Sun Oct 23 2022

Data protection notice of Aleph Alpha GmbH

The protection of your data is very important to us. In the following, we would like to explain to you in a transparent and understandable way which, whether and how we process your data.

I. Name and address of the controller

The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the member states as well as other data protection regulations is:

Aleph Alpha GmbH

Grenzhöfer Weg 36

69123 Heidelberg

E-mail: privacy@aleph-alpha.com

II. Contact details of the data protection officer

Datenschutzbeauftragter / Data Protection Officer

Fresh Compliance GmbH

Frank Trautwein

Fürbringerstr. 15

10961 Berlin

E-mail: dsb@freshcompliance.de

III. General provisions on data processing

1. Scope of the processing of personal data

As a matter of principle, we only collect and use your personal data insofar as this is necessary for the provision of a functional website as well as our contents and services or to initiate and discuss a business relationship, a business contact or to establish, implement and terminate our cooperation and the processing is legally permissible, i.e. purpose-bound and based on a legal basis.

2. Legal basis for the processing of personal data

Insofar as we obtain the consent of the data subject for processing operations involving personal data, Article 6 para. 1 lit. a GDPR (General Data Protection Regulation) will serve as the legal basis.

When processing personal data which is necessary for the initiation and discussion of a business contact, for the establishment, implementation and termination of a contract, a cooperation, Article 6 para. 1 lit. b GDPR will serve as the legal basis. This also applies to processing operations that are necessary for the implementation of pre-contractual measures.

Insofar as the processing of personal data is necessary for the fulfilment of a legal obligation to which our company is subject, like e.g. the safekeeping of invoices for 10 years, Article 6 para. 1 lit. c GDPR will serve as the legal basis.

In the event that vital interests of the data subject or another natural person makes the processing of personal data necessary, Article 6 para. 1 lit. d GDPR will serve as the legal basis.

If the processing is necessary to protect a legitimate interest of our company or a third party and if the interests, fundamental rights and freedoms of the data subject do not override the former interest, Article 6 para. 1 lit. f GDPR will serve as the legal basis for the processing.

3. Data erasure and storage period

Your data will be erased or disabled as soon as the purpose of processing, in particular storage, ceases to apply. In addition, storage may take place if this has been provided for by the European or national legislator in Union regulations, laws (e.g. GDPR, tax, accounting retention obligations) or other provisions to which the controller is subject.

Data will also be disabled or erased if a retention period prescribed by the aforementioned standards expires, unless there is a need to continue storing the data , e.g. for the execution or performance of a contract.

IV. Provision of the website and setting of log files

1. Description and scope of data processing

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer.

The following data is collected:

Name of the internet service provider

Browser type

The Aleph Alpha pages visited by the user

Date and duration of the visit

In the case of a registered user, this data is also stored in the log files of our system. Your IP addresses or other data that enable the data to be assigned to you as a user are not permanently stored in the log files, unless their processing is temporarily necessary, e.g. for the delivery and presentation of our website.

2. Legal basis for the data processing

Insofar as your visit to our website serves the purpose of initiating a business contact, establishing, implementing or terminating our cooperation, the legal basis for the temporary processing is Article 6 para. 1 lit. b) GDPR. In other cases, the legal basis is Article 6 para. 1 lit. f GDPR, insofar as our interest in the processing outweighs the interest of the data subject.

3. Purpose of the data processing

When visiting our website, the temporary processing, in particular storage, of the IP address by the system is necessary to enable the delivery of the website to the user's computer. To the latter purpose, the user's IP address has to be stored for the duration of the session.

These purposes also constitute our legitimate interest in the data processing pursuant to Article 6 para. 1 lit. f) GDPR. Insofar as the visit to our website serves the purpose of initiating, implementing or terminating the business relationship, this purpose at the same time also constitutes the purpose of the processing.

4. Duration of storage

The data will be erased as soon as it is no longer required to achieve the purpose of the processing. In the event of the collection of data for the provision of the website, this is the case when the respective session has ended. In the event that the visit to the website and thus the processing serves to initiate (e.g. initial contact), implement (e.g. order processing, AIaaS, billing) and terminate the business relationship, the data will be erased insofar as and for as long as it is no longer required to fulfil the respective purpose, unless the data is required to assert legal claims or defend ourselves against legal claims or there is a legal obligation to retain the data. In accordance with Section 14 b para. 1 sentence 1 German Turnover Tax Act, invoices must be kept for at least 10 years.

5. Right to objection and elimination

The collection of data for the provision of the website and the storage of the data in log files is absolutely necessary for the operation of the website. Consequently, the user has no right to object. There is also no right to object to the ten-year retention of invoices.

V. Use of cookies an add-ons

1. Use of technically necessary cookies an add-ons

a) Description and scope of data processing

Our website uses technically necessary cookies. Cookies are text files that are stored in the internet browser or by the internet browser on the user's computer system. When a user accesses a website, a cookie may be stored on the user's operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is accessed again.

We use technically necessary cookies to make our website more user-friendly, and also to the extent that this is technically necessary for the delivery of the website. Some elements of our website require that the calling browser can be identified even after a website has been switched.

b) Legal basis for the data processing

The legal basis for the processing of personal data using cookies is Article 6 para. 1 lit. f) GDPR. Both the users and we have a legitimate interest in a functional and up-to-date website.

c) Purpose of the data processing

The purpose of using technically necessary cookies is to simplify the use of websites for users. Some functions of our website cannot be offered without the use of cookies. It is, thus, necessary that the browser is recognised even after the website has been switched.

The user data collected through technically necessary cookies are not used to create user profiles. These purposes also constitute our legitimate interest in data processing pursuant to Article 6 para. 1 lit. f) GDPR.

d) Duration of storage, right to objection and elimination

The technically necessary cookies are stored on your computer and transmitted from it to our website. Therefore, you as a user also have full control over the use of cookies. By changing the settings in your internet browser, you can deactivate or restrict the transmission of cookies. Cookies that have already been stored can be erased at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all the functions of the website to their full extent.

2. Use of non-technical necessary cookies.

We use non-technically necessary cookies exclusively on the app.aleph-alpha.com website. The following non-technically necessary cookies are used on the site:

2.1 Use of Twitter Conversion Tracking

a) Description and scope of data processing

If you have given your approval, Twitter Conversion Tracking is used on this website. This is a service of Twitter International Company, Gordon House, One Cumberland Place, Fenian Street, Ireland, (hereinafter referred to as Twitter). Twitter Conversion Tracking is a remarketing function. The service stores and processes information about your user behavior on our website. For this purpose, the service uses, among other things, cookies, i.e. small text files that are stored locally in the cache of your web browser on your end device and that enable an analysis of your use of our website. Through the integration of tags, Twitter receives the information that you have accessed the corresponding website. We have no control over the scope of the transmitted data and its further processing by Twitter: If you are registered with a Twitter service, Twitter can assign the visit to your account. Even if you are not registered with Twitter or have not logged in, there is a possibility that the provider will learn and store your IP address and other identifiers. The information generated by the tags about your use of our services is transmitted to a Twitter server in the USA and stored there.

Further information from the third-party provider Twitter:

https://twitter.com/de/privacy

https://help.twitter.com/de/safety-and-security/privacy-controls-for-tailored-ads

b) Legal basis for data processing

The legal basis for the processing of personal data using Twitter Conversion Tracking is Art. 6 (1) lit. a DSGVO.

c) Purposes of data processing

We use the service to analyze the use of our website and to continuously improve individual functions and offers as well as the user experience. Through the statistical evaluation of user behavior, we can improve our offer and make it more interesting for you as a user.

d) Duration of storage, right to objection and elimination

The cookies are stored on your computer and transmitted from it to our site. Therefore, you as a user also have full control over the use of cookies. By changing the settings in your Internet browser, you can disable or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all functions of the website.

Members of twitter can control the use of their personal data for advertising purposes in their account settings at twitter.

2.2 Use of LinkedIn Conversion Tracking

a) Description and scope of data processing

If you have given your approval, we use LinkedIn Conversion Tracking from LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (hereinafter referred to as LinkedIn). LinkedIn Conversion Tracking uses so-called "cookies", i.e. text files that are stored on your computer by the LinkedIn Insight tag and that enable an analysis of your use of the website.

The information collected by the LinkedIn Insight tag about your use of our website is encrypted. The cookie is stored on the LinkedIn member's browser until the member deletes the cookie or the cookie expires (the expiration date is rolling six months after the member's browser last loaded the Insight tag). LinkedIn Conversion Tracking is a retargeting and analytics tool powered by the LinkedIn Insight Tag. The LinkedIn Insight tag enables the collection of data about visits to our website, including URL, referrer URL, IP address, device and browser properties, and timestamps. This data is encrypted, IP addresses are shortened, and members' unique IDs are removed within seven days to pseudonymize the data.

Further information from the third-party provider LinkedIn:

http://www.linkedin.com/legal/privacy-policy

https://www.linkedin.com/help/lms/answer/85787

https://www.linkedin.com/help/linkedin/answer/87150/linkedin-marketinglosungen-und-die-datenschutz-grundverordnung-dsgvo-?lang=de

b) Legal basis for data processing

The legal basis for the processing of personal data using LinkedIn Conversion Tracking is Art. 6 para. 1 lit. a DSGVO.

c) Purposes of data processing

We use LinkedIn Conversion Tracking to analyze and regularly improve the use of our website. The statistics obtained enable us to improve our offer and make it more interesting for you as a user. LinkedIn does not share any personal data with us, but only provides aggregated reports on website audience and ad performance. LinkedIn also provides retargeting for website visitors, so we can use this data to display targeted ads outside of our website without identifying the member.

d) Duration of storage, right to objection and elimination

The cookies are stored on your computer and transmitted from it to our site. Therefore, you as a user also have full control over the use of cookies. By changing the settings in your Internet browser, you can disable or restrict the transmission of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all functions of the website.

Members of LinkedIn can control the use of their personal data for advertising purposes in your account settings at LinkedIn.

2.3 Use of Fathom Analytics

a) Description and scope of data processing

If you have given your approval, we use Fathom Analytics from Conva Ventures Inc, 37058 Millstream PO; Victoria British Columbia V9B 0E8, Canada (hereinafter referred to as Fathom Analytics). Fathom Analytics will briefly process your IP address to track user behavior on our website and use these insights to improve user-friendliness and functionality of the website. In accordance with the DSGVO, your personal data will be anonymized.

For more information, please visit the Fathom Analytics website:

https://usefathom.com/

b) Legal basis for data processing

The legal basis for the processing of personal data using Fathom Analytics is Art. 6 (1) lit. f DSGVO (consent).

c) Purposes of data processing

We use Fathom Analytics to analyze and regularly improve the use of our website. The statistics obtained enable us to improve our offer and make it more interesting for you as a user. Fathom Analytics does not collect any personal data, but only provides summarized reports about the website target group and ad performance.

d) Duration of storage, objection and removal options

No cookies are stored on your computer and your IP address is only stored for a short period of time. Fathom Analytics has no way of identifying you or collecting personal data.

VI. Contact sheet and e-mail correspondence

1. Description and scope of data processing

A contact form is available on our website, which can be used for electronic communications. If a user takes advantage of this option, the data entered in the input mask will be transmitted to us and stored. The Data is:

Title

First and last name

E-mail

Organisation

Country

Specification of a intended of use of the AIaaS

Specification of the intended use of the AIaaS

Question of whether a journalistic profession is being pursued

Enquiry if there is an interest in marketing & promotional material

The following data is also stored at the time the message is sent:

Your IP address

Date and time of registration

For the processing of the data, your consent is obtained during the submission process and reference is made to this data protection statement.

It is possible to contact us via the e-mail address provided info@aleph-alpha.com or, in the case of enquiries about data protection, via dataprivacy@aleph-alpha.com . In this case, the personal data transmitted with the e-mail (surname, first name, e-mail address, message content) will be processed.

In this context, the data will not be transferred to third parties. The data is primarily used for processing the conversation or for initiating, implementing or terminating the business relationship.

2. Legal basis for the data processing

The legal basis for the processing of the data is Article 6 para. 1 lit. a) GDPR.

The legal basis for the processing of data transmitted in the course of sending an e-mail is Article 6 para. 1 lit. f) GDPR.

If the e-mail contact aims at the initiation, implementation and termination of the business relationship, the additional legal basis for the processing is Article 6 para. lit. b) GDPR.

3. Purpose of the data processing

The processing of the personal data from the input mask serves mainly to process the contact. When contact is made by e-mail, the necessary legitimate interest in processing the data lies in the processing of the contact.

The other personal data processed during the sending process serve to prevent misuse of the contact form and to ensure the security of our information technology systems.

Insofar as you contact us for the purpose of initiating, implementing or terminating the business relationship, these are also the purposes of the processing.

4. Duration of storage

The data will be erased as soon as it is no longer required to achieve the purpose for which it was collected. For the personal data from the input mask of the contact form and those sent by e-mail, this is the case when the respective conversation with the user has ended. The conversation is ended when it is clear from the circumstances that the matter in question has been conclusively clarified. The additional personal data collected during the sending process will be erased after a period of seven days at the latest.

Should the data serve to initiate, implement or terminate the business relationship, your data will generally be erased no later than 4 years after the end of the business relationship, unless the further processing of the data is necessary for the assertion of or defence against legal claims or is mandatory due to a statutory retention obligation. E-mails that simultaneously constitute commercial and business letters have to be stored for six years pursuant to Sections 147 para.3 German Tax Code, 257 para. 4 German Commercial Code.

5. Right to objection and elimination

You have the possibility to revoke your consent to the processing of personal data at any time.

If you contact us via the contact form or by e-mail, you can object to the storage of your personal data at any time. In such a case, the conversation cannot be continued.

Insofar as the purpose of the contact was the initiation, implementation or termination of the business relationship, it may be the case that the business relationship can no longer be continued after an objection to the data processing.

The revocation of consent and the objection to data processing can be submitted by e-mail to dataprivacy@aleph-alpha.com .

All personal data stored in the course of contacting us will be erased in this case.

VII. Newsletter

1. Description and scope of data processing

You can subscribe to our newsletter, with which we inform you about our current interesting offers, by granting your consent. The advertised goods and services are named in the declaration of consent.

We use the so-called double-opt-in procedure for the register for our newsletter. This means that after you have registered, we will send you an email to the email address you have provided in which we ask you to confirm that you are the owner of the email address provided and that you wish to receive the notifications. If you do not confirm your registration within [24 hours], your information will be disabled and automatically erased after one month. In addition, we store your IP addresses and the times of registration and confirmation. The purpose of the procedure is to be able to prove your registration and, if necessary, to clarify a possible misuse of your personal data.

The only mandatory information for sending the newsletter is your e-mail address. [The provision of further, separately marked data is voluntary and will be used to address you personally.] After your confirmation, we store your e-mail address for the purpose of sending you the newsletter.

2. Legal basis for the data processing

The legal basis is Article  6 para. 1 sentence 1 lit. a GDPR.

3. Purpose of the data processing

The purpose of the data processing is the submission of the newsletter. It may be sent at regular or irregular intervals.

4. Duration of storage

All personal data stored in the course of the newsletter registration or newsletter dispatch will be erased upon revocation or objection within the period stipulated in Article 17 GDPR, i.e. except if the case of a legal reason stipulated in Article 17 para. 3 GDPRin an individual case.

5. Revocation of consent and objection

Revocation: You can revoke your consent to receive the newsletter and unsubscribe at any time. You can declare the revocation by clicking on the link provided in every newsletter e-mail, by e-mail to [ Newsletter@aleph-alpha.com ], by contact form or by sending a message to the contact details given in the imprint.

Objection: You can also object to the processing for direct marketing purposes at any time. Your personal data collected and processed within the scope of the newsletter will then no longer be processed for these purposes. You can declare your objection to advertising by clicking on the link provided in every newsletter e-mail, by e-mail to [ Newsletter@aleph-alpha.com ], by using the contact form or by sending a message to the contact details given in the imprint.

VIII. Rights of the data subject

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller, which you can assert - preferably by e-mail to dataprivacy@aleph-alpha.com :

1. Right of access pursuant to Article 15 GDPR

Firstly, you can request confirmation from us, e.g. by e-mail to dataprivacy@aleph-alpha.com , as to whether your personal data is being processed by us. In the event of doubts about your identity, we are entitled to check your identity in accordance with Article 12 para. 6 GDPR.

If case of data processing, you can request information about the following:

(1) the purposes for which the personal data are processed;

(2) the categories of the processed personal data;

(3) the recipients or categories of recipients to whom your personal data has been or will be disclosed;

(4) the planned duration of the storage of the personal data relating to you or, if specific information on this is not available, criteria for determining the storage duration;

(5) the existence of the right to request from the controller rectification or erasure of personal data, restriction of processing of personal data concerning the data subject or to object to such processing;

(6) the right to lodge a complaint with a supervisory authority;

(7) where the personal data are not collected from the data subject, any available information as to their source;

(8) the existence of automated decision-making including profiling pursuant to Article 22 para. 2 and 4 of GDPR and - at least in these cases - meaningful information regarding the logic involved and the scope and intended effects of such processing for the data subject.

You have the right to request information on whether personal data is transferred to a third country or to an international organisation. In this context, you can request to be informed about the appropriate guarantees according to Article 46 GDPR in connection with the transfer.

2. Right to rectification pursuant to Article 16 GDPR

You are entitled to a right of rectification and/or completion vis-à-vis the data controller if the personal data processed are inaccurate or incomplete. The data controller has to implement the correction without delay.

3. Right to restriction of processing pursuant to Article 18 GDPR

You may request the restriction of the processing of personal data under the following conditions:

(1) if you contest the accuracy of the personal data concerning you for a period enabling the controller to verify the accuracy of the personal data;

(2) if the processing is unlawful and you oppose the erasure of the personal data and request the restriction of the use of the personal data instead;

(3) if the controller no longer needs the personal data for the purposes of processing but you need them for the establishment,exercise or defence of legal claims; or

(4) if you object to the processing pursuant to Article 21 para. 1 GDPR pending the verification whether the legitimate interests of the controller override your interests.

Where the processing of personal data has been restricted, those data may be processed, with the exception of their storage, only with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

If the restriction of processing has been restricted in accordance with the above conditions, you will be informed by the controller before the restriction is withdrawn.

4. Right to erasure pursuant to Article 17 GDPR

a) Obligation to erasure

You have the right to obtain the erasure of your personal data from the controller without undue delay and the controller has the obligation to erase personal data without undue delay where one of the following grounds applies:

(1) The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

(2) You withdraw your consent on which the processing is based pursuant to Article 6 para. 1 lit. a or Article 9 para. 2 lit. a GDPR and there is no other legal basis for the processing.

(3) You object to the procession pursuant to Article 21 para. 1 GDPR and there are no overriding legitimate grounds for the processing, or you lodge a complaint pursuant to Article 21 para. 2 GDPR against the processing.

(4) The personal data concerning you have been processed unlawfully.

(5) The personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;

(6) The personal data concerning you have been collected in relation to information society services referred to in Article 8 para. 1 GDPR.

b) Information to third parties

Where the controller has made the personal data public and is obliged pursuant to Article 17 para. 1 GDPR to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

c) Exceptions

The right to erasure does not apply to the extent that processing is necessary

(1) for exercising the right of freedom of expression and information;

(2) for compliance with a legal obligation which requires processing according to Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

(3) for reasons of public interest in the field of public health pursuant to Article 9 para. 2 lit. h and i as well as Article 9 para. 3 GDPR;

(4) for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes in accordance with Article Article 89 para. 1 GDPR, insofar as the right referred to in section a) is likely to render impossible or seriously prejudice the achievement of the purposes of such processing, or

(5) for the establishment, exercise or defence of legal claims.

5. Right to information pursuant to Article 19 GDPR

If you have asserted the right to rectification, erasure or restriction of processing vis-à-vis the controller, the latter will be obliged to communicate this rectification or erasure of the data or restriction of processing to all recipients to whom the personal data has been disclosed, unless this proves impossible or involves a disproportionate effort.

You have the right to be informed of these recipients by the controller.

6. Right to data portability pursuant to Article 20 GDPR

You have the right to receive the personal data concerning you that you have provided to the controller in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to whom the personal data has been provided, provided that

(1) the processing is based on consent pursuant to Article 6 para.1 lit. a GDPR or Article 9 para. 2 lit. a GDPR or a contract pursuant to Article 6 para. 1 lit. b GDPR and para. 2 the processing is carried out by automated means.

In exercising this right you have the right to have the personal data transmitted directly from one controller to another, where technically feasible. The freedoms and rights of other persons must not be affected by this.

The right to portability does not apply to processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

7. Right to object pursuant to Article 21 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Article 6 para. 1 lit. e or f GDPR, preferably by email to dataprivacy@aleph-alpha.com .

The controller will no longer process the personal data relating to you unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is for the establishment, exercise or defence of legal claims.

If your personal data is processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing.

If you object to processing for direct marketing purposes, your personal data will no longer be processed for such purposes.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to objection by automated means using technical specifications.

8. Right to revoke the consent under data protection law

In accordance with Article 7 para. 3 GDPR you have the option to revoke your consent to data processing at any time, preferably by e-mail to dataprivacy@aleph-alpha.com . The revocation of consent does not affect the lawfulness of processing based on consent before its revocation.

9. Right to lodge a complaint with a supervisory authority pursuant to Article 77 GDPR

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if the you consider that the processing of personal data relating to you violates the GDPR.

The supervisory authority with which the complaint has been lodged will inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78 GDPR.

The supervisory authority in Baden-Württemberg is the State Commissioner for Data Protection and Freedom of Information. It is possible to lodge a complaint from there online.

Version February 2023