Back to the home page

Privacy Policy

Last updated: 2026-10-12

This is a courtesy translation. The German Datenschutzerklärung is the binding version under German law.

In short

This is a static site. It sets no cookies and loads no external fonts, maps or videos. We measure how many people visit and how far they readwithout cookies and without recognising you with Pirsch, a service based in Germany; your browser loads the measurement script from its server. We do not recognise you from one day to the next. Also embedded is our own booking calendar at cal.inviqon.de - on our server, not a third party's. We process personal data in seven places: in the server log files, in audience measurement (your IP address is turned into a daily value there at once and not stored), in the booking calendar when you enter something there, in the contact form when you send it, in the EU AI Act check when you request your result and, if you choose to, consent to marketing emails, in the AI assistant when you open it and write to it, and when you write to us or call us. How to object is set out under Right to object.

Controller

inviqon GmbH
Kaiserstraße 91
40764 Langenfeld (Rheinland)
Germany
Phone: 0176 64039302
hello@inviqon.de

A data protection officer is not legally required and has not been appointed.

Hosting and delivery

This site is served from our own server cluster at OVH GmbH, Christophstrasse 19, 50670 Cologne, in a data centre in Germany (OVHcloud region Frankfurt). We use no content delivery network; every request is answered at that one location. The site is therefore delivered by the same provider and from the same country as our booking system.

We operate the cluster ourselves; OVH provides the infrastructure as a processor. The basis for this is a data processing agreement under Article 28 GDPR. No transfer to a third country takes place.

Server log files

When you open this site, our server processes technically necessary data. It arises on our own server cluster at OVH in Germany (OVHcloud region Frankfurt):

  • the page requested and the time of the request
  • the volume of data transferred and whether the request succeeded
  • browser type and version, operating system
  • the page you came from (referrer)
  • your IP address

Our API, which the contact form and the EU AI Act check use, also logs every request with the address requested, the time and your IP address.

The legal basis is Article 6(1)(f) GDPR. The legitimate interest is the stable and secure operation of the site. This data is not combined with other sources. We only look at these logs in the event of faults or attacks. The logs are neither archived nor collected centrally: they exist only in the respective server container, are rotated there once they reach a fixed size and are continuously overwritten by newer entries.

Cookies and audience measurement

We set no cookies, neither for advertising nor for analytics, and store nothing in your browser for measurement. Only if you switch measurement off below does the page store that choice in your browser.

For audience measurement we use Pirsch Analytics by Emvi Software GmbH, Nickelstraße 1b, 33378 Rheda-Wiedenbrück, Germany. Pirsch processes the data on servers in Germany on our behalf under Article 28 GDPR; a data processing agreement is in place. Pirsch uses Hetzner Online GmbH, Gunzenhausen, as a sub-processor; processing takes place in its data centres in Nuremberg and Falkenstein (Germany). Your browser loads the measurement script from insights.inviqon.de, an address that points at Pirsch's servers; the measurement data goes there too. When a page is requested, the following is transmitted: the page address including campaign parameters (such as utm_source), the page title, the referring page, browser, operating system and browser language as your browser sends them with every request, and your IP address. From the IP address Pirsch derives country and region and then discards it; it is not stored. Instead Pirsch combines it with the other connection data and a random value that changes daily into a one-way hash. This groups a visit within one day, but does not recognise you the next day. Pirsch keeps the statistics for as long as our Pirsch account exists; no profile of you is built, because the hash changes daily.

We also count a few events on this site: which sections of the home page, the industry pages and the use case pages are read, which button to the booking or the contact form is clicked and on which industry or use case page, whether the booking calendar was opened and whether an appointment was booked. These events contain no information about you and nothing from the booking - no name, no email address, not the chosen time. The EU AI Act check reports how far it got and whether the marketing email box was ticked, never your answers. The check's result pages are not measured at all: their address contains your result.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to understand how this site is used and where interested visitors drop off on their way to booking, in order to improve it. The data is not combined with other sources. The measurement script sets no cookies; from your browser's storage it reads only the switch-off entry that you can set yourself with the switch below. This is strictly necessary to honour your objection (Section 25(2)(2) TDDDG). You can object to this processing at any time, informally by email to hello@inviqon.de or for this browser right here:

This browser cannot use the switch (JavaScript or local storage is unavailable). An informal objection by email to hello@inviqon.de works just as well.

Only when you use it does the switch store a single entry in your browser (disable_pirsch in this site's local storage). As long as it is there, the measurement script sends nothing; the visit to this page itself has already been counted by then. The entry covers this browser only; if you clear your browser data, it is gone. An ad or tracking blocker in your browser also prevents the measurement.

The booking calendar stores data in your browser that the booking process needs - your time zone and the state of the dialog, among others. We treat this storage as strictly necessary under Section 25(2)(2) TDDDG: it is a precondition for the booking calendar, which is provided as part of this page, to work. Consent is therefore not required and we need no cookie banner.

Fonts

The typeface Archivo is served from our own server. There is no connection to Google Fonts or any other external provider, and your IP address is not transmitted to a third party.

Contacting us and arranging an appointment

Our booking calendar is embedded in this website. On the home page it appears as a calendar in the process section and at the end of the page and loads with the page. Every booking button also opens it as a window on the current page; for that it loads as soon as you point at such a button, reach it with the keyboard or tap it. It loads from cal.inviqon.de only, our own server - nothing goes to a third party.

To run a booking the application stores what it needs in your browser - among other things your time zone and the state of the booking. It is set by cal.inviqon.de and readable only there, not by this website. None of it is used for analysis or to recognise you for any other purpose. Besides the contact form you can write to us at any time athello@inviqon.de.

If you write to us or call us, we process your details solely to handle your enquiry and to arrange an appointment. The legal basis is Article 6(1)(b) GDPR for pre-contractual steps, otherwise (f). We keep the data for as long as we need it to handle your enquiry and any business relationship that results from it, and delete it afterwards unless statutory retention duties apply (business letters six years, accounting records ten years under the German Commercial Code and Fiscal Code, only where your details form part of them).

Our mailbox is hosted on Microsoft 365 (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). Microsoft processes your message on our behalf under Article 28 GDPR. A transfer to the USA cannot be ruled out; Microsoft bases it on the standard contractual clauses and is certified under the EU-US Data Privacy Framework.

For scheduling we run our own installation of the booking software atcal.inviqon.de, on a server in Germany (OVH GmbH, Christophstrasse 19, 50670 Cologne). No external booking provider is involved. We process what you enter there - usually your name, email address and the slot you pick - together with technical connection data. The legal basis is Article 6(1)(b) GDPR. We keep the booking data in the booking system and in our calendar for as long as we need it for the appointment and any business relationship that results from it, and delete it afterwards unless statutory retention duties apply.

The appointment is written into our Microsoft 365 calendar; where it is held as a video call we use Microsoft Teams from the same provider. The emails about the appointment - confirmation, reschedule, cancellation and reminder - are sent by our booking system through Brevo (Brevo GmbH, Köpenicker Strasse 126, 10179 Berlin, Germany) as the technical sending provider. Promotional email is sent only with your confirmed consent, see the EU AI Act check. The legal basis for these emails is Article 6(1)(b) GDPR; all of the above process on our behalf under Article 28 GDPR.

Contact form

At /en/contact/ we offer a contact form. When you send it, we process your topic (for example project enquiry or press), your name, your company, your email address, your phone number if you give it, your message and the language of the page. If you come from an industry or use case page, the form puts the details chosen there (industry, use case, calculation or package) in front of your message; you see them above the form first.

We store your details in our CRM, Pipedrive, as a contact, a company and an enquiry with your message. Every enquiry also goes by email to our team mailbox, so it is not lost if the CRM is unavailable. You receive a short confirmation email without your name and without your message. We send both emails through Brevo as a technical delivery service. The legal basis for handling your enquiry and the confirmation is Article 6(1)(b) GDPR (your request, where applicable pre-contractual steps), for storage in the CRM Article 6(1)(f) GDPR; our legitimate interest is handling enquiries in one place.

To protect against automated requests your browser solves a small computation before sending (ALTCHA, on our server, no third party, no cookie), and we limit requests per IP address. For this we keep the IP address in memory for at most one hour and do not store it for this purpose. What is said above under server log files applies to our API's access log.

For Pipedrive, Brevo and where our API runs, what is said in the EU AI Act check section applies, including how long we keep your details.

AI assistant

You can use an AI assistant on this website. It is an artificial intelligence and says so. It loads only after you click the button for the assistant; before that, nothing is stored and no service is called.

We process the text you type into the chat so that the assistant can answer. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is answering questions about our services directly. If you want to book an appointment, we also process your name, email address, company and a short summary of your need. The assistant shows you these details for confirmation first. The legal basis for the booking is Article 6(1)(b) GDPR.

The chat is processed by Microsoft Azure OpenAI on our behalf, in data centres within the EU (EU Data Zone). The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, with whom we have a data processing agreement. Your inputs are not used to train models. Microsoft keeps inputs and answers for up to 30 days to detect abuse and deletes them afterwards. Once you confirm a booking, the details go to Cal, our self-hosted booking system, and to Pipedrive, our CRM. Neither receives any data from the chat before that. We do not store the conversation.

In addition, Pirsch counts four anonymous events without content: assistant opened, first message sent, slots shown and booking confirmed.

EU AI Act check

At /en/eu-ai-act-check/ we offer a self-check on the EU AI Act. While you fill it in, your browser sends your answers about your company's use of AI to our own API, which computes the interim counts from them. These answers are not stored.

When you request your result, we process your name, your company, your business email address, your phone number if you give it, your answers and the computed result. We show you the result and email it to you. For this we store these details in our CRM, Pipedrive, to handle your request and send you the result. The legal basis for showing and sending it is Article 6(1)(b) GDPR (your request), for the CRM record Article 6(1)(f) GDPR; our legitimate interest is handling your request in one place.

To protect against automated requests your browser solves a small computation before sending (ALTCHA, on our server, no third party, no cookie), and we limit requests per IP address. For this we keep the IP address in memory for at most one hour and do not store it for this purpose. As with this website, our API's access log records every request with its IP address; what is said above under server log files applies to it.

Promotional email, such as our newsletter or information on AI, digitalisation and our services, is sent only if you tick the optional box and confirm your consent via the link in a separate email (double opt-in, Article 6(1)(a) GDPR). Brevo sends this confirmation email for us and adds you to our mailing list only after your click. For this Brevo receives your email address, name, company and language. As proof we store, at Brevo and in our CRM, the time of the request and of your confirmation, your IP address at the request, the wording and version of the consent text and the version of the confirmation email. If you unsubscribe, complain about an email or your contact is deleted at Brevo, Brevo tells us automatically and we note it in our CRM. You can withdraw your consent at any time with effect for the future, via the unsubscribe link in any of our emails or by email to hello@inviqon.de.

Our CRM is Pipedrive (Pipedrive OÜ, Mustamäe tee 3a, 10615 Tallinn, Estonia); emails are sent through Brevo (Brevo GmbH, Köpenicker Strasse 126, 10179 Berlin, Germany). Both process on our behalf under Article 28 GDPR; the data processing agreement is part of Pipedrive's terms and appendix 3 of Brevo's terms of service. Pipedrive transfers data to Pipedrive Inc. in the USA and to further sub-processors and bases this on the European Commission's standard contractual clauses and on the EU-US Data Privacy Framework. Brevo partly uses sub-processors outside the EU, such as Cloudflare and Zendesk in the USA, and bases the transfer on the EU-US Data Privacy Framework or on standard contractual clauses. Our API runs on our server cluster at OVH GmbH in Germany (OVHcloud region Frankfurt).

We keep your details in the CRM for as long as we need them to handle your request and any business relationship that results from it, and delete them afterwards, or earlier if you object, unless statutory retention duties apply (business letters six years, accounting records ten years under the German Commercial Code and Fiscal Code, only where your details form part of them). We keep the proof of consent for as long as we use the consent and afterwards for as long as claims can be made on it. The link to your result in the email carries only your answers, the language and the ruleset version in signed form, no contact details; it is valid for 90 days and we do not store it.

Right to object under Article 21 GDPR

Where we process data on the basis of Article 6(1)(f) GDPR (server log files, audience measurement, storage in our CRM, enquiries outside pre-contractual steps), you have the right to object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

Where we process data for direct marketing, you may object at any time without giving reasons; we will then no longer process it for that purpose.

An informal message to hello@inviqon.de is enough.

Your rights

You have the right of access (Article 15 GDPR), rectification (16), erasure (17), restriction of processing (18), data portability (20) and to object (21, see above). You may withdraw any consent at any time with effect for the future (Article 7(3) GDPR); this does not affect the lawfulness of processing before the withdrawal. Please write to the address above.

You may also lodge a complaint with a supervisory authority (Article 77 GDPR), in particular in the Member State of your residence, place of work or of the alleged infringement. The authority competent for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestraße 2-4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.

You are not legally or contractually required to provide your data. Without a name and email address, however, we cannot confirm an appointment or send you the result of the EU AI Act check. There is no automated decision-making, including profiling, under Article 22 GDPR; the check's result is an evaluation of your own answers without legal effect on you.

Version and changes

The version published on this page applies; its date is shown at the top of the page. If what this site does changes - because a new service is added, say - we change this policy before the change goes live.