Privacy

General notes

This privacy policy explains in detail what happens to your personal data when you visit our website naointelligence.com. Personal data is any data that can be used to identify you personally. When processing your data, we strictly follow the legal requirements, in particular the General Data Protection Regulation („GDPR"), and we attach great importance to making sure your visit to our website is completely secure.

Controller

The party responsible under data protection law for the collection and processing of personal data on this website is:

Nao Intelligence GmbH
Niederrheinstr. 147
40474 Düsseldorf
Germany
Email: hello@naointelligence.com
Phone: +49 211 5425498-0

Access data (server log files)

When you visit our website, we automatically collect and store access data in so-called server log files, which your browser transmits to us automatically. These are:

• browser type and browser version
• operating system used
• referrer URL
• host name of the accessing device
• time of the server request
• IP address

As a rule, we are unable to link this data to a specific person, nor do we intend to. Such data is processed under Art. 6 (1) (f) GDPR to protect our legitimate interest in improving the stability and functionality of our website.

Cookies

To make visiting our website appealing and to enable the use of certain functions, we use so-called cookies. These are small text files stored on your device. Cookies cannot run programs or transfer viruses to your computer system.

Cookies that are necessary to carry out the electronic communication process or to provide certain functions you have requested are stored on the basis of Art. 6 (1) (f) GDPR. We have a legitimate interest in storing cookies in order to provide our services without technical errors and in an optimized way. Where other cookies (e.g. cookies to analyze your browsing behavior) are stored, these are addressed separately in this privacy policy.

Most of the cookies we use are so-called „session cookies". They are automatically deleted when your visit ends. Other cookies remain stored on your device until you delete them. These cookies allow us to recognize your browser on your next visit.

You can set your browser to inform you when cookies are placed and to allow cookies only in individual cases, to exclude the acceptance of cookies in certain cases or in general, and to enable the automatic deletion of cookies when the browser is closed. Disabling cookies may limit the functionality of this website.

Web analytics with Rybbit

On this website we use Rybbit, a cookieless, self-hosted web analytics tool, to evaluate the use of our website statistically and to improve what we offer. Rybbit runs on our own servers (location: Germany); no data is transmitted to third parties.

Rybbit uses no cookies and stores no information on your device. No data that directly identifies you is stored. Only aggregated information is recorded, such as pages viewed, time spent, referrer, approximate location (country/region), device type, browser and operating system. Your IP address is used solely to derive the approximate location and is not stored. To distinguish between visits, daily-rotating hashed identifiers are used that do not allow persistent recognition.

The legal basis is our legitimate interest in designing our website in line with actual needs and on a sound statistical footing under Art. 6 (1) (f) GDPR. Since Rybbit works without cookies and without accessing your device, no consent is required for this.

Session replay (recording of sessions)

To improve how users find their way around, we use Rybbit to record anonymized sessions (including mouse movements, clicks, scrolling behavior, page views). Input fields are masked by default; form pages (e.g. the contact form) are completely excluded from recording. The legal basis is our legitimate interest in designing our website in line with actual needs under Art. 6 (1) (f) GDPR. You can object to the recording at any time with effect for the future, via the „Privacy" button at the bottom left of every page or via the toggle below. The recordings are stored exclusively on our own servers (location: Germany) and are automatically deleted after 90 days.

LinkedIn Insight Tag (ad measurement)

If you choose “Accept” in the notice on your first visit, we embed the LinkedIn Insight Tag. The provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. The Insight Tag helps us understand whether visitors reached our website through a LinkedIn ad and which pages they view afterwards. To do so, a script is loaded from LinkedIn and LinkedIn sets cookies on your device. The data transmitted includes the URL visited, the referrer, your truncated IP address, device and browser data and a timestamp. LinkedIn provides this data to us in aggregated form only; we cannot identify individual people from it. LinkedIn, however, can recognise LinkedIn members from the data. The data is also transferred to the USA. LinkedIn is certified under the EU-US Data Privacy Framework; in addition, the EU Commission’s standard contractual clauses apply.

The legal basis is your consent under Art. 6 (1) (a) GDPR and Section 25 (1) of the German TDDDG. Without your consent the Insight Tag is not loaded. You can withdraw your consent at any time with effect for the future, via the toggle in the “Session replay” section above or via the “Privacy” button at the bottom left of every page. LinkedIn deletes direct identifiers within seven days and the pseudonymised data within 180 days. Further information on data processing by LinkedIn and on objecting directly to LinkedIn is available at: https://www.linkedin.com/legal/privacy-policy and https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

Social media

1. LinkedIn plugin

Our website uses features of the LinkedIn network. The provider is LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA („LinkedIn"). To better protect your data when visiting our website, the LinkedIn plugins are not embedded without restriction but only via an HTML link (the so-called „Shariff" solution by c’t). This embedding ensures that, when you open a page of our website that contains such plugins, no connection to LinkedIn’s servers is established yet. Only when you click the LinkedIn button does a new browser window open and load the LinkedIn page.

You can find information about the purpose and scope of the data collection and the further processing and use of the data by LinkedIn, as well as your related rights and options for protecting your privacy, in LinkedIn’s privacy policy at: https://www.linkedin.com/legal/privacy-policy

Newsletter

If you have given your express consent, we will regularly send our newsletter to your email address. To receive our newsletter, you need to give us your email address and then verify it. Additional data is not collected, or is provided voluntarily. The data is used exclusively to send the newsletter. The data provided when signing up for the newsletter is processed solely on the basis of your consent under Art. 6 (1) (a) GDPR. You can revoke consent you have already given at any time. An informal message by email is enough to revoke it, or you can unsubscribe via the „Unsubscribe" link in the newsletter. The lawfulness of the data processing operations already carried out is not affected by the revocation. Data entered to set up the subscription is deleted if you unsubscribe. If this data was transmitted to us for other purposes and elsewhere, it remains with us.

Contact form

If you contact us by email or via a contact form, the data transmitted, including your contact details, is stored so that we can handle your request or be available for follow-up questions. This data is not passed on without your consent. The data entered into the contact form is processed solely on the basis of your consent (Art. 6 (1) (a) GDPR). You can revoke consent you have already given at any time. An informal message by email is enough to revoke it. The lawfulness of the data processing operations carried out up to the revocation is not affected by it.

Data transmitted via the contact form remains with us until you ask us to delete it, revoke your consent to storage, or there is no longer any need to store the data. Mandatory legal provisions, in particular retention periods, remain unaffected.

User account

When you open a user account, you consent to your master data such as name, address and email address as well as your usage data (username, password) being stored. This gives you the option to log in to us with your email address and your personal password.

Use and disclosure of data

We will neither sell nor otherwise market the personal data you provide to us, e.g. by email (such as your name and address or your email address), to third parties. Your personal data is processed only to correspond with you and only for the purpose for which you provided the data to us. To handle payments, we pass your payment data on to the bank tasked with the payment. Data automatically collected when you visit our website is used only for the purposes stated above. The data is not used in any other way. We assure you that we do not otherwise pass your personal data on to third parties unless we are legally obliged to do so or you have given us your prior consent.

SSL / TLS encryption

For security reasons and to protect the transmission of confidential content, such as requests you send to us as the site operator, our website uses SSL / TLS encryption. You can recognize an encrypted connection by the browser address bar changing from „http://" to „https://" and by the padlock symbol in your browser bar. When SSL / TLS encryption is active, the data you transmit to us cannot be read by third parties.

Handling of personal data

§ 1 Storage period

Personal data provided to us via our website is stored only until the purpose for which it was entrusted to us has been fulfilled. To the extent that retention periods under commercial and tax law must be observed, the storage period for certain data may be up to 10 years.

§ 2 Data subject rights

With regard to the personal data concerning you, as a data subject of the processing you have the following rights against the controller, in accordance with the legal provisions:

2.1 Right to withdraw consent

Many data processing operations are only possible with your express consent. Where the processing of your data is based on your consent, you have the right under Art. 7 (3) GDPR to withdraw consent you have given to the processing of data at any time with effect for the future. Withdrawing consent does not affect the lawfulness of the processing carried out on the basis of the consent up to the withdrawal. The storage of data for billing and accounting purposes is not affected by a withdrawal.

2.2 Right of access

Under Art. 15 GDPR you have the right to ask us to confirm whether we process personal data concerning you. Where such processing takes place, you have the right to information about your personal data processed by us, the purposes of the processing, the categories of personal data processed, the recipients or categories of recipients to whom your data has been or will be disclosed, the planned storage period or the criteria for determining the storage period, the existence of a right to rectification, erasure, restriction of processing, objection to processing, complaint to a supervisory authority, the origin of your data if it was not collected from you by us, the existence of automated decision-making including profiling and, where applicable, meaningful information about the logic involved and the significance and the envisaged consequences of such processing for you, as well as your right to be informed of the safeguards under Art. 46 GDPR that exist where your data is transferred to third countries.

2.3 Right to rectification

Under Art. 16 GDPR you have the right to demand at any time the prompt rectification of inaccurate personal data concerning you and/or the completion of your incomplete data.

2.4 Right to erasure

Under Art. 17 GDPR you have the right to demand the erasure of your personal data, provided one of the following grounds applies:

• a) your personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
• b) you withdraw your consent on which the processing was based under Art. 6 (1) (a) or Art. 9 (2) (a) GDPR, and there is no other legal basis for the processing;
• c) you object to the processing under Art. 21 (1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing under Art. 21 (2) GDPR;
• d) the personal data has been processed unlawfully;
• e) the erasure of the personal data is necessary to comply with a legal obligation under Union law or the law of the Member States to which we are subject.
• f) the personal data was collected in relation to information society services offered under Article 8 (1) GDPR.

However, this right does not apply where processing is necessary:

• a) for exercising the right to freedom of expression and information;
• b) to comply with a legal obligation that requires processing under the law of the Union or of the Member State to which we are subject, or to perform a task carried out in the public interest or in the exercise of official authority vested in us;
• c) for reasons of public interest in the area of public health under Art. 9 (2) (h) and (i) as well as Art. 9 (3) GDPR;
• d) for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes under Art. 89 (1) GDPR, where the data subject right is likely to render impossible or seriously impair the achievement of the objectives of that processing, or for the establishment, exercise or defense of legal claims.

If we have made your personal data public and are obliged to erase it under the above, we will, taking account of available technology and the cost of implementation, take reasonable measures, including technical ones, to inform controllers processing the personal data that you, as the data subject, have requested the erasure of all links to your personal data or of copies or replications of this personal data.

2.5 Right to restriction of processing

Under Art. 18 GDPR you have the right to demand the restriction of processing (blocking) of your personal data. To do so, you can contact us at any time at the address given in the imprint. The right to restriction of processing applies in the following cases:

• a) If you contest the accuracy of your personal data stored with us, we usually need time to verify this. For the duration of the verification, you have the right to demand the restriction of the processing of your personal data.
• b) If the processing of your personal data happened / is happening unlawfully, you can demand the restriction of the data processing instead of erasure.
• c) If we no longer need your personal data but you need it for the exercise, defense or establishment of legal claims, you have the right to demand the restriction of the processing of your personal data instead of erasure.
• d) If you have filed an objection under Art. 21 (1) GDPR, a weighing of your interests and ours must be carried out. As long as it has not yet been determined whose interests prevail, you have the right to demand the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, this data, apart from being stored, may only be processed with your consent or for the establishment, exercise or defense of legal claims or to protect the rights of another natural or legal person or for reasons of an important public interest of the European Union or a Member State.

2.6 Right to be informed

If you have asserted the right to rectification, erasure or restriction of processing against us, we are obliged to notify all recipients to whom your personal data has been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves disproportionate effort. Under Art. 19 GDPR you have the right to be informed about these recipients on request.

2.7 Automated decisions in individual cases including profiling

Under Art. 22 GDPR you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision

• a) is necessary for entering into or performing a contract between you and us,
• b) is permitted by Union or Member State law to which the controller is subject, and that law contains appropriate measures to safeguard your rights and freedoms and your legitimate interests, or
• c) is made with your express consent.

However, the decisions in the cases mentioned in (a) to (c) may not be based on special categories of personal data under Art. 9 (1) GDPR, unless Art. 9 (2) (a) or (g) applies and appropriate measures to protect your rights and freedoms and your legitimate interests have been taken. In the cases mentioned in (a) and (c), we take appropriate measures to safeguard your rights and freedoms and your legitimate interests, including at least the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.

2.8 Right to data portability

Where the processing is based on your consent under Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR or on a contract under Art. 6 (1) (b) GDPR and is carried out by automated means, you have the right under Art. 20 GDPR to receive the personal data you have provided to us in a structured, commonly used and machine-readable format and to transmit it to another controller, or to demand that it be transmitted to another controller, where this is technically feasible.

2.9 Right to object

To the extent that we base the processing of your personal data on the balancing of interests under Art. 6 (1) (f) GDPR, you have the right at any time, on grounds relating to your particular situation, to object to the processing of your personal data; this also applies to profiling based on this provision. You can find the respective legal basis on which any processing is based in this privacy policy. If you object, we will no longer process your affected personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims (objection under Art. 21 (1) GDPR). If your personal data is processed for direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling insofar as it is related to such direct marketing. If you object, your personal data will subsequently no longer be used for the purpose of direct marketing (objection under Art. 21 (2) GDPR). In connection with the use of information society services, notwithstanding Directive 2002/58/EC, you have the option of exercising your right to object by automated means using technical specifications.

2.10 Right to lodge a complaint with the competent supervisory authority under Art. 77 GDPR

In the event of breaches of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work or the place of the alleged breach. The right to complain applies without prejudice to any other administrative or judicial remedy. The supervisory authority competent for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Postfach 20 04 44
40102 Düsseldorf

Kavalleriestraße 2-4
40213 Düsseldorf

Phone: 02 11 / 384 24-0
Email: poststelle@ldi.nrw.de
Internet: https://www.ldi.nrw.de

Validity and changes to this privacy policy

This privacy policy applies from August 23, 2024. We reserve the right to change this privacy policy at any time in compliance with the applicable data protection regulations. This may be necessary, for example, to comply with new legal provisions or to reflect changes to our website or new services on our website. The version available at the time of your visit applies. Should this privacy policy be changed, we intend to announce changes to our privacy policy on this page so that you are fully informed about which personal data we collect, how we process it and under what circumstances it may be passed on.