Privacy Policy

This privacy policy applies to the website www.octonomy.ai in its German and English language versions. For our presences on social networks and for the job application portal, the supplementary notices provided in the respective places apply.

Personal data is processed when you visit our website. Which data this is and for what purpose it is processed is set out in the following sections. We use the terms in this policy as defined in Art. 4 GDPR.

Storing information on your device and accessing information already stored there takes place only with your consent pursuant to § 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG). This does not apply to information that is strictly necessary for the service you have expressly requested (§ 25(2) no. 2 TDDDG); this concerns the cookies marked as such in Section 6.

§ 25 TDDDG does not cover cookies alone. Some of the services listed in Section 6 also store information in your browser’s local storage. The same applies to this storage.

The subsequent processing of the data collected in this way is a separate processing operation. For the analytics and advertising services, it is based on your consent pursuant to Art. 6(1)(a) GDPR.

We use the consent management tool Real Cookie Banner. It shows you the services in use, obtains your consent and documents it. In doing so, it stores your selection, a timestamp, the page visited, the screen size and a checksum of your IP address. This information does not leave our server.

You may withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR). To do so, open the privacy settings via the link in the footer of any page. The lawfulness of processing carried out before the withdrawal remains unaffected.

Your decision in the consent banner is additionally transmitted as a signal to the Google services in use (Google Consent Mode). The signal controls whether these services may set cookies and to what extent they process data. If no consent has been given, the signal “denied” is transmitted.

When you visit our website, the server automatically collects the following data and stores it in log files: IP address of the requesting device, date and time of access, page accessed, volume of data transferred, notification of successful retrieval, browser type and version, operating system and the previously visited page.

The purpose is to deliver the website, ensure system security and investigate attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the stated purpose.

We delete the log files as soon as they are no longer required for the stated purposes. Where entries are needed to investigate an attack, we retain them until the investigation has been completed.

So that the website is delivered in the language you have chosen, we store your selection in a cookie that expires when the browser is closed. See the overview in Section 6 for details.

The website is operated on a server of Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, in Germany. Hetzner processes the data arising in this context as a processor pursuant to Art. 28 GDPR. Name resolution for our domain is carried out via Amazon Route 53, a service of Amazon Web Services EMEA SARL.

If you contact us via a form, by email or by telephone, we process the data you provide in order to respond to your enquiry. The legal basis is Art. 6(1)(b) GDPR where the enquiry is aimed at concluding a contract. In all other cases it is Art. 6(1)(f) GDPR; our legitimate interest lies in responding to your enquiry. We delete the data as soon as the enquiry has been conclusively dealt with and no statutory retention obligations prevent deletion.

Our forms, webinar registration and the provision of downloads run via HubSpot. HubSpot processes the data arising in this context as a processor on our behalf; the data is stored in the EU1 instance with servers located in Germany. According to the provider, usage and analytics data is additionally transferred to the United States; the basis is Art. 45 GDPR.

If you tick the box to receive our newsletter, we process your email address on the basis of your consent pursuant to Art. 6(1)(a) GDPR. You can unsubscribe from the newsletter at any time via the unsubscribe link in every message.

On our webinar page we embed the Contrast platform. When a recording is played, data is transmitted to the provider. The embedding only takes place after you have given your consent. See the overview in Section 6 for details.

The following overview lists all services embedded on this website. The services identified as requiring consent are only loaded after you have agreed in the consent banner.

The collection of event data on our website and its transmission to Meta take place under the joint controllership of us and Meta Platforms Ireland Limited pursuant to Art. 26 GDPR. The basis is the Controller Addendum, which forms part of the Meta Business Tools Terms.

Essential content of this arrangement: We are responsible for informing you about the joint processing pursuant to Art. 13 and 14 GDPR. Meta is responsible for fulfilling your rights under Art. 15 to 20 GDPR with regard to the data stored by Meta after transmission. The information on Meta pursuant to Art. 13(1)(a) and (b) GDPR, the legal bases on which Meta relies and the ways to exercise your rights vis-à-vis Meta can be found in Meta’s privacy policy at facebook.com/privacy/policy/. You may assert your rights directly against Meta. The Controller Addendum is available at facebook.com/legal/controller_addendum.

Joint controllership is limited to the collection and the transmission. The subsequent processing by Meta is carried out under Meta’s sole responsibility. The data transmitted comprises information from the HTTP header including browser and language settings, the event triggered and buttons you have clicked, as well as online identifiers including your IP address and, where available, identifiers assigned by Meta.

If you click on one of our ads in ChatGPT, OpenAI appends a click reference to the address of our website that is called up. The pixel stores this reference and a browser identifier in the cookies __oppref and __obref on your device and transmits to OpenAI the page accessed, the event triggered, the time, and technical information about your browser and device.

OpenAI processes this information as an independent controller and also uses it to optimise the delivery of ads. We do not use the “Automatic Advanced Matching” function, by which the pixel reads information from forms and transmits it in hashed form.

OpenAI is not certified under the EU-US Data Privacy Framework. The transfer to the United States is therefore based on the European Commission’s standard contractual clauses pursuant to Art. 46(2)(c) GDPR. You can request a copy of the safeguards using the contact details given in Section 1.

Clarity records your session and displays usage in heatmaps. In doing so, it captures mouse movements, scrolling and clicking behaviour and the page structure. According to the provider, entries in form fields and selections in drop-down menus are masked in every configuration and are not transmitted to Clarity.

According to the provider, recordings are available for 30 days; recordings marked as favourites, a sample and the heatmaps for up to nine months.

Both services assign the IP address from which our website is accessed to a company. The purpose is to approach companies that are interested in our offering.

Leadfeeder does not transmit the IP address alone. It also transmits the address and title of the page accessed, the previously visited page, an identifier assigned by Leadfeeder, the identifier of the Google Analytics cookie and the identifier of the HubSpot cookie. Your visit can thus be matched to an entry in our customer relationship management system. We therefore use Leadfeeder only with your consent.

We operate a Trust Center at trust.octonomy.ai. It runs on the Vanta platform and is linked from the home page. When you access it, the cookies set on the domain octonomy.ai are transmitted along with the request, because they apply to all subdomains.

Recipients of your data are the providers named in Section 6 and our service providers in the areas of hosting, IT operations, human resources administration, and tax and legal advice. Where these service providers act as processors on our behalf, this is done on the basis of contracts pursuant to Art. 28 GDPR.

Some recipients process data outside the European Union. The basis for the transfer differs by recipient:

The European Commission’s adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework only benefits those organisations that are actively listed in the participant register of the US Department of Commerce. We checked the register status shown in the table on 13 September 2026.

Where a transfer is based on the standard contractual clauses, you can request a copy of the safeguards using the contact details given in Section 1.

We store personal data only for as long as is necessary for the respective purpose. The lifetimes of the cookies used are stated in Section 6. We retain data from enquiries and contractual relationships for the duration of the statutory retention periods; pursuant to § 147 of the German Fiscal Code (AO) and § 257 of the German Commercial Code (HGB), these are six and ten years respectively. After that, we delete the data.

You have the following rights vis-à-vis us with regard to the personal data concerning you:

Access pursuant to Art. 15 GDPR
Rectification pursuant to Art. 16 GDPR
Erasure pursuant to Art. 17 GDPR
Restriction of processing pursuant to Art. 18 GDPR
Data portability pursuant to Art. 20 GDPR
Objection pursuant to Art. 21 GDPR
Withdrawal of consent given pursuant to Art. 7(3) GDPR

Right to object: Where we process your data on the basis of legitimate interests pursuant to Art. 6(1)(f) GDPR, you may object to the processing at any time on grounds relating to your particular situation.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia), Postfach 20 04 44, 40102 Düsseldorf, Germany

We do not make any decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR).

Use of our website does not require you to provide personal data, provided you do not consent to the services requiring consent. To process an enquiry or conclude a contract, we need the data marked as mandatory in the respective form. Without this information, we cannot process the enquiry.

We take technical and organisational measures pursuant to Art. 32 GDPR to protect your data against loss and unauthorised access. Transmission between your browser and our server is encrypted throughout (TLS).

We adapt this privacy policy whenever the processing changes. The version available on this page applies in each case. The date stated at the top indicates the current version.