Privacy policy

Last updated: October 19, 2026

1. Controller

The controller responsible for data processing on this website and in the KI verbindet Academy (academy.ki-verbindet.de) within the meaning of Art. 4(7) GDPR is:

We have not appointed a data protection officer, as we are not required to do so under Art. 37 GDPR and § 38 of the German Federal Data Protection Act (BDSG).

2. When you simply view the website

Server logs

Each time the site is accessed, technically necessary data is stored in log files:

• IP address of the requesting device
• date and time of access
• requested address and amount of data transferred
• status message indicating whether the request was successful
• browser type and operating system
• previously visited page (referrer), if your browser transmits it

Purpose and legal basis: This data is needed to deliver the site, and we need it to detect attacks and malfunctions. The legal basis is our legitimate interest in a secure and functioning service (Art. 6(1)(f) GDPR).

Retention: The logs are continuously overwritten; only a limited amount is kept at any time. They are deleted as soon as they are no longer needed to detect malfunctions and attacks, at the latest when the website is next republished. The data is not combined with other data or analyzed for advertising purposes.

Hosting

The website runs on a server operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server is located in Germany (Falkenstein). Hetzner processes the data listed above solely on our behalf and in accordance with our instructions (processing on our behalf under Art. 28 GDPR).

Encryption

This site is delivered exclusively via HTTPS. Everything you enter here is encrypted on its way to us.

Fonts and images

Fonts (Outfit, Caveat) are embedded in the site and loaded from our own server. There is no connection to Google Fonts or any other third-party provider. The world maps used in the 3D visualization come from public-domain NASA datasets and are also hosted on our server.

Language choice (German/English)

This website is available in German and English. The first time you open the home page or the Academy page, a small script in your browser checks the language set there: if it is not German, we show you the English version. This check takes place only in your browser; nothing is stored, and nothing is sent to us or to third parties.

If you choose a language yourself using the “DE | EN” switch, your browser remembers this choice in its local storage (localStorage, entry kv_lang with the value de or en). The entry stays on your device, is not sent to our server, contains no information about you and is not used for tracking. It is strictly necessary to keep the language you explicitly chose (§ 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG) and therefore does not require consent. You can delete it at any time in your browser settings (site data for ki-verbindet.de).

3. When you submit a form

On the home page (German and English versions) there are two ways to contact us: the form in the phone graphic and the short form at the very bottom. In doing so, we process:

Information	Required?	Purpose
Name	yes	so we can address you
Email address	yes	for our reply
Mobile number	optional	in case you prefer a call
Selected topics and additional details	optional	so we can prepare the conversation
Partner code	optional	to attribute your inquiry to the partner who referred you

We also store which page the inquiry came from (for example the German or English home page), so we can reply in your language.

Purpose and legal basis: We process this information to answer your inquiry and to prepare a possible contract (Art. 6(1)(b) GDPR). Where no contract is being prepared, we rely on our legitimate interest in handling inquiries (Art. 6(1)(f) GDPR).

What happens to it: The inquiry is stored on our server, sent to us by email and added as a contact to our own customer management system (ERP). The ERP runs on our own servers; this is not a disclosure to third parties.

Retention: We keep inquiries for as long as needed to process them and to answer any follow-up questions, but no longer than three years after the last contact. If an order results, the statutory retention periods apply (up to ten years under § 147 of the German Fiscal Code, AO, and § 257 of the German Commercial Code, HGB). You can request deletion at any time, unless a retention obligation prevents it.

Protection against automated submissions: The form contains a field that is invisible to humans and only filled in by programs, and it limits the number of submissions per IP address. No external service such as reCAPTCHA is used.

Email delivery via Brevo

We use Brevo (Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany; a subsidiary of Sendinblue SAS, Paris) to send notifications. Your name, email address and the content of your inquiry are transmitted to Brevo so the message can be delivered. Brevo processes this data solely on our behalf; processing takes place within the EU. The legal basis is Art. 6(1)(b) and (f) GDPR.

Appointment booking via Calendly

After you submit a form, a “Book your first call” button appears. Only when you click it are you redirected to Calendly (Calendly, LLC, USA). Your name, email address and, if applicable, your partner code are passed to Calendly so you don’t have to fill in the fields again. As long as you don’t click, no connection to Calendly is made.

Calendly also processes data in the USA. Calendly, LLC is certified under the EU-U.S. Data Privacy Framework; as a result, an adequacy decision of the European Commission serves as the basis for the transfer (Art. 45 GDPR). The legal basis for passing on your data is the consent you give by clicking, or the performance of pre-contractual measures (Art. 6(1)(a) and (b) GDPR). Calendly’s privacy policy also applies.

Partner codes

If you arrive via a partner’s link or enter a code, we store this code together with your inquiry. It is used solely to attribute the referral to the right partner and to settle the agreed commission. The partner receives no personal data about you from us, only the information that an inquiry was received via their code. The legal basis is our legitimate interest in accurate billing (Art. 6(1)(f) GDPR).

4. KI verbindet Academy (academy.ki-verbindet.de)

At academy.ki-verbindet.de we operate our own online learning platform. Unlike this website, you need a user account there. That is why we process more data in the Academy. This section sets out in full which data we process, for what purpose and for how long.

Account and sign-in

Information	Required?	Purpose
Email address	yes	sign-in and contact regarding your access
Name	optional, needed for the certificate	addressing you and the name on the certificate
Password	yes	sign-in; only a verification value is stored (salted scrypt hash), never the password itself
Selected interface language (for example German or English)	optional	showing the Academy in your language, also on other devices, and the language of the certificate and emails
Account status, role, origin of the account (access request or invitation), date of creation and of the last sign-in	automatic	operating and protecting the account
Number of failed attempts, temporary lock	automatic	protection against password guessing
Unlocked courses (which courses, since when, by which route)	automatic	access to the courses

An account is created in only two ways: we approve your access request (see below), or we invite you. We review every approval personally. With an invitation, you receive a link to set your password. Links for setting or resetting a password can be used only once and are valid for a limited time (invitation 72 hours, new password 60 minutes). We store only a verification value of these links, not the link itself. Passwords never appear in logs, emails or reports.

Sign-in cookie: After you sign in, the Academy sets the cookie kv_session. It contains only a random string, cannot be read by scripts, is transmitted only via HTTPS and expires after 30 days, or immediately when you sign out. Signing in would not be possible without this cookie. It is therefore strictly necessary and does not require consent (§ 25(2) no. 2 TDDDG). There are no other cookies.

Browser storage: The Academy stores three things only in your browser (localStorage), not with us: your language choice (kv_lang), a referral code if you arrive via a referral link (kv_ref; it stays in your browser until it is linked to your account after you sign in, or until you remove it or clear the site data, see below), and the check marks you set in exercise checklists. If you are signed in, we also store your language choice in your account. You can delete these browser entries at any time in your browser settings.

The legal basis is the performance of the user relationship, even if a course is free of charge (Art. 6(1)(b) GDPR). We base the protective measures against misuse on our legitimate interest in a secure service (Art. 6(1)(f) GDPR).

Access requests with your own password

Through the “Request access” form, we process your name, your email address, the courses you want, the password you choose (only as a verification value, see below), an access code if applicable and the information on who referred you (see below for both), together with your consent, including the date and the version of the consent text. We use this information to review the request and to set up your access. The notification we receive about a new request contains neither names nor email addresses.

Your password is never stored in plain text, only as an irreversible verification value (scrypt hash); no one at our company can read it. If we approve your request, it becomes the password of your account and is deleted from the request. If we decline the request, we delete the verification value immediately. If an account already exists for your address, we do not store a new password; a request never changes an existing password. If another request with a different password arrives for the same address, we use neither; access is then granted via an invitation link.

The legal basis is the preparation of the user relationship (Art. 6(1)(b) GDPR). We also record the consent you give in the form (Art. 6(1)(a) GDPR); you can withdraw it at any time with effect for the future. Retention: We automatically delete requests 30 days after our decision, and requests that were never processed after 90 days. If we approve the request, an account is created as described above.

Access with an access code

For specific campaigns, for example a pre-sale, an event or a partner, we issue access codes, usually as a link. An access code does not unlock anything by itself: you use it to submit a normal access request (see above), and we review and approve every request personally. No online payment takes place; you receive the invoice separately after your access has been unlocked.

In addition to your request data, we store the access code you entered. This lets us match your request to the campaign, the courses and the campaign price for the later invoice. If we approve the request, we record for which account, which courses, when and by whom the approval via this code was granted. We also note in your account which campaign you came through, so that information and offers for one campaign don’t reach participants of another. Only we can see this information in the administration area (user list and CSV export for invoicing); every export is recorded in our internal log. People who use a code cannot see who else has used it. We do not store IP addresses in this process.

The legal basis is the preparation and performance of the user relationship (Art. 6(1)(b) GDPR), and for invoice data our statutory retention obligation (Art. 6(1)(c) GDPR). Retention: As with any access request, we delete the request 30 days after our decision, and unprocessed requests after 90 days. The approval and the campaign remain with your account. If we delete your account, we also remove your details from the approval record; all that remains is the fact that a campaign spot was taken, without any reference to you. What we must keep for invoices is covered in the next section.

Invoices

Online payment is currently not active in the Academy. If access is subject to a fee, we issue the invoice separately after unlocking your access and send it to you by email. For this we process your name, email address, billing address, the service and the amount. The legal basis is our statutory bookkeeping obligation (Art. 6(1)(c) GDPR). We keep invoice data for as long as the law requires (up to ten years under § 147 AO and § 257 HGB); until then, we restrict its processing. If we introduce online payment, we will update this policy beforehand.

Learning progress and answers

So that you can pick up where you left off, we store for each learning station: whether and when you completed it, whether a quiz answer was correct, and your free-text answers to practical tasks, including drafts. For interactive exercises, we only store that you completed them.

No person evaluates your learning success. We do not read or grade your free-text answers, and they are not shown in the administration area. There we only see how many stations you have completed in each course and when you last signed in — for example to help with questions or to issue the certificate. No AI service analyzes your answers either.

Please do not enter other people’s data, health data or trade secrets in free-text fields. The tasks can always be solved with examples.

If we revise courses and a station is removed, your answers to that station remain stored but are no longer displayed. They are deleted together with the account, or earlier on request. The legal basis is Art. 6(1)(b) GDPR. Retention: same as the account.

Foundation Certificate and public verification page

Once you have completed all courses, you can have the Foundation Certificate issued. Beforehand, you confirm how your name should appear on it. We store the confirmed name, a random certificate number (format KV-FC-XXXX-XXXX-XXXX), the date of issue, the course scope and, if applicable, a revocation. Only you can download the PDF, and only while signed in.

So that third parties, such as an employer, can check that it is genuine, there is a public verification page at academy.ki-verbindet.de/zertifikat/ followed by the certificate number. The QR code on the PDF leads there. Anyone who knows the link or the number can see: your name, the certificate title, the course scope, the date of issue and whether the certificate is valid or revoked. Your email address, your internal user number and your learning progress are not visible. The number is random and cannot be guessed, the page is blocked for search engines, and the number of lookups is limited. You decide who gets the link.

The legal basis is Art. 6(1)(b) GDPR, because verifiability is part of the certificate. Retention: same as the account. If we delete your account, the certificate is deleted too, and the verification page reports “not found”. Copies that others have already saved are beyond our control.

Referrals

Every account has a personal referral link. There is currently no commission or payout for referrals.

• When someone opens a referral link, we store only the referral code and the time, without IP address and without device data. To prevent the counter from being artificially inflated, we count at most one visit per IP address and code per day. For this, the IP address is held only briefly in memory, is not stored and expires automatically. We delete these visits after 90 days.
• If you arrive via a referral link or state who referred you in your access request, we store who referred you with your request and, once your access is unlocked, with your account. If your information cannot be matched to an account, we store the text you entered (up to 40 characters) and may match it ourselves. This also shows who referred the referring person (second level); there are no further levels. Only we can see names and email addresses in this attribution, in the administration area.
• The referring person only sees numbers: how often their link was opened in the last 90 days, how many accounts were created directly through it and how many at the second level. They do not see the names, email addresses, dates or learning progress of the people they referred. However: with very small numbers, for example the first sign-up, they may be able to infer that a specific person has signed up if they know whom they sent the link to.

We use the attribution to keep track of referrals and possibly to compensate partners later. The legal basis is our legitimate interest in making referrals traceable and protecting the counter against misuse (Art. 6(1)(f) GDPR). You can object to this at any time. Retention: We delete the information in the request together with the request, and the attribution in the account together with the account; on request, we remove it earlier.

Emails from the Academy

The Academy itself currently sends no emails. We let you know personally about your unlocked access, invitation links and password links, for example from our email inbox.

Only if we activate automatic sending (currently not active): the Academy will then send only emails for resetting and changing your password via Brevo (Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany). For this, Brevo receives your email address and the content of the email, including a time-limited link, and processes them on our behalf (Art. 28 GDPR) within the EU. The emails show our logo, which is loaded from our own server when you open them, provided your email program displays images. As with any page request, our server sees your IP address and the time (see server logs in section 2). There is no tracking pixel, and we do not analyze whether or when you open an email. If we extend sending to other purposes, we will update this policy beforehand.

Security and logs

The Academy can only be accessed via HTTPS. We limit sign-in attempts, requests and verification page lookups per IP address and per email address. These counters are held only in memory and expire after a short time. For access to the server, section 2 (server logs) applies accordingly.

What we do as administrators (for example unlocking access, creating access codes, exporting lists, locking or deleting an account, revoking a certificate) is recorded in an internal log. Affected persons appear there only with their internal user number and a shortened email address (such as m***@example.com) and, if applicable, the certificate number; for access codes, the log also includes the campaign and the reason, which we enter ourselves as free text. Partner names and free-text referral information are not included. These entries are kept for 365 days, even after an account is deleted, so that changes remain traceable, and are then deleted automatically. The legal basis is our legitimate interest in secure and traceable operation (Art. 6(1)(f) GDPR).

Hosting and backups

The Academy runs on the same server as this website at Hetzner Online GmbH in Germany (see section 2, processing on our behalf under Art. 28 GDPR). We run the database (PostgreSQL) ourselves on this server; it cannot be accessed from outside. The database is backed up daily. The backups are also stored on the server at Hetzner in Germany and are overwritten after 14 backups (about 14 days). By then at the latest, deleted data is also gone from the backups.

Retention and deletion

Data	How long
Account, language choice, learning progress, answers, unlocked courses, certificate, referral attribution, campaign	until the account is deleted
Approval via an access code	until the account is deleted; afterward only the taken spot remains, without personal reference
Sign-in session	30 days, or immediately on sign-out
Invitation and password links	valid for 72 hours or 60 minutes respectively, deleted 7 days after expiry or use
Access requests (with password verification value, access code, referral information)	30 days after our decision, unprocessed requests after 90 days; the password verification value immediately if declined
Referral link visits	90 days
Internal log (shortened information)	365 days
Invoice data	statutory retention period, up to ten years
Backups	14 backups (about 14 days)

The Academy applies the periods in this table automatically. We do not delete accounts automatically, but at your request: an email to info@ki-verbindet.de is enough. We then delete your account with your learning progress, answers, unlocked courses, certificate, open links, sessions and access requests; your details are removed from approvals via an access code. Referral attributions from other accounts to your account are removed. The only exceptions are data we must keep for invoices and the shortened entries in the internal log. Your other rights, including the right to a copy of your data, are listed in the section “Your rights”.

5. Use of artificial intelligence

We develop AI-powered software. That is why we are open about what does and does not happen on this website:

• There is no chatbot or automated dialog system on this website. What you write in the forms is read by people.
• There is no automated decision-making or profiling within the meaning of Art. 22 GDPR. We decide ourselves whether and how we respond to your inquiry.
• Parts of the texts and design of this website were created with the help of AI systems and then reviewed by us. We point this out here because Art. 50 of the EU AI Act (Regulation (EU) 2024/1689) requires transparency about AI-generated content and about interaction with AI systems.
• Your inquiries are not used to train AI models — neither by us nor by passing them on to third parties.
• If we use AI systems in a project for you, we agree on the purpose, data flow, role under the EU AI Act and, where necessary, a data processing agreement in writing beforehand in the respective project contract.

6. Recipients of your data at a glance

Recipient	Purpose	Location
Hetzner Online GmbH	server operation (website and Academy)	Germany
Brevo GmbH	sending notifications; for the Academy only password emails, if activated (currently not active)	EU
Calendly, LLC	appointment booking, only after your click	USA (EU-U.S. DPF)

We do not pass on your data beyond this. Data is only disclosed to authorities if we are legally obliged to do so.

7. Your rights

You have the following rights with respect to us:

• Access to the data we process about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interest (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

An informal email to info@ki-verbindet.de is sufficient.

Right to lodge a complaint: You can lodge a complaint with a data protection supervisory authority at any time (Art. 77 GDPR), for example with the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestr. 2–4, 40213 Düsseldorf, Germany.

8. Changes

We update this policy when technology or the legal situation changes. The version published here applies.