Your data. Your decision.

The controller responsible for processing personal data on this website is:

Swiftron GmbH
Gartenstraße 37
74072 Heilbronn
Germany

Represented by the Managing Director Pit Ogermann. Email for data protection inquiries: privacy@swiftron.eu. All other details can be found in the Legal Notice.

This privacy policy applies to the website swiftron.eu. When we process customer data in our products on behalf of our customers, this is governed by a separate data processing agreement.

We are currently not legally required to appoint a data protection officer (Art. 37 GDPR, § 38 BDSG). For any questions regarding data protection, you can reach us directly at privacy@swiftron.eu.

• Without your consent, we only use technically necessary storage. Google Analytics, Google Ads, Meta, YouTube, and OpenStreetMap will only load after you have given your consent.
• We load fonts and program libraries from our own server, not from third-party providers.
• We only use data from forms and appointment bookings to process your request.
• Our servers are located in the EU. Some service providers are based in the USA, for which the guarantees from the Third Countries chapter apply.
• We do not sell any data and do not make automated decisions about you.

For each point in this privacy policy, we state the legal basis. These include:

• Consent (Art. 6 para. 1 lit. a GDPR), and additionally Sec. 25 para. 1 TDDDG for storage on your device.
• Contract and inquiry (Art. 6 para. 1 lit. b GDPR), for example when you book an appointment or apply.
• Legal obligation (Art. 6 para. 1 lit. c GDPR), such as retention periods or proof of your consent.
• Legitimate interest (Art. 6 para. 1 lit. f GDPR), such as the secure operation of the website.
• Strictly necessary storage on your device pursuant to Sec. 25 para. 2 No. 2 TDDDG.

You are under no obligation to provide us with your data. However, without the information in a form, we will not be able to process your respective inquiry.

You have the following rights towards us, in each case free of charge:

• Access to your stored data (Art. 15 GDPR)
• Rectification of incorrect data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR), provided there is no statutory retention obligation
• Restriction of processing (Art. 18 GDPR)
• Data portability in a structured, commonly used and machine-readable format (Art. 20 GDPR)
• Withdrawal of consent with effect for the future (Art. 7 para. 3 GDPR)
• Objection to certain processing activities (Art. 21 GDPR, see next point)

An email to privacy@swiftron.eu is sufficient. We will respond within one month.

An informal message to privacy@swiftron.eu is sufficient.

As simple as when you granted it: Turn off the service above under Your Settings, or open the privacy settings via the link in the footer of any page. We will then delete the cookies that the service has stored on our domain and reload the page.

The withdrawal of consent applies to the future. Anything done up to that point based on your consent remains lawful.

You have the right to lodge a complaint with any data protection supervisory authority, particularly in the country where you reside or work (Art. 77 GDPR). The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20
70173 Stuttgart
www.baden-wuerttemberg.datenschutz.de

Often, the quickest way to resolve an issue is to contact us directly. We will take care of it.

No. We do not make any decisions based solely on automated processing which produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

Our website runs on Google Cloud Run in the europe-west4 region data center in the Netherlands. The provider is Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland. Google processes the data as a processor in accordance with our instructions (Art. 28 GDPR). Access by Google LLC in the USA, for example in support cases, is secured by the EU-U.S. Data Privacy Framework and standard contractual clauses.

The legal basis is our legitimate interest in a secure, fast, and reliable website (Art. 6 para. 1 lit. f GDPR).

With every visit, the hosting platform stores technical data: IP address, date and time, accessed address, referrer, browser and operating system, status code, and the volume of data transferred. We require these logs to prevent attacks and troubleshoot errors. They are automatically deleted after 30 days.

If a technical error occurs in the browser, for example when booking an appointment, the page sends a brief error message to our server. This does not contain any form content. In our own application logs, we truncate email addresses and telephone numbers.

The legal basis is our legitimate interest in secure and error-free operation (Art. 6 para. 1 lit. f GDPR).

We store callback requests, appointment bookings, proofs of consent, inputs in our AI tools, and the translations of our pages in a database (Azure Cosmos DB) in the West Europe region in the Netherlands. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, acting as a data processor. Potential access from the USA is secured by the EU-U.S. Data Privacy Framework and standard contractual clauses.

We transmit all pages and forms exclusively in encrypted form via HTTPS (TLS). You can recognize this by the padlock icon in your browser's address bar.

We load fonts, program libraries, and images from our own server. Therefore, when you visit our pages, we do not transmit your IP address to font or CDN providers. External services only load if you have given your consent (see your settings).

Exception: Individual product demos that we make specifically available to customers may load fonts from Google Fonts. These pages are not publicly linked.

We use our own system, not an external provider. On your first visit, we ask what we are allowed to use. We store your selection in the cookie swiftron_consent along with a random consent ID.

To prove that you have given your consent (Art. 7 para. 1 GDPR), we store every decision on our server: consent ID, selected services, timestamp, page, language, and version of the consent text. We deliberately do not store your IP address or your browser. We delete these records after three years. The legal basis is our legal obligation to provide proof (Art. 6 para. 1 lit. c GDPR).

Your selection is valid for twelve months, or six months after a complete rejection. After that, we will ask you again, as well as when we introduce new services. If you have not allowed statistics or ad measurement, we display a small notice in the bottom left corner. It does not cover any content, and as long as you do not use it, nothing changes.

We need this storage for the website and your requested functions to work. They are permitted without consent (Section 25 (2) No. 2 TDDDG) and do not contain any personal data.

These storage items are only created if you consent to the respective service (Art. 6 para. 1 lit. a GDPR, § 25 para. 1 TDDDG):

If you request a callback or book an appointment, we store with your request the page and campaign link through which you reached us: for example utm_source, utm_campaign, the click ID of an ad (gclid, fbclid, msclkid) and the referring website. This helps us identify which channels lead to conversations. The legal basis is our legitimate interest in cost-effective advertising (Art. 6 para. 1 lit. f GDPR).

Without your consent, we only read this information from the currently open page. We only store it in the browser across multiple pages with your consent. Along with your request, we also record which consents you had granted at that moment. We do not share your contact details with advertising networks.

On some pages, you can book an appointment with us directly. The appointment selection is our own system. To display available times, our server checks our team's calendars. We do not access your calendar.

When booking, we process your name, your email address, your company, your phone number if requested, the selected date and time, language, and page. We create the appointment with a Google Meet link in our team's calendar, and Google Calendar sends you the invitation by email. During the video call, Google Meet processes technically necessary data such as IP address, image, and sound.

Calendar and video conferencing are provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as a processor within the scope of Google Workspace. Data transfer to the USA is secured by the EU-U.S. Data Privacy Framework. We also store your booking in our CRM (see Customer Management). The legal basis is the initiation of a contract at your request (Art. 6 para. 1 lit. b GDPR).

When you request a callback, we process your name, telephone number, and email address, as well as the page from which you make the request. We only use this data to contact you regarding your inquiry and to prepare for the call. Your request reaches us via email and is stored in our CRM. The legal basis is the initiation of a contract at your request (Art. 6 para. 1 lit. b GDPR).

We manage inquiries and appointment bookings as a data processor in the CRM system Pipedrive, provided by Pipedrive OÜ, Mustamäe tee 3a, 10615 Tallinn, Estonia. There, we store your contact details, your company, appointments, meeting notes, and the origin of your inquiry. If Pipedrive transfers data to sub-processors outside the EU, this is done on the basis of standard contractual clauses.

If no business relationship is established, we will delete your data as soon as it is no longer required for your inquiry, at the latest three years after the last contact. For customers, statutory retention periods apply.

When you write to or call us, we process your information in order to handle your request (Art. 6 para. 1 lit. b or f GDPR). Our mailboxes are operated by Google Ireland Limited as part of Google Workspace. We send automatic emails such as confirmations and internal notifications via STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin. Both act as data processors.

On our homepage, you can apply for pilot projects or submit a technical inquiry. In doing so, we process your name, email address, and the information you provide in the form, such as company, role, or challenge. The inquiry reaches us via email. The legal basis is the initiation of a contract at your request (Art. 6 para. 1 lit. b GDPR).

We send documents to you as a personal link (for example swiftron.eu/k7q2xa) instead of as an attachment. When you open the link or download the document, our server records which link was opened and when. This allows us to know whether the documents have arrived and to tailor our conversation accordingly. We do not set a cookie or store anything on your device for this purpose.

During your visit, we append the code of the link to the addresses of the pages you access from there (?sd=…). If you consent to statistics, we link your visit to your contact (see Google Analytics). The documents are stored in Google Cloud Storage in the Netherlands, and the mapping of the links is stored in a Google Cloud database (Firestore) in the EU.

The legal basis is our legitimate interest in a well-prepared initiation of business (Art. 6 para. 1 lit. f GDPR). We delete the information regarding the link along with your contact in our CRM. You can object to this at any time; a short message to privacy@swiftron.eu is sufficient.

To approach businesses, we research professional contact details from publicly accessible sources such as company websites, legal notices, and business directories, partly with the support of commissioned service providers. We store the company name, website, address, name, job title, as well as professional email address and telephone number in our CRM in order to present you with a suitable offer.

The legal basis is our legitimate interest in initiating business relationships (Art. 6 para. 1 lit. f GDPR). If your company is not a fit for our offering, we will flag it so that we do not contact you again. We delete personal data no later than three years after the last contact. You can object to the processing at any time (Art. 21 GDPR), in which case we will no longer contact you.

When you use the GPT Optimizer, we send your input to an OpenAI (USA) language model and display the result to you. We store the input and result without IP addresses or identifiers in order to display the counter on the page and to improve the tool. Please do not enter any personal data.

OpenAI processes the data as a data processor, does not use it to train its models, and deletes it after 30 days at the latest. The transfer to the USA is based on standard contractual clauses. The legal basis is the use of the service requested by you (Art. 6 para. 1 lit. b GDPR).

When voting, your browser generates a random ID. We store this along with your vote to ensure that each vote is only counted once. We do not collect any other information. The legal basis is your participation in the vote (Art. 6 para. 1 lit. b GDPR).

We write our pages in German or English and have them translated into other languages by AI models. Only our own website content is processed during this, no visitor data.

Links to social networks and other websites are simple links. You will only leave our site once you click on them. At that point, the privacy policy of the respective provider applies.

When you apply, we process your name, email address, your answers in the form, and your uploaded documents. We store them in Google Drive (Google Workspace, Google Ireland Limited, as a data processor) and send you an acknowledgment of receipt by email. Access is restricted solely to the individuals involved in the selection process.

The legal basis is the conduct of the application process (Art. 6 para. 1 lit. b GDPR). If no cooperation is established, we will delete your documents six months after the completion of the process, unless you consent to us retaining them for longer.

We only share data with service providers whom we have carefully selected and contractually obligated to data protection, or when required by law.

DPF: EU-U.S. Data Privacy Framework. SCC: Standard Contractual Clauses of the EU Commission.

Some service providers are based in the USA or belong to US groups. Data is only transferred there if an adequate level of protection is guaranteed: through the recipient's certification under the EU-U.S. Data Privacy Framework (adequacy decision of the EU Commission of July 10, 2023) or through standard contractual clauses of the EU Commission. An adequacy decision also exists for the United Kingdom.

Generally, only for as long as we need the data for the respective purpose. An overview:

• Server logs: 30 days
• Proof of your consent: three years
• Google Analytics: 14 months, raw data export in BigQuery: 36 months
• Details on personal document links: together with the contact in the CRM
• Inquiries and appointments without a business relationship: until resolved, at the latest three years after the last contact
• Job applications: six months after completion of the application process
• Business letters and accounting records: statutory retention periods of up to ten years (German Commercial Code, German Fiscal Code)

We will update this policy if our website or the legal situation changes. The date above shows the current status. If we introduce new services that require your consent, we will ask you again.