·LEGAL

Privacy Policy

As of: 2 October 2026 · Information pursuant to Art. 13 and Art. 14 GDPR and § 25 TDDDG. Translation provided for reference only. The German version is legally binding.

1. Privacy at a glance

General information

The following notes give a simple overview of what happens to your personal data when you visit this website or get in touch with us. Personal data is any data that can be used to identify you personally. For detailed information, please see the further sections of this privacy policy.

Who is responsible for data collection?

Data processing on this website is carried out by the website operator (contact details in Section 2 and the Imprint).

How do we collect your data?

Data is collected partly because you actively provide it to us, for example via a form or by email. Other data is collected automatically by the server when you visit the website, primarily technical data such as browser, operating system, or time of access (server log files). We also collect business contact data of companies from publicly available sources (see Section 13).

What do we use your data for?

Part of the data serves to ensure error-free provision of the website. We use other data to handle your requests. Reach measurement and the map display are only activated with your consent (see Section 12). Automated decision-making within the meaning of Art. 22 GDPR does not take place.

What rights do you have regarding your data?

You have the right at any time to information, correction, deletion, restriction of processing, data portability, and objection (see Section 14). You also have the right to lodge a complaint with the competent supervisory authority.

2. Controller

The controller responsible for data processing on this website is:

GermanAI Defense GmbH
Neue Mainzer Straße 6-10
60311 Frankfurt am Main
Germany

Phone: 06171 277 98 71
Fax: +49 (0) 69 50 50 60 4155
E-Mail: info@germanaidefense.de
Managing Director: Abdussamed Nazik

Data protection officer

You can reach our data protection officer at the address above, marked “Data Protection Officer”, or by email to info@germanaidefense.de with the subject “Datenschutzbeauftragter” (data protection officer). We forward messages with this subject unopened.

3. General information and mandatory disclosures

Data protection

We take the protection of your personal data seriously. We treat it confidentially and in accordance with the legal data-protection regulations and this privacy policy. Complete protection of data against access by third parties during transmission over the open internet is not technically possible.

Protection of vulnerable groups / children

Our website and services are not specifically aimed at children under the age of 16. We do not knowingly process personal data of children within the meaning of Art. 8 GDPR. If we inadvertently learn of data from children, we delete it without delay in accordance with Art. 17 GDPR.

Special categories of data (Art. 9 GDPR)

We do not request special categories of personal data pursuant to Art. 9 GDPR (e.g., health, religious, or political data) on this website. If you provide such data on your own initiative, for example in an application, Section 9 applies.

Automated decision-making / profiling

Automated decision-making or profiling within the meaning of Art. 22 GDPR does not take place. In particular, we do not deploy AI systems on the website that analyze or evaluate visitor input or behavioral data, even though our business itself includes AI-powered security solutions.

4. Legal bases of processing

We process personal data on the basis of the GDPR:

  • Art. 6 (1)(a) GDPR: consent
  • Art. 6 (1)(b) GDPR: performance of a contract or pre-contractual measures
  • Art. 6 (1)(c) GDPR: compliance with legal obligations
  • Art. 6 (1)(f) GDPR: legitimate interests (e.g., secure operation of the website, handling of requests, B2B business development)

Storing information on your device and accessing it (cookies, local storage) is additionally governed by § 25 TDDDG: where access is strictly necessary for a service you have expressly requested, we rely on § 25 (2) no. 2 TDDDG. In all other cases, we obtain your prior consent under § 25 (1) TDDDG. Consent can be withdrawn at any time with effect for the future.

5. Data processing and third countries

We generally process personal data within the European Union and the European Economic Area (EEA). The services embedded on this website are deliberately data-minimizing: hosting and email are operated in Germany, fonts and spam protection run on our own server, and reach measurement (Plausible) is cookieless and runs on servers within the EU. The map display (OpenStreetMap) is provided by the OpenStreetMap Foundation, based in the United Kingdom, for which an adequacy decision of the EU Commission under Art. 45 GDPR exists. The OpenStreetMap Foundation uses its own service providers to deliver the map material; we cannot rule out processing outside the EU and the United Kingdom. The map is only loaded with your consent (see Section 12).

A transfer to the United States may occur in individual cases if you hold an online meeting with us via Microsoft Teams (see Section 8). Microsoft is certified under the “EU-US Data Privacy Framework” (DPF); in addition, Microsoft's contract terms provide for standard contractual clauses under Art. 46 GDPR. Beyond that, the website itself does not transfer data to third countries without an adequacy decision.

Recipients of personal data

Personal data is only transferred where this is necessary for the performance of a contract, where we are legally obliged to do so, where we have a legitimate interest under Art. 6 (1)(f) GDPR, or where another legal basis permits the transfer. We use processors (Art. 28 GDPR) for hosting (Section 6), email (Section 6), reach measurement (Section 12) and online meetings (Section 8). They process data only on our instructions.

6. Hosting, email and infrastructure

Hosting

This website, form processing, the user account and our internal business development tool run on servers of:

  • Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Data center in Nuremberg

We use the hosting provider as a processor under Art. 28 GDPR.

Email

For our mailboxes and for sending emails we use the following processor:

  • STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany

Content you send via our forms (contact, demo, quote request, application, newsletter confirmation) is delivered by email to our mailbox at STRATO and stored there. The same applies to emails you send us directly and to emails we send you. The legal basis is that of the underlying processing (see Sections 8 to 11).

7. Collection and processing when visiting the website

Server log files

When you visit our website, technical information is automatically stored in server log files:

  • IP address
  • Date and time of access
  • Page accessed (URL)
  • Amount of data transferred
  • Browser type and version
  • Operating system
  • Referrer URL

This data is processed solely to secure operation, analyze errors and defend against attacks (legal basis: Art. 6 (1)(f) GDPR). It is not combined with other data sources. Server log files are deleted after 30 days at the latest, unless they are needed longer to investigate or defend against a specific security incident.

Cookies and browser storage (local storage)

Our website uses cookies and your browser's storage (local storage and session storage). Small data packets are stored on your device. We use:

  • Strictly necessary storage: your privacy settings, the login cookie of the user account (see Section 11) and the drafts and request list of the quote request (see Section 8). The legal basis is § 25 (2) no. 2 TDDDG and, for any related processing of personal data, Art. 6 (1)(f) GDPR.
  • Functional (only with consent): the OpenStreetMap map display (see Section 12).
  • Statistics (only with consent): cookieless reach measurement with Plausible (see Section 12).

Services requiring consent are only loaded after your consent under Art. 6 (1)(a) GDPR and § 25 (1) TDDDG. You can withdraw or change your consent at any time via the “Cookie settings” link in the footer of every page. You can also set your browser to allow cookies and local storage only in individual cases or to block them entirely.

Spam protection for forms (ALTCHA)

To protect our forms against automated spam, we use ALTCHA. The software is installed on our own server; no third-party provider is involved. As soon as you click into a form field, your browser loads a computational task from our server and solves it in the background (proof of work). The result is submitted with the form and verified on our server. ALTCHA sets no cookies and does not analyze usage behavior. Only technical request data is processed (in particular the IP address, see server log files). The legal basis is our legitimate interest in functioning forms free from abuse (Art. 6 (1)(f) GDPR). For the same reason, we limit the number of form submissions per IP address and time period.

SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, this website uses SSL/TLS encryption. You can recognize an encrypted connection by “https://” in the address bar and the lock icon in your browser.

8. Contact, demo and quote requests

Contact form and demo request

Via our contact form and the demo request form we collect the following data:

  • Name (required)
  • Company (required or optional, depending on the form)
  • Email address (required)
  • Phone number (optional)
  • Topic (selection, where offered)
  • Message (required in the contact form, optional for demo requests)
  • Confirmation that you have read the privacy notice (checkbox)

Quote request and request list

On the “Request a quote” pages you can fill in a short questionnaire for individual services (e.g., cybersecurity, GRC, AI Solutions, data center, GAD Academy, RedMentis). Your selection is initially stored as a draft only in your browser's storage (local storage) and collected in a request list. This data only leaves your device when you submit the request. You can delete the drafts yourself at any time by removing them from the request list or clearing your browser storage. If you are logged into your user account, you can also save drafts in your account (see Section 11).

When submitting, you send us:

  • Name, company and email address (required)
  • Phone number and a note (optional)
  • Your selection per service from the request list
  • Confirmation that you have read the privacy notice (checkbox)

Purpose and legal basis

We process this data to answer your request, arrange a demo or prepare a quote. The legal basis is Art. 6 (1)(b) GDPR where your request is aimed at concluding a contract or concerns pre-contractual measures. In all other cases, processing is based on our legitimate interest in handling requests addressed to us (Art. 6 (1)(f) GDPR). The content is processed on our server and delivered by email to our mailbox (see Section 6). We do not pass it on to third parties without your consent, unless this is necessary to carry out the requested project and you have been informed in advance.

By ticking the checkbox in these forms, you only confirm that you have read this privacy notice. It is not consent within the meaning of Art. 6 (1)(a) GDPR.

Requests by email or phone

If you contact us by email or phone, your request and the resulting personal data are stored by us for the purpose of handling your request. The legal basis is Art. 6 (1)(b) or (f) GDPR as described above.

Storage period

We delete requests once they have been dealt with and no retention obligation applies, at the latest after three years. If a contract is concluded or the data constitutes business correspondence, we retain it for the statutory periods (§ 257 HGB, § 147 AO: six or eight years for commercial and business letters and accounting records). You can request deletion at any time unless a retention obligation applies.

Online meetings and video conferences (Microsoft Teams)

For consulting, demo and coordination meetings, we use Microsoft Teams after prior appointment (provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). This function is not embedded on the website; processing only takes place if you actively take part in such a meeting.

In particular, your name, your email address, meeting metadata (time, duration, IP address) and the audio, video and chat content you transmit are processed. Meetings are not recorded without explicit notice and your consent. The legal basis is Art. 6 (1)(b) GDPR (pre-contractual or contractual measures) or Art. 6 (1)(f) GDPR (legitimate interest in efficient communication). We use Microsoft as a processor under Art. 28 GDPR. For a possible transfer to the United States, see Section 5. Further information: privacy.microsoft.com.

9. Processing in the application process

If you apply to us, via the application form in the careers section (including uploading your CV), via your user account or by email, we process the personal data you submit solely to carry out the application process.

What data we process

  • Master and contact data (name, email, phone number, optionally salutation)
  • Details on the position (salary expectation, earliest start date, how you heard about us)
  • Application documents (cover letter, CV, references, certificates)
  • Data from interviews and aptitude assessments
  • Other information voluntarily provided as part of the application

Purpose and legal basis

Processing serves the decision on establishing an employment relationship. The legal basis is Art. 6 (1)(b) GDPR (steps prior to an employment relationship at your request). After the process has ended, we process the data until the end of the storage period on the basis of our legitimate interest in defending against possible legal claims (Art. 6 (1)(f) GDPR). If you voluntarily provide special categories of personal data (Art. 9 GDPR, e.g., a severe disability), we only process them to the extent necessary for the process, for example to fulfil obligations under employment and social security law (Art. 9 (2)(b) GDPR).

Recipients

Your application data is only viewed by persons involved in the application process (management, HR if applicable, line managers). Technically, it is stored on our server and in our mailbox (see Section 6). It is only passed on to other third parties where required by law.

Storage period

If you are hired, your data is transferred to your personnel file. If you are not hired, we delete your application documents no later than six months after the application process has ended. This period serves to defend against possible claims under the German General Equal Treatment Act (AGG, § 15 (4) AGG and § 61b ArbGG). If legal proceedings are pending at that time, we store the data until they are concluded. This also applies to files uploaded via your user account. Technically, we automatically delete application files stored on our server 180 days after upload and the copy of your application in your user account 180 days after it was last changed.

Inclusion in our talent pool

In the application form, we offer you the option of consenting separately and voluntarily to inclusion in our talent pool. In this case, we store your application documents beyond the current process so that we can consider you for suitable future positions. The legal basis is your consent under Art. 6 (1)(a) GDPR. Storage lasts for a maximum of six months after the process has ended; you can withdraw your consent at any time with effect for the future by informal email to info@germanaidefense.de, after which we will remove your data from the talent pool. We automatically delete the record of your consent (time, name, email address, IP address) twelve months after we receive your application.

10. Newsletter and mailing lists

If you subscribe to our newsletter or a mailing list, we collect the data entered in the form (at least your email address) and use it solely to send the requested information. Registration uses the double opt-in procedure: after you enter your email address, we send a confirmation email; your data is only used for sending after you confirm this link.

The legal basis is your consent under Art. 6 (1)(a) GDPR. You can withdraw this consent at any time with effect for the future by clicking the unsubscribe link in any newsletter email and in the subscription confirmation email or by informal notice to info@germanaidefense.de. The lawfulness of processing carried out before withdrawal remains unaffected. After unsubscribing, your data is removed from the mailing list.

We keep the record of your consent (email address, name, time of confirmation, IP address) and the time of any unsubscription for as long as you are subscribed and for three years after you unsubscribe. This allows us to prove that you had consented (Art. 7 (1) GDPR) and to defend ourselves against claims. The legal basis is Art. 6 (1)(c) and (f) GDPR. After that, we delete the record automatically.

11. User account

You can create a personal user account on this website to manage drafts, requests and applications in one place. Creating an account is voluntary; all functions of the website (contact form, application, newsletter, quote request) can also be used without an account.

Data collected during registration and in the account

  • Required: first and last name, email address, password (stored as a bcrypt hash, never in plain text)
  • Optional: phone number, company, role/position, address, industry, profile type
  • Account data arising from use: saved request drafts (your selection per service), bookmarked services, request list content, submitted requests, submitted applications with attached files, active login sessions

Legal basis and purpose

By registering, you conclude a free-of-charge user agreement with us for the account. The legal basis is therefore Art. 6 (1)(b) GDPR. The purpose is the personal management of your requests, drafts and applications and communication with you. The checkbox at registration only confirms that you have read the privacy notice; it is not consent.

Login sessions (cookies)

When you log in, a strictly necessary session cookie (session ID) is set. This cookie is HttpOnly, Secure and SameSite=Lax; it cannot be read by JavaScript and is only transmitted to GermanAI Defense GmbH's own server. The cookie is valid for 7 days and is deleted immediately on logout. The legal basis is § 25 (2) no. 2 TDDDG (strictly necessary cookie).

Storage period and deletion

Account data is stored as long as your account exists. You can have your account deleted at any time via the account area or by informal email to info@germanaidefense.de. After deletion, personal profile data is removed immediately. Drafts saved in the account are deleted and the copies of your applications in the account are anonymized automatically 30 days after deletion. Submitted requests and applications remain subject to the storage periods in Sections 8 and 9.

Data security

Passwords are stored exclusively as bcrypt hashes. Application files and sensitive content are stored outside the public web root on GermanAI Defense GmbH's server. Access to account data is always encrypted (HTTPS).

12. Plugins and tools

OpenStreetMap

On the contact page and the About us page, you can display a map of our location from OpenStreetMap. The provider is the OpenStreetMap Foundation (OSMF), St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. The map is only loaded once you activate the “Functional” category in the privacy settings. Your IP address is then transmitted to the servers of the OSMF and its service providers so that the map material can be loaded.

The legal basis is your consent (Art. 6 (1)(a) GDPR, § 25 (1) TDDDG). You can withdraw consent at any time via “Cookie settings” in the footer. An adequacy decision of the EU Commission under Art. 45 GDPR exists for the United Kingdom; for service providers outside the EU, see Section 5. We base any such transfer on your explicit consent (Art. 49(1)(a) GDPR), given by activating the ‘Functional’ category. Please note: such countries may not offer an equivalent level of data protection, and authorities may be able to access the data. Without consent, you can find our location via the “Open in OpenStreetMap” link. OSMF privacy policy: wiki.osmfoundation.org/wiki/Privacy_Policy.

Plausible Analytics

For reach and usage statistics we use Plausible Analytics (provider: Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia). The analytics script is loaded from the provider's servers within the European Union. Plausible sets no cookies and does not use cross-device recognition. IP addresses are processed only in hashed form and are not stored permanently, so no conclusions about individual persons are possible.

On our website Plausible is loaded only after your active consent via the consent banner (“Statistics” category). The legal basis is therefore your consent under Art. 6 (1)(a) GDPR in conjunction with § 25 (1) TDDDG; consent can be withdrawn at any time with effect for the future. We use Plausible as a processor under Art. 28 GDPR. Privacy policy: plausible.io/privacy.

Voice assistant (ElevenLabs)

On our website you can ask an AI questions by voice ("Talk to GAD"). The feature only starts when you click "Start conversation" and your browser allows microphone access. No connection is made before that. You are talking to an AI, not a person.

During the conversation your microphone audio is sent to the provider Eleven Labs, Inc. (USA), converted to text there, answered by a language model and played back as speech. Your IP address and technical connection data are processed as well. We do not store an audio recording. The conversation text is kept by the provider for at most 30 days and then deleted; we only use it to fix errors and improve the answers. A conversation lasts up to 2 minutes, and one conversation per day is possible. For this, your browser stores only the date of the last conversation locally (entry “gad-voice-tag”); it is not sent to us and can be deleted in your browser settings. Please do not share confidential or personal data.

The legal basis is your consent, given by clicking "Start conversation" (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can end the conversation at any time. We base the transfer to the USA on your explicit consent (Art. 49(1)(a) GDPR) and on the EU Commission's standard contractual clauses; for third countries see section 5. Provider's privacy policy: elevenlabs.io/privacy-policy.

Locally hosted fonts

For consistent font display, this website uses only fonts stored locally on our server. When pages are accessed, no connection to third-party servers (such as Google Fonts or Adobe Fonts) is established; no personal data is transferred to third parties for this purpose.

Security news (news ticker)

We fetch the items in the “Current threat landscape” section and their preview images on our own server and deliver them from there. No connection to the servers of the news sources is established when you open the page. Only when you click an item do you open the website of the respective source, where its privacy policy applies.

Links to social networks

We show selected posts from our Instagram and LinkedIn profiles as our own, locally stored view. When you visit our site, no content is loaded from Instagram or LinkedIn and no data is transferred to these providers. Only when you click a link do you open the provider's site (Meta Platforms Ireland Ltd. or LinkedIn Ireland Unlimited Company); their privacy policy applies there.

Our presence on social networks (Instagram, LinkedIn)

We operate company profiles on Instagram (provider: Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland) and LinkedIn (provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland). The purpose is to inform you about our company, our services and open positions and to get in touch with you. The legal basis is our legitimate interest in this public relations work (Art. 6 (1)(f) GDPR).

When you visit our profiles, follow them or interact with posts, the respective provider processes your data and uses it to create page statistics (“Insights”), for example on reach, interactions and aggregated information on industry, job function or country. We are jointly responsible with the provider for these statistics (Art. 26 GDPR). We only receive aggregated reports and cannot attribute them to individual persons. The essence of the Art. 26 GDPR arrangements: the provider has primary responsibility for processing the Insights data, fulfils the information obligations, ensures the security of the data and is the first point of contact for your rights.

The providers may also process data outside the EU, in particular in the USA. According to their own information, they base such transfers on the EU-US Data Privacy Framework or on standard contractual clauses. We have only limited influence on the processing by the providers.

You can exercise your rights (Section 14) both against the provider and against us. A request directly to the provider is fastest, as only the provider has access to the user data. If you contact us, we will forward your request. We process messages you send us via these profiles to answer your request (Art. 6 (1)(b) or (f) GDPR) and delete them when they are no longer needed.

13. Business contacts from public sources (Art. 14 GDPR)

This section informs persons whose data we have not collected from them directly. We approach companies and public authorities for which our services are relevant (B2B business development). For this we use an internal business development tool on our own server.

Categories of data

  • Company data: name, address, industry, website, general phone number and email address, publicly stated figures (e.g., number of employees, year founded)
  • Contact person data: name, function (e.g., management) and business contact details, where published by the company
  • Our own notes: status of contact, conversation notes, appointments, an internal assessment of whether our services fit the company, and any objection

Sources

The data comes from publicly available sources: company websites and imprints, the OpenStreetMap map service and the free database Wikidata. We receive data from conversations from you directly.

Purpose, legal basis and legitimate interest

The purpose is to initiate business relationships with companies and public authorities. The legal basis is Art. 6 (1)(f) GDPR. Our legitimate interest is direct marketing to business customers (Recital 47 GDPR). We only process business data that the company has published itself, and we do not send mass emails. We only send you promotional emails or call you within the limits of § 7 UWG (German Act against Unfair Competition).

Recipients

Only GermanAI Defense staff entrusted with sales have access. The data is stored on our server at Hetzner Online GmbH (see Section 6). It is not passed on to third parties.

Storage period

We store the data as long as a business relationship can be initiated. The data is deleted automatically 24 months after the last contact unless a contractual relationship has arisen. If a business relationship arises, the periods in Section 8 apply. If you have objected to being contacted, we keep a blocking note so that your objection is permanently respected: for a block covering an entire company only its domain and the reason for the block, for a block covering an individual person the contact entry marked as blocked.

Your right to object

You can object at any time, without giving reasons, to the processing of your data for direct marketing purposes (Art. 21 (2) GDPR), informally by email to info@germanaidefense.de. We then delete your data and only keep your contact details on a suppression list so that you are not contacted again (legal basis: Art. 6 (1)(c) and (f) GDPR).

14. Your rights

You have the following rights with respect to personal data concerning you:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object (Art. 21 GDPR)
  • Right to withdraw consent (Art. 7 (3) GDPR)
  • Right to lodge a complaint with the competent supervisory authority (Art. 77 GDPR)

Right to object (Art. 21 GDPR)

If data processing is based on Art. 6 (1)(e) or (f) GDPR, you have the right at any time to object to the processing of your personal data on grounds relating to your particular situation; this also applies to profiling based on these provisions. If your data is processed for direct marketing, you have the right to object at any time without giving reasons.

15. Supervisory authority

Competent supervisory authority:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Postfach 3163, 65021 Wiesbaden, Germany
datenschutz.hessen.de

16. Data security

We use technical and organizational security measures to protect your data against accidental or unlawful destruction, manipulation, loss or unauthorized access. Our security measures are continuously adapted in line with technological developments.

17. Status and changes

This privacy policy is current as of 2 October 2026. Changes to our website or to legal requirements may make adjustments necessary. The current version is always available on this page.