Privacy Policy

This Privacy Policy explains how iiterate Technologies GmbH (iiterate, we, us) processes personal data when you visit www.iiterate.de (the Website), and how we comply with the EU General Data Protection Regulation (GDPR) and applicable German data protection law. The Website is primarily an informational presence. We keep data collection to a minimum, and we do not sell personal data.

1. Controller#

The controller responsible for the processing of personal data on this Website is:

iiterate Technologies GmbH

Mittelbachstraße 66, 53518 Adenau, Germany

Managing Director: Aashwin Shrivastava

Email: [email protected]

Phone: +49 (0) 176 74709826

Commercial register: HRB 28958, Local Court of Koblenz

VAT ID: DE354188637

Full company information is set out in our Impressum.

2. Data Protection Officer#

We are not required to appoint a Data Protection Officer under Art. 37 GDPR and § 38 BDSG. For any questions regarding data protection, please contact us at [email protected].

3. Visiting the Website (server log data)#

When you access the Website, technical data is processed automatically to enable the secure and stable delivery of the site. This may include your IP address, the date and time of the request, the browser type and operating system, the referring page, and the pages you access. The legal basis is our legitimate interest in providing a functional and secure website (Art. 6(1)(f) GDPR). Hosting is provided by Contabo GmbH, Aschheim, Germany, on servers located in Germany (European Union), which processes this data on our behalf under a data processing agreement pursuant to Art. 28 GDPR as part of delivering the Website. Server log data including the IP address is stored on our server and is automatically deleted after no more than seven days. This data is not combined with other sources and is not evaluated for analytics purposes.

The Website is delivered through the content delivery network and security service of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare acts as our processor under Art. 28 GDPR and terminates the encrypted connection, so it processes your IP address, the request metadata described above, and technical security signals. If Cloudflare shows a security check to protect against attacks, a strictly necessary cookie (cf_clearance) is set once the check is passed, so that it is not repeated on every request; this is exempt from consent under § 25(2) no. 2 TDDDG (see Section 5). The purpose is the secure, available and performant delivery of the Website, including protection against denial-of-service and other attacks; the legal basis is our legitimate interest under Art. 6(1)(f) GDPR. Cloudflare serves the Website from the network location closest to you, so this processing may take place on servers outside the European Union, including in third countries. Such transfers are safeguarded by the EU Standard Contractual Clauses agreed with Cloudflare; Cloudflare is additionally certified under the EU-US Data Privacy Framework. The retention period for the connection and security data arising at Cloudflare is determined by Cloudflare as processor under its own deletion rules; Cloudflare does not publish a fixed number of days for this. The data is processed solely to deliver the Website and to detect and mitigate attacks, and is kept only as long as necessary for that. Details are set out in Cloudflare’s privacy policy: cloudflare.com/privacypolicy

4. Contacting us#

If you contact us through a contact form or by email, we process the data you provide (for example your name, email address, and the content of your message) in order to handle and respond to your request. The legal basis is Art. 6(1)(b) GDPR where your request relates to pre-contractual steps or an existing contract, and otherwise our legitimate interest in responding to inquiries (Art. 6(1)(f) GDPR). We delete this data once it is no longer required and no statutory retention period applies. Enquiries sent through the contact form are additionally stored on our server for no more than 30 days, so that an enquiry is not lost if email delivery fails; they are deleted automatically thereafter.

5. Cookies, consent and audience measurement#

Necessary storage. Two values are kept locally in your browser and are never transmitted to us: your chosen display theme (light or dark) and your decision about audience measurement. Both are required to deliver the Website as you have set it and to respect your choice, and are therefore exempt from consent under § 25(2) no. 2 TDDDG. They are not cookies but entries in local storage.

Google Analytics 4. This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland („Google“). Google processes this data as our processor under Google’s Data Processing Terms, in accordance with Art. 28 GDPR.

Purpose. We use Google Analytics solely to measure reach and to analyse how our website is used. We do not use it for profiling, advertising or remarketing.

Legal basis. Processing takes place solely on the basis of your consent under Art. 6(1)(a) GDPR. Storing information on your device and accessing information already stored there take place on the basis of your consent under § 25(1) TDDDG.

Nothing is sent before you consent. Without your consent, no Google Analytics scripts are loaded, no cookies are set, and no data is transmitted to Google. Processing begins only after you actively agree.

Withdrawing consent. You can withdraw your consent at any time with effect for the future. You can change your choice here at any time: Open cookie settings. Independently of this, you can prevent collection by Google Analytics across your whole browser using the add-on Google provides: tools.google.com/dlpage/gaoptout

IP addresses. Google Analytics 4 does not store IP addresses. Your IP address is used only transiently to derive an approximate location and is then discarded. For visitors from the EU, this happens on servers within the EU.

What we deliberately do not use.

• Google signals is disabled. There is no cross-device tracking and no collection of demographic or interest characteristics.
• Sharing data with Google for Google’s own purposes is disabled.
• Ads personalization is disabled for the entire European Economic Area.
• No statistical modelling is applied to visitors who did not consent. Our reports are based solely on data actually observed.

Retention. Analytics data is deleted automatically after 14 months. The period runs from collection and is not extended by return visits.

Cookies and local storage in use.

The two Google cookies are set only after you consent. If you withdraw your consent using the link above, they are deleted.

Embedded YouTube videos continue to load only when you actively click to load them.

6. Recipients of your data#

We share personal data only with service providers that help us operate the Website and handle enquiries — our hosting provider Contabo GmbH, Germany, our content delivery and security provider Cloudflare (see Section 3), and our email provider Google Workspace, operated by Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland — and only to the extent necessary for that purpose. Enquiries sent through the contact form and emails to us are received and processed in our Google Workspace mailbox; Google processes this data as our processor under Google’s Cloud Data Processing Addendum pursuant to Art. 28 GDPR. One page embeds a video from YouTube (operated by Google Ireland Limited). That video is not loaded automatically: it is replaced by a placeholder, and only when you click to load it does your browser connect to YouTube/Google servers, which may then receive your IP address and store information on your device. By clicking you consent to that transfer (Art. 6(1)(a) GDPR and § 25(1) TDDDG); you can withhold it simply by not clicking. If you consent to audience measurement (see Section 5), Google Ireland Limited receives the resulting usage data and processes it on our behalf under a data processing agreement pursuant to Art. 28 GDPR. We do not sell personal data and do not pass it on for unrelated purposes.

7. International data transfers#

Hosting and the storage of the Website's content take place within the European Union, on servers in Germany. Four forms of processing can nevertheless reach a third country. First, our content delivery and security provider Cloudflare serves the Website from the network location closest to the visitor, which may be outside the EU (see Section 3); this is safeguarded by the EU Standard Contractual Clauses. Second, a transfer to Google occurs if — and only if — you click to load the embedded YouTube video (see Section 6); this is covered by Google's certification under the EU-US Data Privacy Framework and by standard contractual clauses. Third, if — and only if — you have consented to audience measurement (see Section 5), data may be transferred to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, as sub-processor. The transfer is based on the European Commission’s Standard Contractual Clauses (Implementing Decision (EU) 2021/914) pursuant to Art. 46(2)(c) GDPR, which form part of Google’s Data Processing Terms. Google LLC is additionally certified under the EU-US Data Privacy Framework (European Commission adequacy decision pursuant to Art. 45 GDPR). We note that despite these safeguards, access by US authorities to the transmitted data cannot be entirely excluded. If you withdraw your consent, that transfer ends for the future. Fourth, enquiries sent through the contact form and emails to us are received in our Google Workspace mailbox (see Section 6), and Google may process that data on servers outside the EU. Such transfers are based on the EU Standard Contractual Clauses, which form part of Google’s data processing terms.

8. How long we keep your data#

We process personal data only for as long as necessary for the purposes described in this Policy, or for as long as required by statutory retention obligations (for example under German commercial and tax law). Once the purpose no longer applies and no retention obligation remains, the data is deleted.

The following periods apply in detail:

• Server log data including the IP address: no more than 7 days (Section 3).
• Connection and security data at Cloudflare: under Cloudflare’s own deletion rules as processor (Section 3).
• Analytics data from Google Analytics: 14 months from collection, not extended by return visits (Section 5).
• Enquiries via the contact form or by email: until your request has been dealt with conclusively, unless a statutory retention period applies (Section 4).
• Enquiries submitted through the contact form, stored on our server: no more than 30 days (Section 4).

9. Security#

The Website is provided over an encrypted connection (HTTPS/TLS) to protect data in transit between your browser and the Website.

10. Your rights#

Subject to the conditions of the GDPR, you have the right to access your data (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). Where processing is based on your consent, you may withdraw that consent at any time with effect for the future (Art. 7(3) GDPR). To exercise any of these rights, please contact us at [email protected].

11. Right to lodge a complaint#

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz

Hintere Bleiche 34, 55116 Mainz, Germany

12. Obligation to provide data#

You are generally not legally or contractually obliged to provide personal data to us. However, certain functions, such as contacting us, require the data necessary to carry them out. If you choose not to provide it, we may be unable to respond to your request.

13. Changes to this Policy#

We may update this Privacy Policy to reflect changes to the Website or to legal requirements. The version that applies is the one published here, as indicated by the date shown at the top of this page.