With the following privacy policy, we would like to inform you which types of your personal data (hereinafter also referred to simply as âdataâ) we process, for which purposes, and to what extent. This privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and, in particular, on our websites, in mobile applications, and within external online presences, such as our social media profiles (collectively referred to as the âonline offeringâ).
The terms used are not gender-specific.
Status: 9 September 2025
Thomas John
Zum Breitfeld 71a
51503 Rösrath
Email: mail@ki-navigator.ai
Imprint: https://ki-navigator.ai/impressum
The following overview summarizes the types of data processed and the purposes for which they are processed and refers to the categories of data subjects.
Legal bases under the GDPR: Below is an overview of the legal bases of the GDPR on which we process personal data. Please note that in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence or seat. If more specific legal bases are applicable in individual cases, we will inform you of these in the privacy policy.
National data protection regulations in Germany: In addition to the GDPR, national data protection regulations apply in Germany, in particular the Federal Data Protection Act (Bundesdatenschutzgesetz â BDSG). The BDSG contains, inter alia, specific provisions regarding the right of access, the right to erasure, the right to object, processing of special categories of personal data, processing for other purposes and transmission as well as automated individual decision-making including profiling. State data protection laws may also apply.
Note on applicability of the GDPR and the Swiss FADP: These privacy notices serve to provide information both under the Swiss Federal Act on Data Protection (FADP) and the GDPR. For broader applicability and readability, the terms of the GDPR are used (e.g., âprocessingâ of âpersonal dataâ, âlegitimate interestâ, âspecial categories of dataâ). The legal meaning of the terms under the FADP remains determined by the FADP.
We take appropriate technical and organizational measures in accordance with legal requirements, taking into account the state of the art, implementation costs, and the nature, scope, context and purposes of processing as well as the varying likelihood and severity of risks to the rights and freedoms of natural persons, in order to ensure a level of security appropriate to the risk.
Measures include, in particular, safeguarding the confidentiality, integrity, and availability of data by controlling physical and electronic access to the data as well as access, input, transfer, ensuring availability, and separation of the data. Furthermore, we have established procedures that ensure the exercise of data subject rights, deletion of data, and responses to data threats. We also take the protection of personal data into account during the development or selection of hardware, software, and procedures in accordance with the principle of data protection by design and by default.
Securing online connections via TLS/SSL encryption technology (HTTPS): To protect usersâ data transmitted via our online services from unauthorized access, we use TLS/SSL encryption technology. SSL and TLS are the cornerstones of secure data transmission on the internet. These technologies encrypt information transmitted between the website or app and the userâs browser (or between two servers), thereby protecting the data from unauthorized access. TLS, as the more advanced and secure version of SSL, ensures that all data transmissions meet the highest security standards. When a website is secured by an SSL/TLS certificate, this is indicated by âHTTPSâ in the URL.
In the course of processing personal data, it may happen that data is transmitted to other entities, companies, legally independent organizational units or persons, or disclosed to them. Recipients may include, for example, IT service providers or providers of services and content integrated into a website. In such cases, we comply with legal requirements and, in particular, conclude contracts or agreements with the recipients that serve to protect your data.
Processing of data in third countries: If we transfer data to a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA)) or this occurs in the context of using third-party services or disclosing/transmitting data to other persons, bodies, or companies (which can be recognized, for example, by the providerâs postal address or if this privacy policy explicitly refers to third-country transfers), this is always done in accordance with legal requirements.
For data transfers to the USA, we primarily rely on the Data Privacy Framework (DPF), which was recognized by an adequacy decision of the EU Commission on 10 July 2023. In addition, we have concluded Standard Contractual Clauses with the respective providers.
This dual safeguard ensures comprehensive protection of your data: The DPF forms the primary level of protection, while the Standard Contractual Clauses serve as an additional layer. Should changes occur with respect to the DPF, the Standard Contractual Clauses act as a fallback. Thus, your data remains adequately protected even in the event of political or legal changes.
For each service provider, we inform you whether they are certified under the DPF and whether Standard Contractual Clauses are in place. Further information on the DPF and a list of certified companies can be found at https://www.dataprivacyframework.gov/.
For transfers to other third countries, corresponding safeguards apply, in particular Standard Contractual Clauses, explicit consents, or legally required transfers. Information on third-country transfers and adequacy decisions is available from the European Commission: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en?prefLang=de.
We delete personal data processed by us in accordance with legal requirements as soon as the underlying consents are revoked or there are no other legal bases for processing. This applies in cases where the original purpose no longer applies or the data is no longer needed. Exceptions exist where statutory obligations or particular interests require longer retention or archiving.
In particular, data that must be retained for commercial or tax law reasons, or whose storage is necessary for legal prosecution or the protection of the rights of other natural or legal persons, must be archived accordingly.
Our privacy notices contain additional information on retention and deletion that specifically apply to certain processing operations.
Where multiple retention periods are specified, the longest period is decisive. Data that is no longer required for the original purpose but is retained due to legal requirements or other reasons will be processed solely for the reasons justifying their retention.
Retention and deletion of data: The following general periods apply under German law:
Commencement of periods at year-end: If a period does not explicitly begin on a specific date and is at least one year, it starts at the end of the calendar year in which the triggering event occurred. For ongoing contractual relationships, the triggering event is termination or other ending of the relationship.
Rights under the GDPR: As a data subject, you have various rights pursuant to Articles 15 to 21 GDPR, including:
We process usersâ data in order to provide our online services. For this purpose, we process usersâ IP addresses, which are necessary to transmit the content and functions of our online services to the userâs browser or device.
Further notes on processes, procedures and services:
âCookiesâ refers to functions that store and read information on usersâ devices. Cookies may serve different purposes, such as functionality, security and convenience of online offerings, and audience measurement. We use cookies in accordance with legal requirements. Where necessary, we obtain the userâs prior consent. Where consent is not required, we rely on legitimate interests, e.g., where storage/reading is essential to provide expressly requested content/functions (such as storing settings and ensuring functionality/security). Consent can be withdrawn at any time. We provide clear information on scope and which cookies are used.
Notes on legal bases: Whether we process personal data via cookies depends on consent. If consent is given, it is the legal basis. Without consent, we rely on our legitimate interests as outlined here and in the context of the respective services and procedures.
Storage duration: We distinguish between:
General information on withdrawal and objection (opt-out): Users can withdraw consent at any time and also declare an objection to processing in accordance with legal requirements, including via their browser privacy settings.
Further notes on processes, procedures and services:
We use blogs or comparable online communication and publishing media (âpublishing mediaâ). Readersâ data is processed only to the extent necessary for presentation and communication between authors and readers or for security reasons. Otherwise, see the general information in this privacy policy.
We send newsletters, emails, and other electronic notifications (ânewsletterâ) only with recipientsâ consent or a legal basis. Where contents are specified during signup, they are decisive for consent. Usually, your email address is sufficient to subscribe. To provide a personalized service, we may ask for your name for a personal salutation or other information if necessary for the newsletterâs purpose.
Deletion and restriction: We may store unsubscribed email addresses for up to three years on the basis of our legitimate interests in order to prove previously given consent. Processing of this data is limited to potential defense of claims. Individual deletion is possible at any time if the former existence of consent is confirmed. Where we must permanently observe objections, we store the email address for this purpose alone in a âblocklistâ.
Logging of the signup process occurs on the basis of our legitimate interests to prove proper procedures. If we commission a service provider with sending emails, this is based on our legitimate interests in an efficient and secure dispatch system.
Contents:Information about us, our services, campaigns and offers.
Web analytics (also âreach measurementâ) serves to evaluate visitor flows to our online offering and may include behavior, interests or demographic information (e.g., age, gender) as pseudonymous values. Analytics helps us identify when our online offering and its functions/content are used most often and which areas require optimization.
We may also use testing procedures (A/B tests) to test and optimize different versions of our online offering or its components.
Unless otherwise stated, profiles may be created for these purposes, and information stored on a browser/device may be saved and then read. Data collected includes visited websites and elements used, as well as technical information such as browser, system, and usage times. If users consent to location data collection, such data may also be processed.
IP addresses are stored but we use IP masking (pseudonymization by truncation). Generally, no clear data (such as names or emails) are stored for analytics/A-B testing/optimization; only pseudonyms.
Legal bases: If we ask for consent to use third-party providers, the legal basis is consent; otherwise, processing is based on our legitimate interests (efficient, economical and recipient-friendly services). See also the section âUse of Cookiesâ.
Further notes on processes, procedures and services:
We maintain online presences within social networks and process user data to communicate with users active there or to provide information about us.
We point out that user data may be processed outside the EU. This may pose risks (e.g., more difficult enforcement of rights).
User data in social networks is usually processed for market research and advertising purposes (profiles based on usage behavior/interests; ads inside and outside the networks; cookies used; cross-device storage for members logged in).
For details on processing and opt-out options, please see the privacy policies of the respective networks.
In the case of access requests and the exercise of data subject rights, we also point out that these are most effectively asserted with the providers. Only they have access to user data. If you still need help, contact us.
Further notes on processes, procedures and services:
We integrate functional and content elements obtained from the servers of their respective providers (âthird partiesâ) (e.g., graphics, videos, maps).
Integration always requires that third parties process usersâ IP addresses, since without the IP they cannot send the content to the userâs browser. We strive to use only content whose providers use the IP address solely to deliver the content. Third parties may also use pixel tags for statistics/marketing. Pseudonymous information may be stored in cookies and include technical data and usage info and may be combined with information from other sources.
Legal bases: Where we request consent for third-party use, the legal basis is consent; otherwise, processing is based on our legitimate interests. See also âUse of Cookiesâ.
Further notes on processes, procedures and services:
Please review the content of our privacy policy regularly. We will adapt the privacy policy as soon as changes in our data processing make this necessary. We will inform you if your cooperation (e.g., consent) or other individual notification is required due to the changes.
If we provide addresses and contact information of companies and organizations in this privacy policy, please note that addresses may change over time; please verify before contacting them.
Below is an overview of terms used in this privacy policy. Where terms are legally defined, the legal definitions apply. The explanations below serve understanding.
Created with the free Datenschutz-Generator.de by Dr. Thomas Schwenke