Privacy Policy

As of: 11 October 2026

Google Workspace Integration and Data Usage

Google User Data & AI Limited Use Disclosure

sales automation.ai's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google Workspace user data accessed by our application (including Google Calendar data) is used exclusively to provide user-facing features. Raw, aggregated, or derived Google user data is never used, transferred, or sold to train, improve, or fine-tune generalized machine learning or artificial intelligence models.

What Google User Data We Access

  • Google Calendar (events, availability, calendar list)
  • Basic Google account information (name and primary email address)

We do not access your Google Drive or Google Sheets. Lead lists you export to Google Sheets are created and stored in Sales Automation's own Google account, not in yours.

How We Use Your Google Data

We use your Google data only to:

  • Schedule, update, and cancel sales meetings from CRM
  • Show your availability when meetings are booked
  • Let AI reply drafting and the AI autoresponder propose only times you are free
  • Show your calendar meetings in the meetings area and, if enabled, create meeting summaries and follow-up drafts
  • Identify which Google account is connected to your workspace

Sharing With Service Providers

We share Google data only as needed to provide features you choose to use:

  • If you enable the meeting notetaker, the meeting link from your calendar event is passed to our recording provider Recall.ai (EU region) so it can join the meeting.
  • If you connect a CRM such as HubSpot, meeting details (title, time, attendees) are synced to your own CRM account.
  • Some features process limited Google Calendar data through AI service providers. For meeting summaries, follow-up email drafts and meeting-type classification, the calendar event title is processed together with the meeting transcript. When you use AI reply drafting or the AI autoresponder with a booking link, the open time slots calculated from your calendar availability (free/busy only, without event titles or details) and, if a lead asks to reschedule, the date and time of the booked meeting are included so the AI only proposes times you are actually free. Depending on the AI model selected in your workspace, these providers are OpenAI, Anthropic or Google (Gemini API). All are used directly via their paid commercial APIs, under which customer data is not used to train their models. We do not use AI aggregators or gateways. Google Calendar event descriptions, attendee lists and calendar lists are not sent to AI service providers.
  • This data is used only to generate the result for you. Raw, aggregated or derived Google user data is never used to train, improve or fine-tune generalized AI or machine learning models.

What We Do Not Do

We do not:

  • Sell your Google data
  • Use Google data for advertising
  • Share Google data with third parties, except the service providers described above or where required by law
  • Use Google data for purposes other than providing the features described above
  • Allow humans to read your Google data, unless you give us permission, it is needed for security purposes, or it is required by law

Disconnecting and Revoking Access

You can disconnect Google Calendar at any time in your Sales Automation calendar settings, or revoke access at https://myaccount.google.com/permissions.

After you disconnect or revoke access, we stop reading from and writing to your Google Calendar. When you disconnect in Sales Automation, meetings imported from your calendar are removed from your workspace, except meetings that were recorded or transcribed, which remain part of your CRM records.

To have your remaining Google data deleted, contact info@sales-automation.ai. We will delete it within 30 days, unless we are required by law to keep it.

Overview of Processing Activities

The following overview summarizes the categories of data processed, the purposes of processing, and the groups of data subjects concerned.

Categories of Data Processed

  • Master data.
  • Payment data.
  • Contact data.
  • Content data.
  • Contract data.
  • Usage data.
  • Meta, communication and procedural data.
  • Log data.

Categories of Data Subjects

  • Service recipients and clients.
  • Prospects.
  • Communication partners.
  • Users.
  • Business and contractual partners.
  • Customers.

Purposes of Processing

  • Provision of contractual services and fulfilment of contractual obligations.
  • Communication.
  • Security measures.
  • Direct marketing.
  • Reach measurement.
  • Tracking.
  • Office and organizational procedures.
  • Conversion measurement.
  • Target group creation.
  • Organizational and administrative procedures.
  • Feedback.
  • Marketing.
  • Profiles containing user-related information.
  • Provision of our online offering and user friendliness.
  • Information technology infrastructure.
  • Sales promotion.
  • Business processes and business management procedures.
  • Data enrichment and validation by external services.
  • Web analytics and user-behaviour tracking using Microsoft Clarity.

Relevant Legal Bases

Relevant legal bases under the GDPR: Below you will find an overview of the GDPR legal bases on which we process personal data. Please note that national data protection rules in your or our country of residence or establishment may also apply. If more specific legal bases apply in individual cases, we will inform you of them in this privacy policy.

  • Consent (Art. 6(1)(a) GDPR) - The data subject has given consent to the processing of personal data concerning them for one or more specific purposes.
  • Contract performance and pre-contractual requests (Art. 6(1)(b) GDPR) - Processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract.
  • Legal obligation (Art. 6(1)(c) GDPR) - Processing is necessary for compliance with a legal obligation to which the controller is subject.
  • Legitimate interests (Art. 6(1)(f) GDPR) - Processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

National data protection rules in Germany: In addition to the GDPR, national data protection rules in Germany apply. These include in particular the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG). The BDSG contains special rules on rights of access, erasure, objection, processing of special categories of personal data, processing for other purposes, transfers and automated decision-making including profiling. State data protection laws may also apply.

Reference to the Swiss FADP and GDPR: This privacy notice provides information both under the Swiss Federal Act on Data Protection (FADP) and under the GDPR. For clarity and because of the broader territorial application, GDPR terminology is used. The legal meaning of terms under the Swiss FADP remains determined by the Swiss FADP where it applies.

Security Measures

We take appropriate technical and organizational measures in accordance with legal requirements, taking into account the state of the art, implementation costs, the nature, scope, circumstances and purposes of processing, as well as the varying likelihood and severity of risks to the rights and freedoms of natural persons.

These measures include safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to data, access rights, input, transfer, availability and separation. We have also established procedures for exercising data subject rights, deleting data and responding to threats to data. Data protection is taken into account when developing or selecting hardware, software and procedures, in line with privacy by design and privacy by default.

Securing online connections with TLS/SSL encryption technology (HTTPS): To protect data transmitted via our online services against unauthorized access, we use TLS/SSL encryption. These technologies encrypt information transmitted between the website or app and the user's browser, or between servers. HTTPS in the URL indicates that data is transmitted securely and encrypted.

Transfer of Personal Data

In the course of processing personal data, data may be transmitted to or disclosed to other bodies, companies, legally independent organizational units or persons. Recipients may include IT service providers or providers of services and content integrated into a website. In such cases, we comply with legal requirements and conclude contracts or agreements with recipients to protect your data.

Data transfer within the organization or group: We may transfer personal data to other companies within our group or grant them access. Where transfer is for administrative purposes, it is based on our legitimate business interests, on contractual obligations, on consent, or on legal permission.

International Data Transfers

Where we process data in a third country, i.e. outside the European Union (EU) or European Economic Area (EEA), or where processing takes place through third-party services or disclosure to other persons, bodies or companies, this is done only in accordance with legal requirements. If an adequacy decision exists for the third country (Art. 45 GDPR), it serves as the basis for the transfer. Otherwise, transfers take place only if an adequate level of protection is otherwise ensured, in particular through standard contractual clauses (Art. 46(2)(c) GDPR), explicit consent, or contractual or legally required transfer (Art. 49 GDPR). Information from the European Commission is available at: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en?prefLang=de.

EU-US Trans-Atlantic Data Privacy Framework: Under the Data Privacy Framework (DPF), the European Commission has recognized an adequate level of protection for certain certified US companies. The list of certified companies and further information can be found at https://www.dataprivacyframework.gov/. We indicate in this privacy policy which service providers used by us are certified under the Data Privacy Framework.

General Information on Data Storage and Deletion

We delete personal data that we process in accordance with legal requirements as soon as the underlying consents are withdrawn or no further legal bases for processing exist. This applies where the original processing purpose no longer applies or the data is no longer required. Exceptions apply where legal obligations or special interests require longer retention or archiving.

In particular, data that must be retained for commercial or tax law reasons, or whose storage is necessary for legal claims or to protect the rights of other natural or legal persons, must be archived accordingly.

Our privacy notice contains additional information on retention and deletion for specific processing activities.

Where several retention periods or deletion deadlines apply to a data item, the longest period is decisive.

If a period does not begin on a specific date and is at least one year long, it automatically begins at the end of the calendar year in which the triggering event occurred. For ongoing contractual relationships, the triggering event is the effective termination or other end of the legal relationship.

Data that is no longer required for its original purpose but is retained due to legal requirements or other reasons is processed only for the purposes justifying retention.

Additional notes on processing activities, procedures and services:

  • Retention and deletion of data: The following general retention and archiving periods apply under German law:
    • 10 years - Retention period for books and records, annual financial statements, inventories, management reports, opening balance sheets, related working instructions and organizational documents, accounting records and invoices.
    • 6 years - Other business documents, including received and sent commercial or business letters and other documents relevant for taxation.
    • 3 years - Data required to consider potential warranty, damages or similar contractual claims and related inquiries is retained for the regular statutory limitation period of three years.

Business Services

We process data of our contractual and business partners, such as customers and prospects, within contractual and similar legal relationships and related measures, including communication with those partners and pre-contractual inquiries.

We use this data to fulfil contractual obligations, including providing agreed services, updates and remedies for warranty or service issues. We also use the data to protect our rights, perform administrative tasks and organize our business. In addition, we process the data on the basis of legitimate interests in proper business management and security measures to protect partners and our business from misuse or threats to data, secrets, information and rights. Under applicable law, we disclose partner data to third parties only where necessary for these purposes or to comply with legal obligations. Further processing, for example for marketing purposes, is described in this privacy policy.

We inform contractual partners which data is required before or during collection, for example in online forms, by special markings or personally.

We delete the data after expiry of statutory warranty and comparable obligations, generally after four years, unless the data is stored in a customer account or must be archived for legal reasons, for example for tax purposes. Data disclosed to us by a contractual partner in connection with an order is deleted according to the order requirements and generally after completion of the order.

  • Categories of data processed: Master data; payment data; contact data; contract data.
  • Data subjects: Service recipients and clients; prospects; business and contractual partners.
  • Purposes of processing: Provision of contractual services and fulfilment of contractual obligations; communication; office, organizational and administrative procedures; business processes.
  • Retention and deletion: Deletion according to the section "General Information on Data Storage and Deletion".
  • Legal bases: Contract performance and pre-contractual requests (Art. 6(1)(b) GDPR); legal obligation (Art. 6(1)(c) GDPR); legitimate interests (Art. 6(1)(f) GDPR).

Additional notes on processing activities, procedures and services:

  • Provision of software and platform services: We process data of users, registered users and trial users in order to provide our contractual services and, based on legitimate interests, to secure and further develop our offering. Required information is marked as such during order, booking or similar contract conclusion and includes information needed for service provision, billing and contact; Legal bases: Contract performance and pre-contractual requests (Art. 6(1)(b) GDPR).

Business Processes and Procedures

Personal data of service recipients and clients, including customers, clients, business partners and other third parties, is processed within contractual and comparable legal relationships and pre-contractual measures such as initiating business relationships. This processing supports business operations in customer management, sales, payments, accounting and project management.

The data is used to fulfil contractual obligations and manage business processes efficiently, including business transactions, customer relationship management, sales optimization and internal accounting and finance processes. The data also helps protect the controller's rights and supports administrative and organizational tasks.

  • Categories of data processed: Master data, lead data, company data, and data enriched by enrichment services, such as extended contact information, company information and professional profiles.
  • Data subjects: Service recipients and clients; prospects; communication partners; business and contractual partners; customers.
  • Purposes of processing: Provision of contractual services and fulfilment of contractual obligations; office and organizational procedures; business processes; security measures; provision of our online offering and user friendliness.
  • Retention and deletion: Deletion according to the section "General Information on Data Storage and Deletion".
  • Legal bases: Contract performance and pre-contractual requests (Art. 6(1)(b) GDPR); legitimate interests (Art. 6(1)(f) GDPR).

Additional notes on processing activities, procedures and services:

  • Customer account: Customers may create an account within our online offering. If registration is required, customers are informed accordingly. Accounts are not public and cannot be indexed by search engines. During registration, login and use, we store IP addresses and access times to prove registration and prevent misuse. If an account is terminated, account data is deleted after termination unless it is retained for other purposes or legal reasons. Customers are responsible for backing up their data when terminating an account; Legal bases: Contract performance and pre-contractual requests (Art. 6(1)(b) GDPR), legitimate interests (Art. 6(1)(f) GDPR).
  • Business analysis and market research: We analyze data relating to business transactions, contracts and inquiries to identify market trends and the needs of contractual partners and users. Analyses serve business evaluation, marketing and market research and are performed for the controller only. They are not disclosed externally except as anonymized aggregate analyses. Data is processed in pseudonymized or, where possible, anonymized form; Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).
  • Data enrichment by external services: We use various enrichment APIs and data enrichment services to complete and validate registration and contact data.
    • Categories of data processed: master data, contact data, company data, professional information and publicly available profile information.
    • Data subjects: prospects, customers, business and contractual partners.
    • Purposes: data enrichment, contact validation, improved data quality and personalization of communication.
    • Legal bases: legitimate interests (Art. 6(1)(f) GDPR), contract performance and pre-contractual requests (Art. 6(1)(b) GDPR).

Additional notes on processing activities, procedures and services:

  • Lusha: Data enrichment service for B2B contact information; provider: Lusha Systems Ltd., Israel; website: https://www.lusha.com; privacy policy: https://www.lusha.com/privacy-policy/
  • Apollo: B2B data platform for contact and company information; provider: Apollo.io Inc., USA; website: https://www.apollo.io; privacy policy: https://www.apollo.io/privacy/
  • Dealfront (formerly Echobot): B2B data enrichment and lead intelligence; provider: Dealfront GmbH, Germany; website: https://www.dealfront.com; privacy policy: https://www.dealfront.com/de/legal/privacy/
  • FullEnrich: Data enrichment service for email addresses and contact data; website: https://fullenrich.com; privacy policy available on the website.
  • enrich.so: API-based data enrichment service; website: https://enrich.so
  • Bright Data: Data collection and enrichment; provider: Bright Data Ltd., Israel; website: https://brightdata.com; privacy policy: https://brightdata.com/privacy-policy
  • Hunter.io: Email finder and verification service; provider: Hunter.io SAS, France; website: https://hunter.io; privacy policy: https://hunter.io/privacy

Payment Procedures

Within contractual and other legal relationships, due to legal obligations or based on our legitimate interests, we offer efficient and secure payment options and use banks, credit institutions and other payment service providers.

Data processed by payment service providers includes master data such as name and address, bank data such as account or credit card numbers, passwords, TANs and checksums, as well as contract, amount and recipient information. This information is required to carry out transactions. Entered data is processed and stored only by the payment service providers. We do not receive account or credit-card-related information, but only confirmation or negative information about payment. Payment service providers may transfer data to credit agencies for identity and credit checks. Please refer to the terms and privacy notices of the payment service providers.

Payment transactions are subject to the terms and privacy notices of the respective payment service providers, which are available on their websites or transaction applications.

  • Categories of data processed: Master data; payment data; contract data; usage data; meta, communication and procedural data; contact data.
  • Data subjects: Service recipients and clients; business and contractual partners; prospects.
  • Purposes of processing: Provision of contractual services and fulfilment of contractual obligations; business processes.
  • Retention and deletion: Deletion according to the section "General Information on Data Storage and Deletion".
  • Legal bases: Contract performance and pre-contractual requests (Art. 6(1)(b) GDPR); legitimate interests (Art. 6(1)(f) GDPR).

Additional notes on processing activities, procedures and services:

  • American Express: Payment services; provider: American Express Europe S.A., Theodor-Heuss-Allee 112, 60486 Frankfurt am Main, Germany; legal bases: contract performance and pre-contractual requests (Art. 6(1)(b) GDPR); website: https://www.americanexpress.com/de/; privacy policy: https://www.americanexpress.com/de-de/firma/legal/datenschutz-center/online-datenschutzerklarung/.
  • Apple Pay: Payment services; provider: Apple Inc., Infinite Loop, Cupertino, CA 95014, USA; legal bases: contract performance and pre-contractual requests (Art. 6(1)(b) GDPR); website: https://www.apple.com/de/apple-pay/; privacy policy: https://www.apple.com/legal/privacy/de-ww/.
  • Google Pay: Payment services; provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; legal bases: contract performance and pre-contractual requests (Art. 6(1)(b) GDPR); website: https://pay.google.com/intl/de_de/about/; privacy policy: https://policies.google.com/privacy.
  • Mastercard: Payment services; provider: Mastercard Europe SA, Chaussée de Tervuren 198A, B-1410 Waterloo, Belgium; legal bases: contract performance and pre-contractual requests (Art. 6(1)(b) GDPR); website: https://www.mastercard.de/de-de.html; privacy policy: https://www.mastercard.de/de-de/datenschutz.html.
  • Stripe: Payment services; provider: Stripe, Inc., 510 Townsend Street, San Francisco, CA 94103, USA; legal bases: contract performance and pre-contractual requests (Art. 6(1)(b) GDPR); website: https://stripe.com; privacy policy: https://stripe.com/de/privacy; third-country transfer basis: Data Privacy Framework (DPF).
  • Visa: Payment services; provider: Visa Europe Services Inc., London branch, 1 Sheldon Square, London W2 6TT, United Kingdom; legal bases: contract performance and pre-contractual requests (Art. 6(1)(b) GDPR); website: https://www.visa.de; privacy policy: https://www.visa.de/nutzungsbedingungen/visa-privacy-center.html; third-country transfer basis: adequacy decision (United Kingdom).

Provision of the Online Offering and Web Hosting

We process user data to provide our online services. For this purpose, we process the user's IP address, which is necessary to transmit content and functions of our online services to the user's browser or device.

  • Categories of data processed: Usage data; meta, communication and procedural data; log data.
  • Data subjects: Users, such as website visitors and users of online services.
  • Purposes: Provision of our online offering and user friendliness; IT infrastructure; security measures.
  • Retention and deletion: Deletion according to the section "General Information on Data Storage and Deletion".
  • Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

Additional notes on processing activities, procedures and services:

  • Collection of access data and log files: Access to our online offering is recorded in server log files. These may include the address and name of accessed pages and files, date and time, transferred data volume, success message, browser type and version, operating system, referrer URL, IP addresses and provider. Log files may be used for security purposes, for example to prevent server overload and attacks, and to ensure server stability; Legal bases: Legitimate interests (Art. 6(1)(f) GDPR). Deletion: Log information is stored for up to 30 days and then deleted or anonymized. Data required as evidence is excluded until the relevant incident is finally clarified.

Use of Cookies

Cookies are small text files or other storage markers that store and read information on devices, for example to save login status, shopping basket contents, accessed content or functions used. Cookies may also be used for functionality, security, convenience and analysis of visitor flows.

Notes on consent: We use cookies in accordance with legal requirements. We obtain prior consent unless it is not required by law. Consent is not required where storing and reading information is strictly necessary to provide a telemedia service expressly requested by users. Withdrawable consent is clearly communicated and includes information on the respective cookie use.

Legal bases for cookies: The legal basis depends on whether we ask for consent. If users consent, processing is based on consent. Otherwise, cookie data is processed on the basis of legitimate interests, for example in operating and improving our online offering, or where cookies are required to fulfil contractual obligations.

Storage period: The following types of cookies are distinguished:

  • Temporary cookies (session cookies): Temporary cookies are deleted at the latest after a user leaves an online offering and closes the device, browser or mobile application.
  • Persistent cookies: Persistent cookies remain stored after the device is closed. They may, for example, save login status or preferred content. Unless we provide specific information, users should assume persistent cookies may be stored for up to two years.

Withdrawal and objection (opt-out): Users may withdraw consent at any time and object to processing in accordance with legal requirements, including through browser privacy settings.

  • Categories of data processed: Meta, communication and procedural data.
  • Data subjects: Users, such as website visitors and users of online services.
  • Legal bases: Legitimate interests (Art. 6(1)(f) GDPR); consent (Art. 6(1)(a) GDPR).

Registration, Login and User Account

Users may create a user account. During registration, required mandatory information is communicated and processed for provision of the user account on the basis of contractual obligations. Processed data includes login information, such as username, password and email address.

When users use registration, login and account functions, we store IP address and time of the respective action. Storage is based on our legitimate interests and those of users in protection against misuse and unauthorized use. Data is generally not passed to third parties unless required to pursue our claims or due to a legal obligation.

Users may be informed by email about events relevant to their user account, such as technical changes.

  • Categories of data processed: Master data; contact data; content data; meta, communication and procedural data; log data.
  • Data subjects: Users, such as website visitors and users of online services.
  • Purposes: Provision of contractual services and fulfilment of contractual obligations; security measures; organizational and administrative procedures; provision of our online offering and user friendliness.
  • Retention and deletion: Deletion according to the section "General Information on Data Storage and Deletion".
  • Legal bases: Contract performance and pre-contractual requests (Art. 6(1)(b) GDPR); legitimate interests (Art. 6(1)(f) GDPR).

Additional notes on processing activities, procedures and services:

  • Registration with real names: Due to the nature of our community, we ask users to use our offering only under their real names. Use of pseudonyms is not permitted; Legal bases: Contract performance and pre-contractual requests (Art. 6(1)(b) GDPR).
  • User profiles are not public: User profiles are not publicly visible or accessible.
  • Deletion of data after termination: When users terminate their user account, account data is deleted subject to legal permission, obligation or user consent; Legal bases: Contract performance and pre-contractual requests (Art. 6(1)(b) GDPR).
  • Two-factor authentication: Two-factor authentication provides an additional security layer for your account and helps ensure only you can access it even if someone else knows your password. We will inform you about the procedure used; Legal bases: Contract performance and pre-contractual requests (Art. 6(1)(b) GDPR).

Contact and Inquiry Management

When you contact us, for example by post, contact form, email, telephone or social media, and within existing user or business relationships, we process the information provided by inquiring persons to the extent necessary to answer inquiries and handle requested measures.

  • Categories of data processed: Master data; contact data; content data; usage data; meta, communication and procedural data; log data.
  • Data subjects: Communication partners.
  • Purposes: Communication; organizational and administrative procedures; feedback; provision of our online offering and user friendliness.
  • Retention and deletion: Deletion according to the section "General Information on Data Storage and Deletion".
  • Legal bases: Legitimate interests (Art. 6(1)(f) GDPR); contract performance and pre-contractual requests (Art. 6(1)(b) GDPR).

Additional notes on processing activities, procedures and services:

  • Contact form: When you contact us through our contact form, by email or other channels, we process the personal data transmitted to answer and handle the request. This usually includes name, contact information and any further information provided. We use this data only for the stated purpose of contact and communication; Legal bases: Contract performance and pre-contractual requests (Art. 6(1)(b) GDPR), legitimate interests (Art. 6(1)(f) GDPR).

Chatbots and Chat Functions

We offer online chats and chatbot functions as communication options. A chat is an online conversation conducted with a certain immediacy. A chatbot is software that answers user questions or informs users through messages. When you use our chat functions, we may process your personal data.

If you use our chat services within a platform or messenger service, access data for your account on that platform or messenger may also be collected. For web-based chat services, special identifiers may be stored in your browser so that the chat service is available across pages.

Information stored in connection with chat services is deleted or anonymized when no longer required, and at the latest after six months, unless longer storage is legally required or permitted. Longer storage may also occur if you have consented to further contact.

  • Categories of data processed: Contact data; content data; usage data; meta, communication and procedural data.
  • Data subjects: Communication partners; users.
  • Purposes: Communication; direct marketing; feedback.
  • Retention and deletion: Deletion according to the section "General Information on Data Storage and Deletion"; deletion after up to 6 months.
  • Legal bases: Consent (Art. 6(1)(a) GDPR); legitimate interests (Art. 6(1)(f) GDPR).

Additional notes on processing activities, procedures and services:

Newsletters and Electronic Notifications

We send newsletters, emails and other electronic notifications only with recipients' consent or where legally permitted. If newsletter content is described during sign-up, it is decisive for consent. Otherwise, our newsletters contain information about us and our services.

To subscribe to newsletters, providing an email address is generally sufficient. We may ask for a name for personal address or further information if required for newsletter purposes.

Double opt-in: Newsletter sign-up generally uses a double opt-in procedure. After registration, you receive an email asking you to confirm the subscription. This confirmation prevents registration with third-party email addresses. Subscriptions are logged to prove the registration process in accordance with legal requirements, including storage of registration and confirmation time and IP address.

Deletion and restriction: We may store unsubscribed email addresses for up to three years based on legitimate interests before deleting them, to prove previous consent. Processing is limited to possible defence against claims. Where objections must be permanently observed, we may store the email address in a block list for this purpose.

Logging of the registration process is based on legitimate interests in proving proper operation. Where we use a service provider to send emails, this is based on legitimate interests in efficient and secure dispatch.

Content:

Information about us, our services, campaigns and offers.

  • Categories of data processed: Master data; contact data; meta, communication and procedural data; usage data; log data.
  • Data subjects: Communication partners.
  • Purposes: Direct marketing; provision of our online offering and user friendliness.
  • Retention and deletion: Deletion according to the section "General Information on Data Storage and Deletion".
  • Legal bases: Consent (Art. 6(1)(a) GDPR); legitimate interests (Art. 6(1)(f) GDPR).

Additional notes on processing activities, procedures and services:

  • Open and click rate measurement: Newsletters contain a web beacon, a pixel-sized file retrieved from our server or the mailing service provider's server when the newsletter is opened. Technical information such as browser, system, IP address and time is collected. This information is used to technically improve newsletters and analyze readership. It also records whether newsletters are opened, when they are opened and which links are clicked. The information is assigned to individual recipients and stored in their profiles until deletion. Measurement and further processing are based on user consent. Separate withdrawal of measurement is not possible; the newsletter subscription must be cancelled or objected to, in which case stored profile information is deleted; Legal bases: Consent (Art. 6(1)(a) GDPR).

Advertising Communication by Email, Post, Fax or Telephone

We process personal data for advertising communication through channels such as email, telephone, post or fax in accordance with legal requirements.

Recipients may withdraw consent or object to advertising communication at any time.

After withdrawal or objection, we store data required to prove previous authorization for contacting or sending for up to three years after the end of the year of withdrawal or objection, based on legitimate interests. Processing is limited to possible defence against claims. To permanently respect withdrawals or objections, we also store data necessary to prevent renewed contact, such as email address, telephone number or name.

  • Categories of data processed: Master data; contact data.
  • Data subjects: Communication partners.
  • Purposes: Direct marketing.
  • Retention and deletion: Deletion according to the section "General Information on Data Storage and Deletion".
  • Legal bases: Consent (Art. 6(1)(a) GDPR); legitimate interests (Art. 6(1)(f) GDPR).

Web Analytics, Monitoring and Optimization

Web analytics, also called reach measurement, evaluates visitor flows to our online offering and may include behaviour, interests or demographic information as pseudonymous values. Reach analysis helps us identify when our online offering or its functions and content are most used and where optimization is needed.

We may also use testing procedures to test and optimize different versions of our online offering or its components.

Unless stated otherwise, profiles may be created for these purposes, meaning data summarized for a usage process, and information may be stored in and read from a browser or device. Collected information includes visited websites, used elements and technical details such as browser, computer system and usage times. If users consent to location data collection, location data may also be processed.

IP addresses are stored, but we use IP masking to protect users. In web analytics, A/B testing and optimization, generally no clear user data such as email addresses or names is stored, but pseudonyms. We and the software providers do not know the actual identity of users, only profile information stored for the respective procedures.

Legal bases: If we ask users for consent to use third-party providers, the legal basis is consent. Otherwise, user data is processed on the basis of legitimate interests in efficient, economical and user-friendly services. Please also note the cookie information in this policy.

  • Categories of data processed: Usage data; meta, communication and procedural data; log data.
  • Data subjects: Users, such as website visitors and users of online services.
  • Purposes: Reach measurement; user profiles; tracking; provision of our online offering and user friendliness; conversion measurement.
  • Security measures: IP masking.
  • Legal bases: Consent (Art. 6(1)(a) GDPR); legitimate interests (Art. 6(1)(f) GDPR).

Additional notes on processing activities, procedures and services:

  • Google Analytics 4: We use Google Analytics to measure and analyze use of our online offering based on a pseudonymous user identification number. This number contains no unique data such as names or email addresses. It helps assign analytics information to a device and understand which content users accessed, which search terms were used and how users interacted with our offering. Google Analytics does not log or store individual IP addresses for EU users. For EU traffic, IP address data is used only for geolocation derivation and then deleted; Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Consent (Art. 6(1)(a) GDPR); Website: https://marketingplatform.google.com/intl/de/about/analytics/; Security measures: IP masking; Privacy policy: https://policies.google.com/privacy; Data processing agreement: https://business.safety.google/adsprocessorterms/; Third-country transfer basis: Data Privacy Framework (DPF), standard contractual clauses; Opt-out: https://tools.google.com/dlpage/gaoptout?hl=de.
  • Microsoft Clarity: We use Microsoft Clarity to analyze and understand use of our website. The service records how visitors interact with the website, including behavioural metrics, heatmaps, mouse movements, clicks and scroll behaviour. Information includes technical data such as device type, browser, operating system, screen resolution, pseudonymized IP addresses and location data at city level. Data is used to optimize usability, identify user experience issues and improve website performance. Processing is based on legitimate interests in analytics, optimization and economic operation of our online offering; Provider: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA; Legal bases: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://clarity.microsoft.com; Privacy policy: https://privacy.microsoft.com/de-de/privacystatement; Third-country transfer basis: Data Privacy Framework (DPF), standard contractual clauses.
  • Sales Automation website visitor system: We use the Sales Automation website visitor system to record and analyze IP addresses of website visitors. The system helps identify companies visiting our website by matching IP addresses with public and commercial databases. Data may include IP address, location, company information, visited pages, dwell time, timestamps and referrer information. The data is used to identify potential business contacts, evaluate marketing effectiveness, analyze user behaviour and optimize website content and marketing strategies. Processing is based on legitimate interests in customer acquisition, market analysis and optimization of business processes. You may object to processing of your IP address at https://www.sales-automation.ai/ip-opt-out; Provider: Sales Automation GmbH, Bahnhofstraße 11, 56112 Lahnstein, Germany; Legal bases: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.sales-automation.ai; Privacy policy: https://www.sales-automation.ai/datenschutz; Opt-out: https://www.sales-automation.ai/ip-opt-out.

Online Marketing

We process personal data for online marketing purposes, including marketing advertising space or displaying advertising and other content based on users' potential interests and measuring effectiveness.

For these purposes, user profiles are created and stored in cookies or similar procedures. Relevant information may include viewed content, visited websites, online networks used, communication partners and technical information such as browser, computer system, usage times and functions. If users consent to location data collection, location data may also be processed.

IP addresses are also stored. We use available IP masking procedures to protect users. Generally, online marketing procedures do not store clear user data such as email addresses or names, but pseudonyms.

Profile information is generally stored in cookies or similar technologies. These cookies may later be read on other websites using the same online marketing procedure and analyzed for content display or combined with additional data.

As an exception, clear data may be assigned to profiles, mainly where users are members of a social network whose online marketing procedure we use and that network links profiles with the information described above.

We generally receive only aggregated information on the success of our advertisements. In conversion measurement, we can determine which online marketing procedures led to conversion, for example conclusion of a contract. Conversion measurement is used solely to analyze marketing success.

Unless otherwise stated, please assume cookies are stored for two years.

  • Categories of data processed: Usage data; meta, communication and procedural data; log data.
  • Data subjects: Users; prospects; communication partners.
  • Purposes: Reach measurement; tracking; conversion measurement; marketing; user profiles; target group creation.
  • Security measures: IP masking.
  • Legal bases: Consent (Art. 6(1)(a) GDPR); legitimate interests (Art. 6(1)(f) GDPR).

Additional notes on processing activities, procedures and services:

  • Google Ads and conversion measurement: We use Google Ads to place ads in the Google advertising network and measure conversions. Ads are displayed based on assumed user interests. We receive anonymous statistics and do not create user profiles. Google may store information in cookies or similar technologies to analyze user behaviour and create profiles; Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Consent (Art. 6(1)(a) GDPR); Website: https://marketingplatform.google.com; Privacy policy: https://policies.google.com/privacy; Third-country transfer basis: Data Privacy Framework (DPF), standard contractual clauses.
  • Google Tag Manager: Google Tag Manager lets us manage website tags and integrate other services into our online offering. The tag manager itself does not create user profiles or store cookies. Google only receives the user's IP address, which is necessary to run Google Tag Manager; Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal bases: Consent (Art. 6(1)(a) GDPR); Website: https://marketingplatform.google.com; Privacy policy: https://policies.google.com/privacy.
  • LinkedIn Insight Tag: The LinkedIn Insight Tag is code added to our website to provide deeper insights into campaign performance, website visits and website visitors for our LinkedIn page. Conversion data, website audiences, demographic data and similar information are collected; Provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland; Legal bases: Consent (Art. 6(1)(a) GDPR); Website: https://www.linkedin.com; Privacy policy: https://www.linkedin.com/legal/privacy-policy; Data processing agreement: https://legal.linkedin.com/dpa; Opt-out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out. LinkedIn removes direct identifiers within seven days and deletes remaining pseudonymized data within 180 days.

Changes and Updates

Please review the content of this privacy policy regularly. We update it whenever changes to our data processing activities make this necessary. We will inform you if changes require action from you, such as consent, or other individual notification.

If we provide addresses and contact information of companies and organizations in this policy, please note that these may change over time and should be checked before contact.

Created with the free Datenschutz-Generator.de by Dr. Thomas Schwenke
Supplemented and expanded by Sales Automation GmbH.