Information on the processing of personal data in accordance with the General Data Protection Regulation (GDPR).
DECOTA GmbH i. G. (in formation)
c/o Digitales Gründerzentrum Aschaffenburg – Alte Schlosserei
Werkstraße 2, 63739 Aschaffenburg, Germany
Email info@decota.ai
Our website is operated on our behalf by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. The server is located in Germany.
When you visit, in particular your IP address, time of access, page accessed, server response, browser, operating system and, where applicable, the previously visited page are processed. This serves to provide and secure the website. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the reliable and secure operation of the website.
Server logs are deleted after 7 days. In the event of specific security incidents, longer storage may be necessary for investigation or legal action.
The connection to our website, including all forms, is TLS-encrypted, recognizable by “https://” in your browser’s address bar.
For contact forms, prospect inquiries, contact management, and email communication, we use HubSpot (HubSpot, Inc., Two Canal Park, Cambridge, MA 02141, USA) as a processor. When you contact us via forms or by email, we process names, email addresses, telephone numbers where applicable, messages, requested content, and the processing history in order to answer inquiries, arrange demos, and provide whitepapers. Providing this information is neither a legal nor a contractual requirement. Without the required mandatory information or a way to contact you, we may not be able to process your inquiry.
For contracts with you and pre-contractual measures requested by you, Art. 6(1)(b) GDPR applies. For contact persons of a company and other inquiries, Art. 6(1)(f) GDPR applies. Our legitimate interest is the handling of business inquiries.
Whitepapers and previews. When you request a whitepaper, we also transmit its title to HubSpot. PDF files and previews are stored in the HubSpot file manager and loaded directly from there. In the process, in particular your IP address and technical connection data are transmitted to HubSpot. This serves to provide the requested content. The legal basis is Art. 6(1)(b) GDPR insofar as the provision serves a pre-contractual measure with you, otherwise Art. 6(1)(f) GDPR; our legitimate interest is providing our information offerings. The download does not depend on consent to advertising or tracking.
Contact data from other sources. We sometimes receive contact data of company contact persons not from you directly but at trade fairs and events, through exchanged business cards, via professional networks such as LinkedIn, through referrals, or from publicly available company information. We process names, business contact details, company, and position in order to initiate and maintain business contacts. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is initiating and maintaining business relationships. Even in this case, we only send promotional emails with your consent.
Data hosting in Germany is set up for our HubSpot account. Nevertheless, HubSpot companies and subcontractors may process data outside the European Economic Area, in particular in the USA. Transfers to HubSpot, Inc. are based, where covered, on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR); where necessary, EU standard contractual clauses apply (Art. 46 GDPR). The safeguards are available in HubSpot’s data processing agreement.
HubSpot privacy · Data processing and safeguards
Email mailboxes. For our email mailboxes, such as info@decota.ai, we use Microsoft 365 (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland) as a processor. Emails you send us directly and our replies are stored there; the rules under “Storage and deletion” apply to deletion. Microsoft Corporation and its sub-processors may also process data outside the European Economic Area, in particular in the USA. Transfers are based, where covered, on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR); where necessary, EU standard contractual clauses apply (Art. 46 GDPR).
Video conferences. For demo appointments and meetings, we use Microsoft Teams as part of Microsoft 365; the information in the preceding paragraph applies to the provider and third-country transfers. Your name, email address, technical connection and device data such as your IP address, time and duration of participation and, if you use them, video, audio, screen sharing, and chat messages are processed. We only make recordings after prior notice and with your consent (Art. 6(1)(a) GDPR). Otherwise, the legal basis is Art. 6(1)(b) GDPR insofar as the meeting serves to initiate or perform a contract, otherwise Art. 6(1)(f) GDPR; our legitimate interest is the efficient conduct of business meetings.
With your consent, we use HubSpot to send you information about DECOTA products and solutions in personal sales emails and newsletters. For this purpose, we process your name and email address. The legal basis is Art. 6(1)(a) GDPR. The handling of your specific inquiry is independent of this.
With your separate consent, we use HubSpot tracking pixels to record whether and when you open our personal sales emails or newsletters and assign this information to your contact. This serves to evaluate and improve our sales and newsletter communication. The open data also feeds into a score for your contact in HubSpot (lead scoring), which we use to prioritize our sales outreach. We do not make automated decisions with legal or similarly significant effects for you. The legal bases are Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Without valid tracking consent, no open tracking takes place.
Voluntariness and withdrawal. Consent to the storage and processing of your data and to receiving information about products, services, and other content is requested in the form via one checkbox. Consent to open tracking is given via a separate, voluntary checkbox. Both consents can be withdrawn independently of each other at any time with effect for the future via info@decota.ai. The lawfulness of prior processing remains unaffected. Once we send newsletters, you can also unsubscribe at any time via the unsubscribe link in every issue.
We delete inquiry data once the inquiry has been completed and the data is no longer needed for an existing or specifically initiated business relationship. For personal sales emails and newsletters, we use your contact data until you withdraw your consent or until we discontinue these mailings.
We delete or anonymize personal open data after completing the respective email evaluation, and at the latest without undue delay after you withdraw your tracking consent.
As proof, we document the content and time of your consent and any withdrawal, linked to your contact (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR). Where necessary to fulfill our accountability obligations or for legal defense, we retain this proof until the relevant limitation periods expire. For legal defense, Art. 6(1)(f) GDPR applies; our legitimate interest is proving lawful processing. Use remains limited to these purposes.
Statutory retention obligations remain unaffected; use of the data concerned remains limited to the respective retention purpose.
Strictly necessary storage of or access to information on your device is governed by Section 25(2) No. 2 TDDDG (German Telecommunications Digital Services Data Protection Act). Other access requiring consent needs your consent pursuant to Section 25(1) TDDDG. The associated processing of personal data is additionally subject to the GDPR legal basis stated in each case.
General. We use necessary cookies for security and consent management as well as optional cookies for website analytics. Optional analytics and the use of visit data described below only take place with your consent via our cookie banner.
Consent banner. We provide the banner ourselves; it does not load any third-party content. There you can allow or reject visitor analytics with HubSpot. The HubSpot script is only loaded once you allow analytics; before that, no connection to HubSpot is established. We store your choice in your browser’s local storage (localStorage) under decota_cookie_consent. The entry contains only your choice and when you made it, and it is not transmitted to us. We ask again after six months. If you have consented, we pass your consent on to HubSpot; HubSpot may record it in the cookies __hs_cookie_cat_pref (selected categories) and __hs_opt_out, each for six months. If you withdraw consent, we delete HubSpot’s analytics cookies in your browser; to store a tracking block, __hs_do_not_track may also be used for six months. If you have consented and later contact us via a form, your cookie decision is additionally recorded on your contact in HubSpot. This serves to implement your choice and to prove consent given. The legal bases are Section 25(2) No. 2 TDDDG and Art. 6(1)(c) in conjunction with Art. 7(1) GDPR for proof of consent; otherwise Art. 6(1)(f) GDPR, with our legitimate interest in reliably implementing your privacy choice. You can change or withdraw your choice at any time via the “Cookie settings” link in the footer.
Language selection. We store the page language you selected in your browser’s local storage. The entry remains until you delete it via your browser settings. It serves solely to retain your language selection. The legal basis is Section 25(2) No. 2 TDDDG.
Film playback position. While the film on the home page is playing, the current playback position may be stored briefly in your browser’s local storage. The entry contains no personal data, is not transmitted to us or to third parties, and is reset on every page view so that the film starts from the beginning. The legal basis is Section 25(2) No. 2 TDDDG.
Necessary cookies of the HubSpot network. When forms and downloads are loaded, HubSpot’s network service provider (Cloudflare) may set the cookies __cf_bm (duration 30 minutes) and __cfruid and __cfuvid (each until the end of the browser session). They serve to protect against automated access and overload. The legal bases are Section 25(2) No. 2 TDDDG and Art. 6(1)(f) GDPR; our legitimate interest is the secure operation of our forms.
Visitor analytics with HubSpot. Only with your consent does HubSpot set the following cookies: __hstc (visitor recognition; contains a pseudonymous visitor ID, the times of the first, last, and current visit, and the number of visits; duration six months), hubspotutk (pseudonymous visitor ID transmitted when a form is submitted; six months), __hssc (counts page views within a visit; 30 minutes), and __hssrc (detects a browser restart; until the end of the session). In the process, in particular your IP address, the pages viewed, the times of access, and the visitor ID are transmitted to HubSpot. We use this data to evaluate and improve the use of our website. If you subsequently identify yourself via a form, for example when requesting a whitepaper, the previous and further page views recorded under your visitor ID may be assigned to your contact. This only takes place within the scope of your consent. We use this information to identify interest in our offerings and to prepare business conversations. The legal bases are Section 25(1) TDDDG and Art. 6(1)(a) GDPR. Forms and downloads also work without this consent; your details are then not linked to page views. For the provider, data hosting, and third-country transfers, the information in section 3 applies.
Use by HubSpot for its own purposes. If you have consented to visitor analytics, HubSpot also uses the data collected via the tracking code for its own purposes: to improve its products and its commercial company dataset, for example to show customers which companies are interested in which topics. This concerns in particular IP address, pseudonymous visitor ID, times and pages viewed and, after a form is submitted, your company’s domain. HubSpot is independently responsible for this processing. Information on purposes, storage, recipients, and data subject rights can be found in HubSpot’s privacy policy. The banner also informs you about this purpose. The legal basis for the transfer to HubSpot is your consent in the banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). Regardless of our data hosting in Germany, this data may also be processed in the USA; transfers are based on the EU-US Data Privacy Framework (Art. 45 GDPR) and, where necessary, on EU standard contractual clauses (Art. 46 GDPR).
Storage period. Cookies are automatically deleted after the stated duration expires. After a withdrawal, we stop consent-based visit tracking and profiling. The lawfulness of prior processing remains unaffected. We delete or anonymize personal visit data already stored unless another legal basis permits its further storage. Otherwise, we store visit data for evaluating website use and preparing existing or specifically initiated business contacts. Once it is no longer needed for this, it is deleted or anonymized. Visit data assigned to your contact is deleted together with your contact data in accordance with the rules under “Storage and deletion”. HubSpot’s retention periods apply to processing by HubSpot for its own purposes.
We operate a company page on LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland). When you visit the page, follow it, or interact with posts, LinkedIn processes your data and provides us with aggregated statistics on the use of the page (Page Insights), for example on job function, industry, company size, or country of visitors. We cannot identify individual persons from this. We are jointly responsible with LinkedIn for these statistics (Art. 26 GDPR). Under the agreement with LinkedIn, LinkedIn assumes primary responsibility, in particular for informing users and fulfilling data subject rights; you can nevertheless also exercise your rights against us. The agreement is available at LinkedIn joint controller agreement. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is presenting our company and improving our page.
We process messages you send us via LinkedIn in order to respond as described in section 3. Otherwise, LinkedIn processes your data under its own responsibility, including in the USA. Further details can be found in LinkedIn’s privacy policy.
Subject to the statutory requirements, you have rights of access, rectification, erasure, restriction of processing, and data portability (Art. 15 to 20 GDPR). You can withdraw consents at any time with effect for the future; the lawfulness of prior processing remains unaffected. Contact: info@decota.ai. Alternatively, you can use our data privacy request form.
Where processing is based on Art. 6(1)(f) GDPR, you can object on grounds relating to your particular situation, including to profiling based on it. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests or the processing is necessary for legal claims. You can object to direct marketing and related profiling at any time without giving reasons; we will then no longer process your data for these purposes.
You can lodge a complaint with a data protection supervisory authority, in particular at your habitual residence, place of work, or place of the alleged infringement. The authority generally responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, poststelle@lda.bayern.de.
As of 12 October 2026