Privacy notice for the dataXtensa website

When the website is requested, the hosting and security services involved process technically necessary connection data. This may include the IP address, time, requested address, amount of data transferred, browser identifier, and response status. Processing supports secure delivery, error analysis, and protection against abusive access.

We use Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, to deliver and protect the website. As a service in front of our server, Cloudflare processes IP addresses and HTTP requests, including requested URLs, headers and submitted content; contact form details also pass through this service when submitted. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is an available website protected against attacks.

During a security check, Cloudflare may use the cf_clearance cookie to recognise a completed check. The configured validity of a completed check is 30 minutes; technical time allowances may apply. Where this device storage is necessary to protect the requested service, it is used under Section 25(2)(2) TDDDG. Security processing operates independently of your choices about optional measurement services.

Cloudflare may also process data outside the European Economic Area, in particular in the United States. Its data processing agreement describes the EU-US Data Privacy Framework and, for restricted transfers not covered by that framework, the EU Standard Contractual Clauses as transfer mechanisms.

Log data is retained only for as long as required for operations, security, and investigating specific incidents. It is retained beyond that period only where legal obligations or the establishment, exercise, or defense of legal claims require it.

When you switch the appearance, we store your choice as light or dark under the theme key in your browser's local storage. This preserves your preferred appearance for your next visit. The entry is used only on your device and is not sent to us or an external provider. It has no fixed expiry and remains until you choose again or clear the website's browser data; your browser may also remove it.

This storage serves only the appearance you have requested (Section 25(2)(2) TDDDG). To the extent that personal data is processed, the basis is Article 6(1)(f) GDPR; our legitimate interest is to retain your selected appearance. This choice does not control analytics or advertising services.

We process your details under Article 6(1)(f) GDPR. Our legitimate interest is to identify your inquiry, respond personally, and arrange a callback you have requested. Name, email address, and message are required form fields for this purpose; the form cannot be submitted without them. A phone number is optional unless you request a callback. Technical information needed for secure transmission is also processed. Consent to advertising is not required.

We use an email mailbox provided by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany, to send and handle your message. IONOS processes message contents, sender and recipient addresses, and technical delivery data on our behalf. The contact form sends the message from our server to the IONOS mail service over an encrypted connection.

To handle your inquiry, we send your name, email address, message, phone number if provided, callback preference, language, and an internal inquiry reference to HubSpot. Only if you have consented to optional HubSpot measurement, we add the current page address and title and, if available, the HubSpot visitor identifier (hubspotutk). HubSpot processes these details in our CRM as a processor on our behalf. Processing may also take place outside the European Economic Area; HubSpot describes safeguards for international transfers in its Data Processing Agreement.

The information is deleted once the inquiry has been completed and no statutory retention obligation or legitimate reason for further storage remains. Do not send credentials, special categories of personal data, or unnecessary third-party data with an initial inquiry.

The cookie settings let you allow or reject Google Tag Manager, Google Analytics 4, Google Ads and Microsoft Advertising separately. Google Analytics 4 and Google Ads also require your permission for Google Tag Manager. Each optional service loads only after you give the corresponding consent. The legal bases are Article 6(1)(a) GDPR and, for storing or accessing information on your device, Section 25(1) of the German TDDDG. You can use the website and contact us without this consent.

You can change your choices or withdraw consent for the future at any time through the cookie settings in the footer. After withdrawal, we send no further page, click or lead events to the measurement service you have deselected. Earlier lawful processing is unaffected. Withdrawal does not automatically erase data already held by a provider or all browser cookies; you can contact us to request access or erasure. The remaining technical Microsoft status request is explained below.

To attribute visits to campaigns, we use our own dx_attribution cookie after the relevant consent. It stores available UTM campaign information for the first and most recent visit, together with timestamps and consent information. Google click identifiers such as gclid are stored only with Google Ads consent; msclkid only with Microsoft consent. The cookie lasts 90 days from its latest write; further page visits while consent remains in place can renew that period. As a website cookie, it is also sent to our server and the security service in front of it. Withdrawal removes information that is no longer permitted; if no permitted content remains, the cookie is deleted. This storage occurs independently of whether contact conversions are enabled.

We use Usercentrics, provided by Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany, as a processor. It processes your choice for each service, the time, configuration version, a pseudonymous consent identifier and technical device information. Loading the service also involves connection data such as your IP address. Your choices are kept in your browser's local storage, and Usercentrics records decisions on its systems.

Managing and documenting consent fulfils our duty to demonstrate consent under Article 7(1) GDPR, based on Article 6(1)(c) GDPR. The device storage needed for this purpose is used under Section 25(2)(2) TDDDG. Usercentrics states that consent data is stored in the EU and retained for twelve months. Our configuration asks again after twelve months; a material change can prompt an earlier request.

For a request about your consent history, you can send us the “ID to request consent data” shown under Services in the banner. Usercentrics provides a history for that identifier covering the last twelve months. Managing consent is separate from using the optional measurement services.

With your consent, we use Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to analyse page views, clicks on selected buttons and successfully submitted contact inquiries. Google processes pseudonymous browser and session identifiers, device and browser information, timestamps and the page and click information we send. IP addresses are technically processed when connections are made; Google states that GA4 does not log or store them.

Our measurement events contain cleaned page addresses without query parameters or fragments and predefined button identifiers. After a successful contact inquiry, we also send a random inquiry identifier with form and language information. Form contents are not sent as measurement parameters. Automatic enhanced measurement, Google Signals, User-ID assignment and ad personalisation are not enabled for this integration. The account's enabled benchmarking feature uses aggregated and de-identified measurement data according to Google.

The GA4 account is set to retain event data for two months and user data for 14 months. New activity resets the user data retention period. These settings apply to the relevant user-level and event-level data; they do not limit retention of aggregated standard reports. The _ga and _ga_<identifier> cookies have a default lifetime of up to two years, which may be refreshed on return visits. Cookie lifetime and retention in the Analytics account are separate periods.

Google Tag Manager, provided by Google Ireland Limited, loads the Google services you allow. We load it only after you allow Google Tag Manager and at least one of Google Analytics 4 or Google Ads. Permission for GTM alone does not activate measurement. Withdrawing GTM permission also stops further measurement events for both Google services. This creates a connection to Google involving the necessary connection data. Consent for one Google service does not automatically allow the other service or Microsoft Advertising.

With your separate Google Ads consent, we measure server-confirmed contact inquiries as conversions to evaluate our advertising. Google receives the conversion target identifier, a random inquiry identifier to prevent duplicate counting, cleaned page information and consent status. Google also processes technical connection, device and browser data and pseudonymous identifiers. Remarketing audiences and ad personalisation are not enabled.

For enhanced conversions, after a successful contact inquiry and only with your Google Ads consent, we also send SHA-256 hashes of your email address and, if provided in international format, your optional phone number. These details are normalised and hashed in your browser before transmission. The hashes are pseudonymous personal data, not anonymous data. Google matches them against data from signed-in Google accounts to attribute ad interactions to an inquiry and improve conversion measurement. Unhashed contact details, names and messages are not sent for this purpose. Google Analytics 4 and Microsoft Advertising do not receive these hashes. You can withdraw consent at any time through the cookie settings; we then stop sending contact-detail hashes. Withdrawal does not retroactively delete data already sent to Google.

After consent, Google may use cookies with names such as _gcl_* on our domain and identifiers in local browser storage for ad attribution. Google states that conversion cookies last 90 days after an ad click. Attribution windows configured in the advertising account determine which ad interactions are credited for an inquiry; they are not complete data deletion periods.

With your separate consent, we use Universal Event Tracking (UET), provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. We record page views, selected button clicks and server-confirmed contact inquiries to evaluate our website and advertising. We send cleaned page information, predefined click identifiers, a random inquiry identifier after successful submission, and consent status. Microsoft also processes technical connection, device and browser data, including the IP address and pseudonymous identifiers. Form contents are not sent as event parameters.

Under its own advertising and privacy terms, Microsoft also processes UET data to provide, evaluate and improve its services. This is not exclusively processing on our behalf. We have not configured remarketing audiences, Clarity session recordings, UET Insights or enhanced conversions.

Microsoft states that UET data is retained for 390 days. The _uetsid cookie identifies a session and expires after one day; _uetvid supports pseudonymous recognition and has a lifetime of 390 days. Where a Microsoft click identifier is present, _uetmsclkid may store it for 90 days. These identifiers may also be held in local browser storage and refreshed on return visits. Microsoft may also use the MUID cookie on its own domain with a lifetime of up to 13 months.

After withdrawal, our page, click and lead events stop. A UET script that has already loaded still sends a technical request with the denied consent status. This may send the tag and SDK identifiers, consent metadata and connection data to Microsoft. The inspected status request also transmitted the website origin and referrer and could include an existing MUID cookie. This request signals your changed choice. It does not mean that every connection to Microsoft or all processing of previously received data ends after withdrawal.

Google and Microsoft may also process data within their corporate groups in the United States and other countries. Google relies on the EU-US Data Privacy Framework for transfers to covered certified US recipients; Microsoft also identifies this framework for covered transfers. For other applicable transfers, the providers' safeguards include EU standard contractual clauses. This integration does not guarantee processing exclusively in Europe. The linked provider terms explain these safeguards and how to request information; you can also use our privacy contact address.

We also use service providers for hosting, website security and email delivery. The measurement services described here are not given access to our contact mailbox. Consent management, optional measurement and handling your inquiry are separate purposes.

Within the applicable legal framework, data subjects can request access, rectification, erasure, restriction of processing, and data portability. Consent can be withdrawn at any time with future effect. You also have the right to lodge a complaint with a competent data protection authority. Use the public contact details of the responsible organization for privacy requests.

Where we process data based on legitimate interests, you may object at any time on grounds relating to your particular situation. We will then stop that processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.