Privacy policy

The company responsible for processing your personal data under the General Data Protection Regulation (GDPR) is:

For questions about data protection or to exercise your rights, contact datenschutz@ases.app or write to the postal address above, marked “Datenschutz”.

When you visit this website, we process your IP address, the time and destination of the request, and browser and device information. We need these data to deliver pages, resolve faults and protect the website against misuse. The website is hosted by Hetzner Online GmbH in Germany.

We use Cloudflare to deliver and protect the website and resolve our domain name (DNS). Cloudflare processes data transmitted through the website, including connection data and submitted form contents. Processing outside the EU is possible; recipients and transfer safeguards are listed below.

Data transmitted between your browser, Cloudflare and our server are encrypted.

The legal basis is our legitimate interest in a secure, stable and fast website (Art. 6(1)(f) GDPR).

Google access logs are deleted after 30 days. Cloudflare does not retain permanent request logs for our website; security events are kept for up to 31 days and forwarding-service logs for up to seven days. IP addresses used to limit search requests are processed temporarily in memory only.

When you use our contact form, we process your name, email address, subject, message, preferred language and reply method. We also need your telephone number if you request a telephone reply.

Company and country details are optional. The form suggests a country and language based on your browser settings; you can change both before sending. Suggestions are generated on your device and sent only with your enquiry.

Your enquiry reaches our team by email. We use Amazon SES in Frankfurt am Main for delivery and acknowledgements, and Google Workspace for our business mailboxes.

We transfer your enquiry and contact details to our customer relationship management system (CRM) to handle and follow up on your request. We operate our own Odoo installation on a Hetzner server in Germany. The time and version of your form acknowledgement are also recorded.

Temporarily held enquiries are deleted after delivery to our CRM or team. Undeliverable enquiries are deleted within 30 days. Technical reference and status records, including a pseudonymised verification value of your telephone number where applicable, are deleted 90 days after the process is completed.

We keep technical logs for troubleshooting without names, telephone numbers or message contents. These include a truncated IP address and are deleted within seven days.

Insofar as your request serves the conclusion or performance of a contract with you, Art. 6(1)(b) GDPR is the legal basis. We handle general inquiries and inquiries on behalf of a company on the basis of our legitimate interest in business communication (Art. 6(1)(f) GDPR).

Enquiries that do not lead to an order are deleted, including CRM data, within 30 days after handling is completed. Necessary customer data are kept for the duration of the business relationship. Statutory retention duties and the protection of legal claims remain applicable.

Cloudflare Turnstile protects our forms against automated and abusive submissions. It activates when you first select a form field.

Cloudflare evaluates technical signals such as IP address, browser information and connection characteristics to distinguish human submissions from automated requests. Cloudflare acts as our processor when protecting our forms and as an independent controller when using these signals to develop its detection systems.

Processing is based on our legitimate interest in protecting our communication channels (Art. 6(1)(f) GDPR). Where access to your device is strictly necessary for this protection, Section 25(2), no. 2 TDDDG applies. We do not use the additional cookie-based “Pre-Clearance” feature.

Use “Start a project” to describe your plans. We process your selected services, project stage, description and the contact details needed to reply.

Company, country, budget, timing, website address and a request for a confidentiality agreement are optional. Required contact details depend on your chosen reply method. You can change the suggested country and language before sending.

Files you choose to attach are transmitted with your enquiry and delivered to our team as email attachments. The website does not create permanent file storage for them.

To let you continue after refreshing the page, we save your progress and entered details in your browser's session storage. Files and consent declarations are excluded. A draft is restored only within 24 hours of its last save and removed after successful submission or when you start a new enquiry.

Email delivery and spam protection follow the procedures described for the contact form.

Contact and project details, along with the time and version of your form acknowledgement, are transferred to our CRM. Only the number of attached files is recorded there. The contact-enquiry retention periods apply to transmission and technical logs.

If you select a callback from Lyra, we record your separate consent and initiate the callback. Details appear in the next section.

Enquiries about a contract with you are processed under Art. 6(1)(b) GDPR. If you act for a company, processing is based on our legitimate interest in establishing and managing the business relationship (Art. 6(1)(f) GDPR). The local draft lets you continue the requested form (Section 25(2), no. 2 TDDDG).

If no order results, we delete the enquiry and associated files within 30 days after handling is completed. Necessary customer data are retained during the business relationship. Statutory retention duties and the protection of legal claims remain applicable.

If you request a Lyra callback in the project form and give separate consent, our AI assistant contacts you on the number provided to ask about your project. You will be speaking with an artificial intelligence.

We make up to three call attempts. The conversation is in your selected language: German, Turkish or, for other languages, English.

We process your telephone number, name, chosen language, project details and conversation contents. The service providers involved are listed in the recipient overview.

The call is transcribed, but no audio recording is stored. The AI provider keeps the transcript and call details for 30 days. Our team receives a summary and the information collected in our CRM.

We keep evidence of consent, including its version, time and a pseudonymised verification value of your telephone number, for five years. Call status, attempt times and technical reference records are deleted 90 days after completion.

If you ask not to receive further calls, we add your telephone number to a suppression list until the entry is removed in our CRM. The transmission service keeps only a pseudonymised verification value for this purpose. Processing is based on our legitimate interest in continuing to respect your request (Art. 6(1)(f) GDPR).

The callback is based on your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time for future processing during the call or via datenschutz@ases.app. You can end the call at any time.

Lyra is an AI assistant that answers questions about ASES and helps you prepare your enquiry. Use is optional; you can also contact us by email or telephone.

Opening the chat window first contacts our assistant server. A connection to our AI provider ElevenLabs is established only when you send a message or start a voice conversation.

We process your messages, chosen language and technical connection data. Previous messages may be shared as context when you resume a conversation or switch between text and voice.

Voice features process your audio data. You grant microphone access through your browser. Voice messages are sent to ElevenLabs for transcription; live conversations run directly through the provider.

When you send a file, its contents, name and technical information are transmitted to ElevenLabs and linked to the conversation. Please provide only information needed for your enquiry and do not send access credentials or particularly sensitive personal data.

Your browser keeps the last 50 completed messages and associated time and file information in session storage, excluding file and audio contents. “New conversation” deletes this local history; it does not delete data stored by the provider.

ElevenLabs stores chat messages, conversation transcripts and uploaded files for 90 days. Live conversations are not stored as audio recordings. Audio files from voice messages are subject to ElevenLabs' separate retention terms. Our assistant server's technical logs contain no message or file contents and are deleted after seven days.

Answering questions is based on our legitimate interest in accessible communication (Art. 6(1)(f) GDPR). Art. 6(1)(b) GDPR applies when preparing a contract with you. Local history lets you continue your chat (Section 25(2), no. 2 TDDDG). ElevenLabs processes data in the USA and through subprocessors; transfer safeguards are listed in the recipient overview.

Email

When you email us, we process your sender and contact details, message and attachments to handle your enquiry.

Our business mailboxes use Google Workspace. Email contents and connection data may also be processed outside the EU. Provider details and transfer safeguards appear in the recipient overview.

Phone

Calls to our telephone number are answered by Lyra, our AI telephone assistant. If you wish to speak to our team, you can ask Lyra for a personal callback or email us.

We process your transmitted telephone number and information shared during the call. No audio recording is stored. The AI provider creates a transcript and keeps it for 30 days. Our team receives a summary and a CRM entry for your enquiry.

We use ElevenLabs for AI assistance and Telnyx for the telephone connection. Telnyx also processes connection data, such as telephone numbers, call times and duration, as an independent telecommunications provider. Processing in the USA is possible.

WhatsApp

The WhatsApp link connects to WhatsApp only when opened. The provider for users in the European Economic Area is WhatsApp Ireland Limited.

When you contact our WhatsApp Business channels, we process your telephone number, profile name, messages and files. WhatsApp and other Meta companies also process connection and usage data as independent controllers.

WhatsApp's own privacy policy and service terms govern its processing, which may include transfers outside the European Economic Area. You can also contact us by email or telephone.

For initiating or performing a contract with you, Art. 6(1)(b) GDPR is the legal basis. We process general inquiries and communication with contact persons of companies on the basis of our legitimate interest in handling the respective request (Art. 6(1)(f) GDPR).

Enquiries that do not lead to an order, including related emails, WhatsApp messages and call notes, are deleted within 30 days after handling is completed. The general retention rules in this notice apply to customer documents, statutory duties and legal claims.

We store information in your browser to apply your chosen settings and let you continue activities you have started. The table below lists the website's cookies and storage entries, their purposes and retention periods.

Insofar as a storage entry is strictly necessary for a function you have explicitly requested, § 25(2) no. 2 TDDDG applies. Any associated processing of personal data is based in particular on our legitimate interest in providing the requested function (Art. 6(1)(f) GDPR). For other access to your device, your consent under § 25(1) TDDDG is required; the subsequent processing of personal data is then based on Art. 6(1)(a) GDPR.

You can delete stored entries at any time in your browser settings.

Images in our editorial content are delivered through Cloudflare. When an image is requested, Cloudflare processes your IP address and technical connection data. Image files are stored in the EU; delivery uses the provider's worldwide network.

The legal basis is our legitimate interest in delivering images quickly and reliably (Art. 6(1)(f) GDPR).

Our checking tools process the files, domains or website addresses you provide on our Hetzner server in Germany to produce the requested result.

Checks run in memory; inputs and files are not permanently stored. Depending on the tool, we retrieve public DNS records, the specified website and its metrics from the Google Chrome UX Report. Only the checked address is sent to Google. Technical logs contain a truncated IP address, but no checked addresses, file names or file contents, and are deleted after seven days.

The Website Check displays its report in your browser. We do not require an email address or send the report by email.

The legal basis is our legitimate interest in providing you with the tools you open and protecting them against misuse (Art. 6(1)(f) GDPR).

Our profiles on LinkedIn, Instagram, TikTok, and YouTube are accessible through ordinary links. Displaying a link does not transmit data to the network.

Opening a link takes you away from our website. The provider then processes data such as your IP address under its own privacy policy.

How long we keep data

We keep personal data only as long as necessary for the relevant purpose. Specific periods are stated with each service. Documents subject to statutory retention duties are kept longer: under Section 257 HGB and Section 147 AO, generally six years for business correspondence, eight for accounting vouchers and ten for books and annual accounts. Longer retention may be necessary to establish or defend legal claims. Data are deleted when these grounds no longer apply. Statutory retention is based on Art. 6(1)(c) GDPR; protecting legal claims is based on Art. 6(1)(f) GDPR.

Who receives data

The providers below support the operation of this website and our communications. Where they process data on our behalf, they do so under contracts complying with Art. 28 GDPR. A provider's independent processing purposes are explained in the relevant section. Within our company, access is limited to people handling the matter concerned.

Processing outside the European Economic Area

Some providers process data outside the European Economic Area, particularly in the USA. The safeguards listed in the table apply: an adequacy decision, including the EU-US Data Privacy Framework for certified US companies (Art. 45 GDPR), or European Commission standard contractual clauses (Art. 46(2)(c) GDPR). You can request information and a copy of the relevant safeguards via datenschutz@ases.app.

Subject to the statutory requirements, you have the following rights:

• Access to information on whether and which personal data we process about you, including a copy of this data (Art. 15 GDPR)
• Rectification of inaccurate and completion of incomplete personal data (Art. 16 GDPR)
• Erasure of your personal data, insofar as there are no legal grounds for further storage (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Receipt of the data you have provided in a structured, commonly used and machine-readable format and, where applicable, transmission to another controller, if the processing is based on consent or contract and is carried out by automated means (Art. 20 GDPR)
• Objection to the processing (Art. 21 GDPR)
• Withdrawal of your consent for the future. This does not affect the lawfulness of the processing carried out on the basis of the consent before its withdrawal (Art. 7(3) GDPR)

You can exercise your rights without a prescribed form via datenschutz@ases.app or at our postal address above. We normally respond within one month and will inform you if a legally permitted extension is necessary.

If you believe that the processing of your personal data violates data protection law, you can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for ASES is the State Commissioner for Data Protection and Freedom of Information of the Free Hanseatic City of Bremen: Georgstraße 122–124, 27570 Bremerhaven, Germany; email: office@datenschutz.bremen.de; website: www.datenschutz.bremen.de.

In particular, you can also contact the supervisory authority at your habitual residence, at your place of work or at the place of the alleged infringement.

Obligation to provide data

You do not have to provide any contact details to visit the website. Technical connection data is, however, required to retrieve the pages. Using our contact options is voluntary. Without the information required for the preferred contact channel, we may not be able to answer your request.

Automated decisions

We do not use any solely automated decision-making on this website that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR). Automated spam checks serve to protect the forms. You can reach us through the contact channels provided regardless.

Changes

We update this privacy policy when the website, our service providers or the legal situation change. The “Last updated” date at the top of the page shows the last change.