Privacy notice

Who is responsible

dionics media UG (haftungsbeschränkt), Birkhuhnweg 8, 31303 Burgdorf, Deutschland, is the controller for the processing described here. Reach us at websites@dionics.ai or +49 175 9648764. We have not appointed a data protection officer, because the thresholds in section 38 of the Federal Data Protection Act do not apply to us.

Visiting the site

Our host records each request in a server log: the requesting IP address, the time, the page requested, the referring page, the status code, the amount of data transferred, and the browser and operating system your browser reports. This is technically necessary to deliver the page and to identify faults and abuse. The legal basis is Article 6(1)(f) GDPR, our legitimate interest in a site that works and is not being attacked. Logs are not combined with any other data and we do not use them to identify you. They are deleted after 30 days at the latest.

Hosting is provided by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, as a processor under a data processing agreement. Traffic may be served from infrastructure outside the EU. Vercel Inc. is certified under the EU-US Data Privacy Framework, with the EU Commission's standard contractual clauses as a fallback.

Fonts and other assets

The typefaces on this site are downloaded when the site is built and served from our own domain. Your browser makes no request to Google Fonts and no IP address reaches Google when you load a page. There is no content delivery network in front of the site other than our host's.

The contact form

When you send the contact form we process the name, email address, topic and message you enter, so we can answer you. All four fields are required; without them we cannot reply. There is no statutory or contractual obligation to provide them. The legal basis is Article 6(1)(b) GDPR where your message concerns a contract or a request for one, and otherwise Article 6(1)(f) GDPR, our interest in answering enquiries addressed to us.

The message is delivered as email over an authenticated, TLS-encrypted SMTP connection and stored in our mailbox. Both the relay and the mailbox are operated for us by Zoho as a processor under a data processing agreement; processing takes place outside the EU under the EU Commission's standard contractual clauses.

Enquiries that do not lead to an engagement are deleted no later than twelve months after the last message. Correspondence belonging to an engagement is kept for six years under section 257 of the Commercial Code and section 147 of the Fiscal Code.

The same applies if you write to us by email or call the number in the imprint: we process what you send in order to answer, on the same legal bases and for the same periods.

Spam protection on the form

Two things protect the form, and only one of them involves anyone else.

The first runs for everyone and sends nothing anywhere. The form carries a field that is hidden from sight, from screen readers and from the tab order, so a person never fills it and an automated script does, and we also check that the time between the page loading and the form arriving is long enough for a human to have typed. Neither stores anything on your device, neither tells any third party anything, and neither needs your consent.

The second is Google reCAPTCHA version 3, and it loads only if you accepted in the banner. If you did, the script is fetched from www.google.com when the contact page opens; Google receives your IP address, details about your browser and device and your behaviour on the page, such as mouse movement and time spent, and sets the cookie _GRECAPTCHA. From that reCAPTCHA produces a score telling us whether the submission was probably automated. The legal basis is your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG, and you can withdraw it with the button at the end of this page.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data is also processed by Google LLC in the USA, which is certified under the EU-US Data Privacy Framework, with the standard contractual clauses as a fallback. Google's own notice is at policies.google.com/privacy.

If you decline, the form still works exactly the same and nothing is sent to Google. You can also just write to websites@dionics.ai; we do not need the form at all.

Booking a call through Cal.com

On the contact page you can book a call through Cal.com. The calendar loads only when you press "Open the calendar". Nothing is requested from Cal.com before that, and if you never press it, nothing is. On the press your browser loads the calendar from app.cal.com, which receives your IP address and technical details about your browser and sets its own cookies or storage entries inside the embedded calendar. The legal basis for loading it is your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG, which you give by pressing the button. You can also book on Cal.com's own site through the link beside it, or just email us.

When you book, we process your name, email address, the chosen time, your time zone and anything you write in the notes field, so we can hold the call. The legal basis is Article 6(1)(b) GDPR, steps taken at your request before a contract. Cal.com sends you a confirmation and a reminder by email.

The provider is Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA, acting for us as a processor under a data processing agreement, with the EU Commission's standard contractual clauses covering the transfer. Bookings that do not lead to an engagement are deleted no later than twelve months after the call. Cal.com's own notice is at cal.com/privacy.

Analytics, only if you agree

We use Google Analytics 4 to count visits and see which pages get read. It loads only after you press "Accept" on the banner, and nothing is stored on your device for it before that. The legal basis is your consent under Article 6(1)(a) GDPR together with section 25(1) of the Telecommunications Digital Services Data Protection Act.

Once you have accepted, Google Analytics sets the cookies _ga and _ga_[measurement id] with a lifetime of two years and sends page views, approximate region, and browser and device details to Google. Google Analytics 4 does not store IP addresses; the address is used to determine the region and then discarded. User and event data is deleted at Google after 14 months at the latest. Advertising features and Google Signals are switched off.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as a processor under Google's data processing terms. Data is also processed on Google LLC servers in the USA. Google LLC is certified under the EU-US Data Privacy Framework, with the standard contractual clauses as a fallback.

You can withdraw your consent at any time, with effect for the future, using the button at the end of this page. Analytics stops loading immediately, in this tab and in any other you have open. Cookies Google has already set are cleared in your browser.

What is stored on your device

Nothing without your doing. Two entries exist in your browser's local storage only because of a choice you made, and are permitted without consent under section 25(2) no. 2 TDDDG because they implement a setting you expressly asked for. `cookie-consent` records your answer to the analytics banner, accepted or rejected, so the question does not return on every page. `theme` records whether you picked the light or dark design with the switch in the header. Neither is sent to a server, and both stay until you clear this site's data in your browser.

Beyond that, only what you triggered is stored: after you press Accept, the Google Analytics cookies and, on the contact page, the reCAPTCHA cookie; and after you open the calendar, Cal.com's entries. Each is described in its own section above. Decline, and none of them appear.

Your right to object under Article 21 GDPR

Where we process your data on the basis of Article 6(1)(f) GDPR, which here means the server logs and enquiries that do not lead towards a contract, you have the right to object at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. We do not do direct marketing. Send an objection to websites@dionics.ai.

Your other rights

Write to websites@dionics.ai to use any of these. You can also complain to a supervisory authority, either the one responsible for us, Der Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, or the one where you live or work.

• Access to the data we hold about you, under Article 15 GDPR
• Correction of data that is wrong, under Article 16
• Deletion, under Article 17
• Restriction of processing, under Article 18
• A copy in a portable format, under Article 20
• Withdrawal of any consent you have given, at any time, under Article 7(3)

No automated decisions

We do not profile you and no decision about you is made automatically on this site. The agent systems we build for clients are a separate matter, governed by the contract for that work and by the client's own notice.

Changes

We update this notice when the site changes. The date at the top is the last change. The current version is always at https://www.prompt-consulting.com/en/privacy.