Privacy Policy

1. Controller

Simpanion Technologies UG (haftungsbeschränkt), Ginsterweg 17, 96114 Hirschaid, Germany (“we”).
Email: contact@simpanion.ai

No data protection officer has been appointed, as there is no legal obligation to do so (§ 38 BDSG, Art. 37 GDPR).

2. Scope

This policy covers the website www.simpanion.ai (including its product and blog pages) and connect.simpanion.ai, our contact page for trade fairs and events. The training platform at app.simpanion.ai has its own privacy notice, because there we mostly act as a processor on behalf of our customers.

3. Hosting and server log files

This website is hosted on servers we operate at Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg (“AWS”), in the Frankfurt region (eu-central-1). A data processing agreement pursuant to Art. 28 GDPR is in place with AWS (AWS GDPR Data Processing Addendum).

When you visit the website, our web server automatically processes technical access data: IP address, date and time of access, requested resource, HTTP status code, volume of data transferred, referrer URL, and browser/operating system information (user agent). This data is technically required to deliver the website and additionally serves stability and security (e.g. defence against attacks and abuse).

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in secure and stable operation). Log files are deleted after 14 days and are not merged with other data. Transmission is TLS-encrypted.

4. No analytics or marketing cookies

This website sets no analytics, tracking or marketing cookies and embeds no such third-party services. Fonts are served locally from our own server (no requests to Google Fonts or other font services). Social media profiles are linked only; no social media plugins are embedded that would transfer data to third parties when a page loads.

5. Contacting us

Contact form (“Book a demo”). When you use the contact form, we process the data you enter (name, email address, message content) and the page you sent the form from, in order to handle and answer your enquiry. Your entries are transmitted to our server TLS-encrypted and delivered from there as an email via Amazon SES to the mailboxes of our managing directors at Amazon WorkMail (both AWS, Ireland region, eu-west-1). Nothing is stored in a database or CRM system and nothing is passed to third parties; your enquiry exists solely as an email in our mailboxes.

To protect the form against abuse, our server automatically checks each submission for spam characteristics and limits the number of submissions per IP address. For this purpose your IP address is processed solely in the server’s memory and for no longer than one hour; it is neither stored, nor linked to your enquiry, nor included in the email.

Information by email (connect.simpanion.ai). On connect.simpanion.ai you can request information about Simpanion by email. For this we process your email address and the language you chose. Our server then sends you an email with information about Simpanion via Amazon SES and notifies our managing directors of your request by email (Amazon WorkMail; both AWS, Ireland region, eu-west-1). Nothing is stored in a database or CRM system and nothing is passed to third parties. So that the same address is not written to more than once, the server keeps a cryptographic hash of your address in memory for no longer than 24 hours; it limits the number of requests per IP address as for the contact form (IP address in memory only, for no longer than one hour).

By sending, you also consent to us contacting you by email about our offering; the wording is shown directly below the “Send” button. You can withdraw this consent at any time with effect for the future, for example by replying to our email or by writing to contact@simpanion.ai. The legal basis for sending the requested information is Art. 6 (1) (b) GDPR, for further emails your consent under Art. 6 (1) (a) GDPR in conjunction with § 7 (2) no. 2 UWG, and for abuse protection Art. 6 (1) (f) GDPR. We keep your address and our notification until you withdraw your consent, at most twelve months after the last contact, unless a contractual relationship comes about.

Booking a meeting and LinkedIn. The “Pick a time” button on connect.simpanion.ai opens a Microsoft Bookings page run through the Microsoft 365 account of our managing director Maximilian Wald (provider: Microsoft Ireland Operations Limited, Dublin, Ireland). No data is transferred until you open that page. We process the details you enter there (e.g. name, email address, preferred time) solely to arrange and hold the meeting (Art. 6 (1) (b) GDPR); Microsoft’s privacy statement applies in addition. Microsoft may transfer data to third countries, in particular the USA; Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework. The link to our LinkedIn page is a plain link: no data reaches LinkedIn until you click it.

Email. If you contact us directly by email (e.g. at contact@simpanion.ai), we likewise process the data you provide to handle your enquiry. Our mailboxes run on AWS (Amazon WorkMail/SES) in the Ireland region (eu-west-1).

Legal basis: Art. 6 (1) (b) GDPR where the enquiry is directed at concluding or performing a contract (such as a demo request), otherwise Art. 6 (1) (f) GDPR (interest in answering enquiries and in protecting the form against abuse). We delete enquiries once their handling is complete, as a rule no later than twelve months after the last contact, unless a contractual relationship comes about or statutory retention duties (e.g. § 257 HGB, § 147 AO) require otherwise.

6. Recipients and third-country transfers

The recipient of personal data is the hosting provider AWS named above, acting as our processor. Processing takes place in data centres within the EU (Frankfurt, Ireland). Insofar as data could exceptionally reach third countries (e.g. support or maintenance access by the US parent company), this is safeguarded by the EU Standard Contractual Clauses and AWS’s certification under the EU-U.S. Data Privacy Framework.

7. Your rights

You have the following rights against us:

• access to the data processed (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdrawal of any consent with effect for the future (Art. 7 (3) GDPR).

Right to object (Art. 21 GDPR): where we process data on the basis of Art. 6 (1) (f) GDPR, you may object at any time on grounds relating to your particular situation.

An informal message to contact@simpanion.ai suffices. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular the one competent for our registered seat: the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.

8. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place on this website.

9. Obligation to provide data

You are under no statutory or contractual obligation to provide personal data. Without the technical data described in section 3, however, the website cannot be delivered, without a name, email address and message we cannot answer an enquiry sent through the contact form, and without an email address we cannot send you information by email.

10. Changes to this policy

We update this privacy policy when the website or the legal situation changes. The version published here applies.