Privacy

This page explains which personal data is processed when you visit this website, why and on what legal basis, and what rights you have. The German version of this policy is authoritative.

1. Controller

Active Search AI GmbH
Konsul-Smidt-Straße 8 p
28217 Bremen
Germany

Email: kontakt@activesearch.ai

For any question about data protection, or to exercise your rights, an informal message to this address is enough. Further details are in the imprint.

2. In short

• The website is hosted on Microsoft Azure. Analytics with PostHog run only with your consent, on servers in Frankfurt am Main, Germany.
• We handle messages sent through the contact form and by email with Microsoft 365, in data centres in the EU.
• Without your consent, we use no cookies and no analytics or tracking tools.
• Fonts, images and videos are delivered with the website itself. No third-party content is embedded.

3. Hosting and server log files

This website is hosted on Azure Static Web Apps. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Microsoft acts as our processor under Art. 28 GDPR. To make pages load quickly, Microsoft delivers them through servers distributed worldwide, so a request may also be answered by a server outside the EU (section 7).

When you open a page, Microsoft processes the data your browser sends:

• IP address
• date and time of the request
• page requested, amount of data transferred and status code
• the previously visited page (referrer), if sent
• browser and operating system

This is needed to deliver the website and protect it against attacks. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). We do not store this data ourselves. All connections are TLS-encrypted.

4. Consent and analytics

Consent request

On your first visit, a notice asks whether you consent to analytics. “Decline” and “Accept” carry equal weight. Until you agree, the tool is not loaded and nothing is stored on your device for it.

We keep your decision, its time and the version of the notice in your browser’s local storage, so we do not have to ask on every visit. The entry stays on your device and is not sent to us. It is strictly necessary for this purpose (Section 25(2) no. 2 TDDDG) and records your decision (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).

Analytics with PostHog

If you consent, we use PostHog to understand which content is read and to improve the website. The provider is PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. The data is stored on servers in Frankfurt am Main, Germany. Requests go through our address c.activesearch.ai, which PostHog operates for us.

We record:

• pages visited and time spent on them
• the previously visited page (referrer)
• device type, browser and operating system
• approximate location (country and city), derived from the IP address

Your IP address is used for this but not stored. We do not record clicks, input, session recordings or heatmaps. We do not build a profile of you, do not combine the data with other sources and do not use it for advertising.

To recognise returning visits, the software stores a random identifier on your device: in the cookie ph_…_posthog (lifetime 1 year) and in local storage. The recorded data is deleted after 12 months.

The legal basis is your consent: Section 25(1) TDDDG for storing and reading information on your device, Art. 6(1)(a) GDPR for processing the data. You can withdraw your consent at any time with effect for the future, via “Cookie settings” at the bottom of every page. We then stop the measurement and remove the identifier from your device. Processing carried out before the withdrawal remains lawful.

5. Contact form and email

If you write to us using the contact form or by email, we process your details to deal with your enquiry. In the form, these are your name, your email address, your message, the topic you chose and, if you give it, your law firm or company. We need your name, email address and message to be able to reply.

The form sends your details, encrypted, to a function on Microsoft Azure (a data centre in the West Europe region, in the Netherlands). It forwards your enquiry by email to our inbox through Azure Communication Services (data location Europe). Nothing is sent to your email address. The function does not store your details. To protect against mass submissions, it keeps your IP address in memory for no longer than 15 minutes.

We handle our email, including enquiries from the form, with Microsoft 365, which, like Azure, is provided by Microsoft Ireland Operations Limited (section 3). Microsoft processes the form data and our email as a processor in data centres in the EU.

The legal basis is Art. 6(1)(b) GDPR where a contract or its preparation is concerned, otherwise our legitimate interest in answering (Art. 6(1)(f) GDPR). We delete the data once the enquiry is settled, unless statutory retention periods apply.

6. Links to other websites

Links, for example to LinkedIn or to our product websites, are plain links. No data is transferred until you click one; the privacy policy of the site you open then applies.

7. Recipients

We use two service providers: Microsoft for hosting the website, the contact form and our email (sections 3 and 5), and PostHog for analytics, if you have consented (section 4). Both act as processors under Art. 28 GDPR, bound by our instructions.

Microsoft also delivers the pages of this website through servers outside the EU (section 3). It processes form data and our email in the EU; only in exceptional cases, for example for technical support, may Microsoft Corporation in the USA access it. Both are covered by the European Commission's adequacy decision on the EU-US Data Privacy Framework, under which Microsoft is certified (Art. 45 GDPR), and additionally by the Commission's standard contractual clauses (Art. 46 GDPR). PostHog stores the analytics data in Frankfurt am Main; where PostHog Inc. accesses it from the USA, its certification under the EU-US Data Privacy Framework and the standard contractual clauses apply as well. Beyond this, we do not transfer data to countries outside the EU.

We do not sell data or pass it on for advertising. We disclose data to authorities only where the law requires us to.

8. Your rights

You have the right to

• access your data (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdraw consent with effect for the future (Art. 7(3) GDPR).

Right to object under Art. 21 GDPR: Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then stop processing the data unless we demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

9. Complaints to the supervisory authority

You may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Die Landesbeauftragte für Datenschutz und Informationsfreiheit der Freien Hansestadt Bremen (State Commissioner for Data Protection and Freedom of Information, Bremen)
Arndtstraße 1
27570 Bremerhaven, Germany

10. Further information

You are not obliged to provide us with any data. Without the connection data listed in section 3, however, the website cannot be delivered, and without your name, email address and message we cannot answer an enquiry sent through the form. No automated decision-making, including profiling (Art. 22 GDPR), takes place.

We update this policy as soon as the processing on the website changes. The version published here applies.