Privacy Policy

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

• Viktor Hermann — Appiq-Solutions
• Oerlinghausen, Germany
• Email: [email protected]
• Phone: +49 175 9918357

We process personal data only to the extent necessary to provide a functional website and our content and services. Processing generally takes place only with the consent of the data subject or where a legal basis permits the processing.

Legal bases (Art. 6 (1) GDPR)

• lit. a — consent: e.g. for non-essential cookies, analytics and newsletter.
• lit. b — contract / pre-contractual measures: e.g. handling inquiries and preparing proposals.
• lit. f — legitimate interest: e.g. secure and stable operation of the website.

Our website is hosted by Vercel Inc. (340 S Lemon Ave #4133, Walnut, CA 91789, USA). When you access the site, technically necessary data (including IP address, date and time, page accessed, browser type, operating system, referrer) is processed to ensure delivery and security of the website.

• Purpose: delivery, stability and security of the website.
• Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in secure operation).
• Transfer to third countries: to the USA on the basis of the EU Standard Contractual Clauses (Art. 46 GDPR) and the EU-U.S. Data Privacy Framework.

You can contact us via the contact form and the price/project calculator. We process the data you provide (including name, email address, company if applicable, subject and message or project details).

• Purpose: handling the inquiry, preparing proposals, and follow-up as part of initiating a business relationship.
• Legal basis: Art. 6 (1) lit. b GDPR (pre-contractual measures) or lit. f GDPR (legitimate interest in handling inquiries).
• Disclosure: form data is transmitted server-side to our CRM system (Appiq-CRM, hosted on Vercel) and processed there.
• Retention: inquiry data is deleted once it is no longer required. Price calculator data is stored for sales follow-up for up to 24 months.

For our newsletter we use the double opt-in procedure: after signing up, you receive an email asking you to confirm the subscription. This ensures that only the authorized owner of an email address can subscribe.

• Data processed: email address and the time of sign-up and confirmation.
• Legal basis: Art. 6 (1) lit. a GDPR (consent).
• Processing: management and dispatch take place via our CRM system (Appiq-CRM) using SMTP.
• Withdrawal: you can unsubscribe at any time via the unsubscribe link in every email or by contacting us. The lawfulness of processing up to withdrawal remains unaffected.

To send transactional and business emails, we use Google Workspace (SMTP) and, additionally, Resend as a delivery service. The data required for delivery (email address, content) is processed in the course of this.

• Legal basis: Art. 6 (1) lit. b or lit. f GDPR.
• Data processing: data processing agreements pursuant to Art. 28 GDPR are in place with the service providers used.

We use cookies and comparable technologies. Necessary cookies are required for the operation of the website and are set without consent on the basis of § 25 (2) TDDDG. All non-essential cookies (analytics, marketing, functional) are only set after your active consent via our cookie banner (§ 25 (1) TDDDG, Art. 6 (1) lit. a GDPR).

Categories

• Necessary: session management, security, storing your cookie choice.
• Analytics: reach measurement and improvement of our offering (see section 8).
• Marketing: only with explicit consent; currently not actively set.
• Functional: convenience features and personalization.

To analyze usage behavior, we use Google Analytics 4 (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland). Google Analytics is loaded only after your consent. We use Google Consent Mode: without consent, no analytics cookies are set and no analytics data is transmitted to Google.

• Data processed: truncated IP address, device/browser data, page views, interactions, approximate location.
• Legal basis: Art. 6 (1) lit. a GDPR (consent).
• Transfer to third countries: to the USA on the basis of the EU Standard Contractual Clauses and the EU-U.S. Data Privacy Framework.
• Withdrawal: at any time via the cookie settings.

In addition, we use Vercel Analytics and Vercel Speed Insights for anonymized reach and performance measurement. These services do not use cookies and do not create personal profiles; the legal basis is Art. 6 (1) lit. f GDPR.

To arrange initial calls, we link to Calendly (Calendly LLC, USA). If you book an appointment, Calendly processes the data you provide (including name, email, preferred time) under its own responsibility.

• Legal basis: Art. 6 (1) lit. b or lit. f GDPR.
• Calendly privacy policy: calendly.com/privacy

We offer contact options via WhatsApp as well as links to our profiles on LinkedIn, GitHub, Instagram and TikTok. If you use these services, the privacy policies of the respective provider apply. With WhatsApp, your phone number and message content are processed by the provider (Meta).

• Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in straightforward communication) or lit. a upon active use.

As part of our services and internal operations, we use AI-supported systems, including the Appiq Cognitive Engine (ACE) and large language model services (e.g. from Anthropic and OpenAI). These systems assist with development, analysis and communication.

Transparency and legal framework

• We make no solely automated decisions with legal effect or similarly significant impact within the meaning of Art. 22 GDPR. All business-relevant decisions are subject to human oversight.
• Personal data from inquiries is not used to train AI models without a separate legal basis.
• When using AI services, we use, where available, options with zero data retention or without training use, and conclude the necessary data processing agreements.
• We align ourselves with the transparency and governance requirements of the EU AI Act (Regulation (EU) 2024/1689) and label AI-generated content where required.

Your data is only transmitted to carefully selected service providers with whom data processing agreements pursuant to Art. 28 GDPR are in place. These include in particular:

• Vercel Inc. — hosting, analytics, CRM infrastructure (USA)
• Google Ireland Ltd. — Google Analytics 4, Google Workspace (EU/USA)
• Resend — email delivery
• Calendly LLC — appointment booking (USA)

You have the following rights regarding your personal data:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interest (Art. 21 GDPR)
• Withdrawal of consent given, with effect for the future (Art. 7 (3) GDPR)

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

• State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW)
• Kavalleriestraße 2–4, 40213 Düsseldorf, Germany
• ldi.nrw.de

This privacy policy is currently valid. As our website develops further or due to changed legal or regulatory requirements, it may become necessary to amend this privacy policy. The current version is always available on this page.

If you request a free project risk analysis via /risk-analysis, we process your details to handle that request. The legal basis is Art. 6 (1) (b) GDPR as a pre-contractual measure at your request.

Categories of data processed

Contact data, project description, and optionally the repository URL and uploaded material, which may contain source code, trade secrets, and third-party personal data.

Recipients

In addition to the processors listed in section 12, the following are used for the risk analysis:

• Neon — database hosting (EU region)
• Vercel Blob — file and object storage
• Resend — email delivery of the report
• [INSERT LLM PROVIDER NAMES — to be confirmed by Viktor] — if your material reaches external AI models as part of the AI-assisted analysis (ACE)

Retention period

We delete uploaded material and repository clones 30 days after the report is delivered, unless a paid engagement follows. We keep the report and lead data for 6 months and then delete them; the retention obligations under §257 HGB/§147 AO (German commercial and tax code) only apply once an invoice exists. Deletion on request is possible at any time by email.

On request, we offer a non-disclosure agreement (NDA) in advance, which we sign the same day.