1. Controller
The controller responsible for data processing on this website and within the platform is:
Andreas Heß
Eikholt 7
18059 Rostock
Germany
Telephone: +49 160 922 322 55
Email: data-protection@autonomytrack.eu
2. Subject Matter and Intended Users
This Privacy Notice applies to the website and SaaS platform Autonomy Track.
The platform is intended exclusively for business users and legal entities governed by private or public law, in particular businesses, associations, federations, foundations, public-law corporations, institutions and authorities. Use for private purposes is excluded.
Nevertheless, personal data relating to employees, contact persons or other natural persons may be processed in the course of use.
It also applies to enquiries and communications concerning our consulting, development, operations and training services.
3. Accessing the Website
When the website is accessed, technically necessary connection and log data are processed to the extent required to deliver the website and ensure stability, IT security and error analysis.
IP addresses are processed for technical transmission and, under the current configuration, are anonymised or truncated at the CDN and analytics levels.
The legal basis is Article 6(1)(f) GDPR.
Details of the service providers used can be found in section 11.
4. Account and Platform Use
4.1 Registration and Account Data
When an account is registered and used, we process the data required to create, administer and use it. This may include, in particular, a name, business email address, organisation, roles and permissions, password hash, and contract and billing information.
Processing is necessary for the performance of a contract or to take steps prior to entering into a contract, on the basis of Article 6(1)(b) GDPR.
4.2 Content within the Platform
Users may enter their own content in the platform, such as questionnaire answers, assessments, notes, actions, reports or organisation-related information.
The platform is designed for organisation-related assessments, documentation and actions, and is not intended for the targeted processing of personal data on behalf of third parties.
Third-party personal data are not permitted in substantive inputs and must be effectively anonymised beforehand. Any different processing on behalf of a customer requires a separate agreement.
For employees and contact persons of a customer organisation, account administration is based on Article 6(1)(f) GDPR. Our legitimate interest is the performance of the contract with the organisation.
5. Newsletter
If you subscribe to our newsletter, we process the data you provide in the subscription form, in particular your email address, to send you the newsletter.
Subscription uses a double opt-in process. We also process the time of subscription, the time of confirmation and other technically necessary evidence to document your subscription in a legally reliable manner.
We use Brevo to send the newsletter, provide the form and manage subscriptions. When the embedded newsletter form loads, technical connection data may be transmitted to Brevo or the infrastructure services involved.
The embedded newsletter form uses technical functions for secure delivery and protection against misuse. Where cookies or similar technologies are strictly necessary for this purpose, their use is based on section 25(2), no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG).
If you subscribe and give separate consent for this purpose, we also measure newsletter opens and clicks and attribute them to individual contacts. This helps us analyse and improve our newsletters.
The legal basis for sending the newsletter is Article 6(1)(a) GDPR. The legal basis for documenting the subscription is Article 6(1)(f) GDPR. Any personal open and click tracking is based on your separate consent.
Consent may be withdrawn at any time using the unsubscribe link in the newsletter or by contacting us.
6. Contact and Support
If you contact us, for example by email or another communication channel, we process the data provided to handle your enquiry, provide support and document the communication.
The legal basis is Article 6(1)(b) GDPR where the enquiry relates to an existing or prospective contractual relationship, and otherwise Article 6(1)(f) GDPR.
Support and communication data are generally retained until the standard statutory limitation period expires. Longer statutory retention obligations may apply to individual documents relevant under commercial or tax law.
We use AI services to support our services, communications and internal processes. Only information necessary for the relevant purpose is processed. Before use, available settings to exclude general model training are enabled. Processing by providers for security, operational and statutory purposes remains possible. The legal basis is Article 6(1)(b) GDPR or our legitimate interest in efficient and secure service delivery under Article 6(1)(f) GDPR. Where required, consent is obtained in advance.
You may object to processing based on legitimate interests under the conditions set out in Article 21 GDPR. Information on providers and possible transfers to third countries is provided in sections 11 and 12.
7. Audience Measurement
We use OpenPanel to measure reach and analyse the use of our website.
Audience measurement operates without cookies. In particular, page views, referrers, pages visited, technical attributes, outbound link clicks and comparable events are processed.
The legal basis is Article 6(1)(f) GDPR, insofar as audience measurement in its current form is permissible under data protection law without separate consent.
8. Cookies and Similar Technologies
Under the current configuration, we do not use non-essential cookies on the website for general website analytics or advertising.
Where cookies or similar technologies are used in connection with individual embedded functions, we describe this in the relevant sections of this Privacy Notice. At present, they serve exclusively to provide technical functionality, stability, security and protection against misuse.
Where storage or access is strictly necessary to provide a function expressly requested by the user, this is based on Article 6(1)(f) GDPR in conjunction with section 25(2) TDDDG.
Entries in the fillable guides on the website are not transmitted to us or stored permanently in the browser. The respective organisation is responsible for any copies it saves or prints.
9. Appointment Booking
Appointments can be booked through an external link to Cal.eu. A connection to the booking provider is established only when this link is opened.
Technical connection data, in particular the IP address, browser and device information, and other data required to provide appointment booking may be transmitted to the provider.
If you book an appointment, we process the data you provide to arrange it and communicate about it.
The legal basis is Article 6(1)(f) GDPR and, where the appointment is booked at your request, Article 6(1)(b) GDPR.
11. Recipients and Service Providers
In operating the website and platform, we use the following service providers in particular:
- Scaleway for hosting the app and technical infrastructure, transactional email and AI services,
- bunny.net as a CDN and for hosting the landing page,
- fonts.bunny.net for delivering the fonts used,
- OpenPanel for cookieless audience measurement,
- Brevo for newsletters and newsletter forms,
- Cal.eu for appointment booking,
- Soverin for business email,
- Anthropic, OpenAI and xAI for AI assistance.
Where these service providers process data on our behalf, we enter into agreements under Article 28 GDPR where legally required.
12. Transfers to Third Countries
When selecting services for our website and platform, we favour European providers and European data processing where possible.
Nevertheless, processing of personal data outside the European Union or the European Economic Area cannot be ruled out in all cases. This may apply in particular to social media platforms and, depending on the specific technical arrangements and subprocessors, to individual third-party services.
Where data are transferred to third countries, this is done in accordance with statutory requirements, in particular on the basis of adequacy decisions or appropriate safeguards such as standard contractual clauses.
13. Retention Periods
Personal data are retained only for as long as required for the respective purposes or to comply with statutory retention obligations.
- Account data are generally retained for the duration of the usage relationship.
- Content data are retained for the contract term and the necessary switching and retrieval periods under section 8 of the Terms and Conditions, and are then deleted unless statutory retention obligations apply.
- Newsletter data are retained until consent is withdrawn or the subscription is cancelled. Evidence of consent is retained beyond that period within the applicable statutory limitation periods.
- Support and communication data are generally retained until the standard statutory limitation period expires.
- Contractual, invoice and tax-related documents are retained for the applicable statutory retention periods.
- Where data are held only in anonymised form, these periods do not constitute retention periods for personal data under data protection law.
14. Data Subjects’ Rights
Subject to the statutory conditions, data subjects have, in particular, rights of access, rectification, erasure, restriction of processing, data portability and objection.
Consent may be withdrawn at any time with effect for the future.
There is also a right to lodge a complaint with a competent data protection supervisory authority.
You may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation. You may object to direct marketing at any time without giving reasons. No solely automated decision-making with legal or similarly significant effects takes place.
15. Requirement to Provide Data
Certain data are required to use the platform, perform a contract or handle an enquiry. Without these data, the relevant function may not be available.
16. Security
We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, unauthorised disclosure and unauthorised alteration.
17. Changes to This Privacy Notice
This Privacy Notice is updated when legal requirements, the platform or the services used change.
10. Social Media Profiles
We maintain profiles on LinkedIn, X, Bluesky and Mastodon.
These profiles are included on this website solely as external links. You are redirected to the relevant platform only when you click such a link. From that point onwards, the respective platform operator processes data as a controller in its own right.
When you visit our profiles, the platform operator may process usage data, device information, interaction data and, where applicable, profile data. Where platforms provide aggregated statistics or insights to us, this may give rise to separate or partially joint controllership.
For LinkedIn Page Insights, the supplementary joint controller agreement with LinkedIn applies.