, for a period that allows us to verify the accuracy of the personal data;
the processing is unlawful, and you oppose the erasure of the personal data and instead request the restriction of the use of your personal data;
we no longer need your personal data for the purposes of processing; however, you need it to assert, exercise, or defend legal claims;
You have objected to the processing, and it has not yet been determined whether our legitimate grounds override yours.

If you have obtained a restriction on processing in accordance with the above list, we will notify you before the restriction is lifted.

You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format and to transmit this data to others, provided that the processing is based on your consent or a contract and is carried out by automated means. To the extent technically feasible, you may also request that we transmit this data directly to another controller. Exercising this right does not affect your right to erasure.

In particular, pursuant to Article 21 of the GDPR, you have the right to object at any time to the processing of your data on grounds relating to your specific situation, if we base this processing on legitimate interests pursuant to Article 6(1)(f) of the GDPR. If you object, we will no longer process your personal data, except in two cases:

we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms;
the processing is necessary for the establishment, exercise, or defense of legal claims.

If we process your personal data for direct marketing purposes, you have the right to object at any time to the processing of your data for such marketing purposes. If you object to the processing of your data for direct marketing purposes, we will no longer use your personal data for that purpose.

You may withdraw your consent given to us at any time with future effect. This withdrawal may be made by sending an informal notice to the contact addresses listed above. If you withdraw your consent, this does not affect the lawfulness of the data processing carried out up to that point.

8.8 Right to lodge a complaint with the supervisory authority

If you believe that our processing of your data violates applicable data protection laws, you have the right to file a complaint with one of the competent supervisory authorities. The supervisory authority responsible for us is:

Berlin Commissioner for Data Protection and Freedom of Information
Alt-Moabit 59–61
10555 Berlin
Phone: 030 13889-0
Fax: 030 2155050
Email: mailbox@datenschutz-berlin.de

In addition, you may file a complaint with the data protection supervisory authority responsible for you at your place of residence, your workplace, or the location of the alleged data protection violation. An overview of data protection supervisory authorities can be found at: https://www.bfdi.bund.de/DE/Service/Anschriften/Laender/Laender-node.html.

We do not make any decisions based solely on automated processing that produce legal effects on you or similarly significantly affect you. This also applies to the AI-supported features we provide. Their results serve exclusively as supportive suggestions, must be reviewed by the user, and do not trigger any independent follow-up actions.