Data privacy

Name and address of the controller

akeno GmbH
Willy-Brandt-Straße 59–65
20457 Hamburg, Germany
E-mail: contact@akeno.ai

Contact details of the data protection officer

Kertos GmbH
Brienner Str. 41
80333 München, Germany
E-Mail: dataprivacy(at)kertos.io

Rights of the data subject

The General Data Protection Regulation (GDPR) guarantees every data subject certain rights in relation to their personal data. These include:

• The right of access: every data subject has the right to obtain from us confirmation as to whether or not personal data concerning them are being processed, and access to those data, as well as further information and copies of those data.
• The right to rectification: Every data subject has the right to request the rectification of inaccurate personal data without undue delay.
• The right to erasure ("right to be forgotten"): Every data subject has the right to request the erasure of their personal data without undue delay.
• The right to restriction of processing: Every data subject has the right to request the restriction of the processing of their personal data.
• The right to data portability: Every data subject has the right to receive the personal data concerning them, which they have provided to us, in a structured, commonly used and machine-readable format.
• Right to object: Every data subject has the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1) GDPR. If we process personal data concerning the data subject for the purpose of direct marketing, the data subject may object to this processing pursuant to Art. 21(2) and (3) GDPR.
• Right to withdraw Consent to Data Processing: Every data subject has the right to withdraw their consent to the processing of personal data at any time.

The data subject also has the right to lodge a complaint with a supervisory authority if they consider that the processing of their personal data infringes the GDPR.

The supervisory authority responsible for us is: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit

General information on the legal basis for data processing

"Personal data" is all information that relates to a specific person. We process this data in accordance with the applicable data protection laws, in particular the GDPR and the BDSG. We may only process personal data if one of the following legal permissions applies:

Storage duration of personal data

We only store your data for as long as is necessary to achieve the purpose of the processing or to fulfill our contractual or legal obligations, unless otherwise stated in the following information. Statutory retention obligations may arise from commercial or tax regulations. After the end of the calendar year in which we collected the data, we will retain personal data contained in our accounting records for ten years and personal data contained in business letters and contracts for six years. Furthermore, we will retain data in connection with consents requiring proof as well as complaints and claims for the duration of the statutory limitation periods. Data stored for advertising purposes will be deleted if you object to processing for this purpose.

Collection of general data and information

Vercel

We use Vercel for hosting the website and for running the server functions behind our contact form and our job application form. These server functions are executed in Vercel's EU region (Frankfurt, Germany).

The legal basis for this processing is our legitimate interest pursuant to Art. 6(1)(f) GDPR.

Data may be transferred to Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Vercel Inc. is certified under the EU-U.S. Data Privacy Framework; in addition, standard contractual clauses pursuant to Art. 46(2)(c) GDPR apply.

The data usually comes from the data subject but may also come from third parties. Collected data includes IP address, log files, page views, and interaction data.

You can contact the data protection officer of Vercel Inc. at: privacy@vercel.com

Usercentrics

We use the consent management platform Usercentrics by Usercentrics GmbH, Sendlinger Straße 7, 80331 München, Germany, to obtain, store and document your consent to the use of cookies and similar technologies on our website.

The legal basis for this processing is our legal obligation to document consent pursuant to Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR.

The data usually comes directly from the data subject. Collected data includes the consent ID, date and time of consent, consent status per service, banner language, device and browser information, and an anonymized IP address. Your consent settings are stored in your browser.

The duration of data storage is subject to the general deadlines for data deletion; consent records are retained for as long as they are required as proof. You can change or withdraw your consent at any time via the cookie settings.

Contact form

If you contact us via the contact form on our website, we process the data you enter (name, company, business e-mail address and your message) as well as the page from which you sent the form and the time of sending, in order to handle your enquiry.

The form is processed by a server function (see "Vercel") and sent as an e-mail to our mailbox via Microsoft 365. Data may be transferred to Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, which acts as our processor.

The legal basis for this processing is Art. 6(1)(b) GDPR, where your enquiry relates to a contract or pre-contractual measures. Otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in responding to enquiries addressed to us.

The duration of data storage is subject to the general deadlines for data deletion. The data comes directly from the data subject.

Job applications

If you apply for a position via our website, we process the data you provide in the application form (in particular name, e-mail address, telephone number, place of residence, CV, cover letter and your answers to the questions asked for the respective position) in order to carry out the application process.

The application form transfers your data via a server function (see "Vercel") directly to our applicant tracking system Workable, provided by Workable Software Limited, which processes the data on our behalf as a processor. Data may be transferred to the United Kingdom, for which an adequacy decision of the European Commission exists. Further information can be found at https://www.workable.com/privacy

The legal basis for this processing is Art. 6(1)(b) GDPR (measures prior to entering into an employment relationship). Where we ask for your consent, for example to keep your application for future vacancies, the legal basis is Art. 6(1)(a) GDPR.

If your application is unsuccessful, we delete your data six months after the end of the application process, unless you have consented to a longer storage period. If you are hired, your data will be transferred to your personnel file.

The data comes directly from the data subject.

Google Tag Manager

The Google Tag Manager by Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland is used to simplify the management of analytical tools by centrally controlling and managing the collected analysis mechanisms. The processing of associated personal data is based on your consent according to Art. 6(1)(a) GDPR and § 25(1) TDDDG.

The duration of data storage is subject to the general deadlines for data deletion.

The data usually comes directly from the data subject. Possible categories of personal data include click behavior, anonymized IP addresses, referrer information, visited subpages, duration of stay on the website, frequency of visits, date, access location, and time of visit.

Information on opt-out can be found under cookie settings. The data protection officer of the provider can be contacted via https://support.google.com/policies/contact/general_privacy_form

For more information about Google's data processing practices, please visit https://business.safety.google/privacy/

Google Analytics

We process personal data of our website visitors for the purpose of creating usage profiles to optimize the cost-benefit factor on our website. The legal basis for this is consent according to Art. 6(1)(a) GDPR and § 25(1) TDDDG. If necessary, the data may be forwarded to Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland.

We have concluded a contract for order processing with the recipient to ensure that the personal data of our website visitors are processed only in accordance with our instructions.

The duration of data storage is determined by the general deadlines for data deletion.

The data usually come directly from the data subject.

The categories of personal data include click behavior, anonymized IP addresses, referrer information, visited subpages, duration of stay on the website, frequency of visits, date, access location and time of visit, as well as the user agent.

To opt out of this processing, a browser plugin can be installed, available at https://tools.google.com/dlpage/gaoptout

The data protection officer of the provider can be contacted via https://support.google.com/policies/contact/general_privacy_form. For more information about Google's data processing practices, please visit https://business.safety.google/privacy/

Google Ads Conversion Tracking

We use Google Ads Conversion Tracking. This service records what happens after a user clicks on an ad placed by us through Google Ads and then visits our website. Conversions measure whether users perform a specific, predefined action on the website after clicking on an ad served through Google Ads (e.g., ordering services). This allows us to determine which keywords, ads, ad groups, or campaigns lead to the desired user interaction.

The legal basis for this processing is your informed consent pursuant to Article 6(1)(a) GDPR.

Data generally comes from the data subject but may also originate from third parties. Collected data includes click behavior, anonymized IP addresses, referrers, visited subpages, time spent on the site, frequency of visits, date, access location, visit time, and user-agent.

You can contact Google's data protection officer at: https://support.google.com/policies/contact/general_privacy_form. For more information about Google's data processing practices, please visit https://business.safety.google/privacy/

Meta Pixel

Our website uses the Visitor Action Pixel from Meta for conversion tracking. This allows us to track the behavior of website visitors who arrive on our website by clicking on a Facebook advertisement. This enables us to analyze the effectiveness of Facebook advertisements for statistical and market research purposes and optimize them for future advertising campaigns. The legal basis for this processing is your consent according to Art. 6(1)(a) GDPR and § 25(1) TDDDG.

Please note that we, together with Meta Platforms Ireland Ltd., are jointly responsible for the collection and transmission of data to Facebook (Art. 26 GDPR). We emphasize that our responsibility concerns solely the collection and transmission of data, while further processing is carried out by Facebook. The agreement on joint processing can be viewed here: https://www.facebook.com/legal/controller_addendum

The data usually come from the data subject and may include browser information, accessed content, device information, geographical location, interactions with advertisements and products, IP address, pixel ID, referrer URL, usage data, user behavior, Facebook user ID, device operating system, device ID, HTTP headers, clicked elements, accessed pages, Facebook cookie information, page/click behavior, user agent, and browser type.

Further information can be found in Meta's privacy policy at https://www.facebook.com/privacy/policy. For any further questions, you can contact the provider's data protection officer via https://www.facebook.com/help/contact/540977946302970

Reddit Pixel

Our website uses the visitor action pixel from Reddit for conversion measurement. This enables the tracking of the behavior of website visitors who arrive on our website by clicking on a Reddit advertisement. This allows us to analyze the effectiveness of Reddit advertisements for statistical and market research purposes and optimize future advertising measures. The legal basis for this processing is your consent in accordance with Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

The data transfer may take place to the USA, whereby Reddit, Inc., 548 Market St, Ste 16093, San Francisco, CA 94104, relies on the EU-US Data Privacy Framework and applies the EU Commission's Standard Contractual Clauses.

The data generally originates from the data subject and may include browser information, accessed content, device information, geographic location, interactions with advertisements and products, IP address, pixel ID, referrer URL, usage data, user behavior, Facebook user ID, device operating system, device ID, HTTP headers, clicked elements, accessed pages, Reddit cookie information, page/click behavior, user agent, and browser type.

For further information, please refer to Reddit's privacy policy at https://www.reddit.com/policies/privacy-policy. If you have any additional questions, you can contact the provider's data protection officer at dpo@reddit.com.

Microsoft Clarity

Our website uses Clarity for optimization, analysis, and marketing. The processing of this data is based on your consent pursuant to Art. 6 (1)(a) GDPR.

Your data may be transferred to Microsoft Ireland Operations Limited, Attn: Data Protection Officer, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

The duration of data storage is determined by the general data deletion periods.

The data generally originates directly from the data subject. The categories of personal data include IP address, date and time of visit, unique user ID, session ID, user behavior, interaction data, mouse movements, clicks, and scrolling activity.

The provider's data protection officer can be contacted at clarityms@microsoft.com. Further information on data processing by Microsoft can be found here: https://clarity.microsoft.com/privacy

LinkedIn Insight Tag

Our website uses the LinkedIn Insight Tag for optimization, analysis, and marketing. The processing of this data is based on your consent pursuant to Art. 6 (1)(a) GDPR.

Your data may be transferred to LinkedIn Ireland Unlimited Company, Attn: Data Protection Officer, Wilton Place, Dublin 2, Ireland.

The duration of data storage is determined by the general data deletion periods.

The data generally originates directly from the data subject. The categories of personal data include IP address, date and time of visit, unique user ID, LinkedIn member ID (for logged-in members), URL, referrer URL, device and browser information, as well as interaction and event data.

The provider's data protection officer can be contacted via LinkedIn's Help Center. Further information on data processing by LinkedIn can be found here: https://www.linkedin.com/legal/privacy-policy

Cookies

The following cookies can be set on our website:

Business contacts and communication

We process personal data of prospects, customers, suppliers, service providers and other business partners as well as their contact persons in order to communicate with them, in particular by e-mail, and to initiate, manage and maintain business relationships. We store and organise this data in a CRM system. This includes handling enquiries, preparing offers, supporting existing customers and documenting communication and the status of our business relationships.

We process your master and contact data (e.g. name, company, position, business e-mail address and telephone number) as well as communication and contract data arising in the course of the business relationship.

As a rule, we receive this data from you directly. In some cases, we receive it from your employer or colleagues or from publicly available sources such as your company website or professional networks.

Legal basis: Art. 6(1)(b) GDPR, where you are our contractual partner or the processing is necessary for pre-contractual measures at your request. Otherwise Art. 6(1)(f) GDPR. Our legitimate interest lies in the efficient communication with and management of our business partners and in the documentation of our communication.

Recipients: We use service providers for e-mail, CRM and collaboration, who process the data on our behalf.

Company Presence on Social Media

We maintain a presence on social media platforms such as LinkedIn to communicate with prospective and existing customers and to provide information about our services. When you visit one of our social media profiles, the respective platform operator processes your personal data. We have no influence over this processing, which is carried out by the platform operators on their own responsibility.

In this context, we process the data you provide to us via the respective platform, for example when you interact with our content or contact us.

With regard to the processing of statistical usage data for our presence on LinkedIn (so-called page or usage statistics), we and the respective platform operator are joint controllers within the meaning of Art. 26 GDPR. Joint controllership pertains in particular to the collection and analysis of usage data for the purpose of compiling statistics, while the platform operator assumes primary responsibility for ensuring the rights of data subjects and fulfilling information obligations. You can find the key provisions of the respective joint controller agreements in the privacy policies of the respective platforms.

Legal basis for processing: Art. 6(1)(f) GDPR. Our legitimate interest lies in effective public relations and communication with prospective and existing customers.

Recipients

We may, if necessary, transfer your data to other recipients such as staffing agencies, recruitment service providers, job portals, and career networks, government agencies, public authorities, and similar recipients. This includes, for example, tax authorities, public prosecutors' offices, and courts, as well as auditors.

If the data transfers described constitute processing on behalf of a controller within the meaning of Article 28 of the GDPR, we ensure that such processing takes place exclusively on the basis of data processing agreements that meet the legal requirements of the GDPR. These agreements obligate the respective data processors, in particular, to process personal data exclusively in accordance with our instructions, to ensure a level of data protection appropriate to the risk, and to comply with data protection obligations, particularly with regard to assisting in the fulfillment of data subjects' rights.

If, on the other hand, certain data transfers take place within the framework of joint controllership pursuant to Article 26 of the GDPR, this is done on the basis of a joint controllership agreement. This agreement clearly defines, in particular, the respective roles and responsibilities with regard to compliance with data protection requirements, for example, which controller is responsible for which obligations in connection with the exercise of data subjects' rights or the fulfillment of information obligations. We will provide you with the key provisions of such agreements upon request.

Data Transfers to Third Countries

Some of the recipients of your personal data mentioned in the previous section are located in so-called third countries, where the level of data protection is not comparable to that in the EU. Third countries are all countries outside the European Economic Area. The European Economic Area includes all countries of the European Union as well as the countries of the so-called European Free Trade Association. These are Norway, Iceland, and Liechtenstein.

Data transfers to such countries may occur, for example, when we use service providers located in a third country. Transfers of personal data to third countries are based on an adequacy decision by the European Commission. If no adequacy decision by the European Commission exists for the respective third country, the transfer is based on appropriate safeguards within the meaning of Article 46(2) of the GDPR. Copies of these safeguards may be requested from the data controller.

In addition, some recipients of your personal data located in the United States may be certified under the EU-U.S. / Swiss-U.S. Data Privacy Framework ("DPF"). For such recipients, a limited adequacy decision applies to certain categories of data. To the extent that the data recipient's DPF certification is valid, the transfer of personal data is based on this adequacy decision.