Privacy Policy
As of September 2026 · Applicable to https://a7.de/ and all sub-pages
Summary - the key points at a glance
No advertising cookies - unless you explicitly consent
Anonymous reach measurement by default without cookies (Matomo); optional cookie extension only after your consent. Advertising measurement (Google Ads, Microsoft Advertising, OpenAI Ads) only after your consent.
Cookie-free analytics (Matomo)
We use Matomo exclusively self-hosted in Germany - to detect 404 errors, understand visitor flows and improve content. No third-country transfer.
Forms & emails via Scaleway
Contact forms and email dispatch are processed via Scaleway - EU data centres, with a data processing agreement.
Videos only after click
Our own videos are delivered via Bunny Stream from within the EU. YouTube videos in individual blog posts only load after your click (details under Embedded Content).
Servers in Germany & EU
Hosting, Matomo and all our own services run on servers in Germany. The website is delivered via an EU CDN. No third-country transfer under normal operations. Data may only be transferred to the USA if you choose Microsoft Teams for an appointment or consent to the Marketing category (conversion measurement with Google, Microsoft and OpenAI).
Your rights are protected
Access, erasure, objection - at any time by email to datenschutz@a7.de.
1 Contact Information
Controller (Verantwortlicher)
AWARE7 GmbH
Munscheidstraße 14
45886 Gelsenkirchen
+49 209 8830 6760
legal@a7.de
Data Protection Officer (Datenschutzbeauftragter)
Kevin Jäkel LL.B.
HK2 Comtection GmbH
Hausvogteiplatz 11A, 10117 Berlin
datenschutz@a7.de
2 General Information on Data Processing
Legal bases at a glance
Contract performance
Processing insofar as it is necessary for the performance or initiation of a contract. (Art. 6 Abs. 1 lit. b DSGVO)
Legitimate interest
Processing where our interests prevail and no overriding interests exist. The specific interest is stated in each case. (Art. 6 Abs. 1 lit. f DSGVO)
Consent
Processing only after explicit consent. Withdrawal is possible at any time with effect for the future. (Art. 6 Abs. 1 lit. a DSGVO)
Legal obligation
Processing to fulfil statutory retention obligations. (Art. 6 Abs. 1 lit. c DSGVO)
Data erasure and retention periods
We erase personal data once the legal basis for processing ceases to apply. Statutory retention obligations (e.g. under tax law) may preclude immediate erasure and are taken into account in each case.
3 Data Processing During Website Operation
Server log files
Art. 6(1)(f) GDPRWhen you visit our website, your browser automatically transmits the following data to our server:
Log files are deleted after no more than 31 days, unless a longer retention period is required to defend against or investigate attacks.
Contact form & enquiries
Art. 6(1)(f) / (b) GDPRVia our contact forms we collect, depending on the form: name, email address, phone number, company name. Mandatory fields are marked. We use this data solely to respond to your enquiry. Some forms additionally contain a voluntary indication of how you heard about us (selected from predefined categories); we use this for internal evaluation of our marketing channels (Art. 6(1)(f) GDPR). Not providing this information has no effect on the processing of your enquiry. Data is erased no later than 6 months after final processing, unless a contractual relationship is established. If a contract is concluded, data is further processed for contract performance and erased after expiry of statutory retention periods. For registration in our lecturer pool (German) we process the profile data provided there for the purpose of initiating a freelance collaboration (Art. 6(1)(b) GDPR); we store this data for as long as there is interest in a collaboration, at most until your withdrawal.
Secure temporary storage & customer management
To prevent an enquiry from being lost in the event of a temporary disruption to the email or customer management system, it is first stored in encrypted form on our web server at Hetzner in Germany. From there it is forwarded to Scaleway and our self-hosted EspoCRM on Hetzner infrastructure. The encrypted content copy in the running delivery queue is erased no later than 30 days after receipt. Rotating database backups also contain this content data only in encrypted form and are erased no later than a further 7 days. Technical status data without enquiry content may be retained longer for error analysis.
Data processor: Scaleway
Form data and email dispatch are processed via Scaleway (Scaleway SAS, Paris - storage and processing exclusively in EU data centres, data processing agreement in place). Scaleway privacy policy →
Spam protection: Friendly Captcha
To protect our forms against automated requests, we use Friendly Captcha by Friendly Captcha GmbH (Am Anger 3-5, 82237 Wörthsee, Germany). Friendly Captcha performs a proof-of-work calculation in the background in the user's browser and transmits the result together with the IP address to Friendly Captcha servers in the EU for evaluation. No cookies are set and no browser fingerprinting is used. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protection against spam). A data processing agreement (DPA) with Friendly Captcha GmbH is in place. Friendly Captcha privacy policy →
Telephony: sipgate
If you provide us with your phone number (e.g. in the contact or callback form), we will call you via our cloud telephone system provided by sipgate GmbH (Gladbacher Straße 74, 40219 Düsseldorf, Germany). Your phone number and the associated connection data will be processed for the purpose of handling your enquiry by telephone. A data processing agreement (DPA) pursuant to Art. 28 GDPR is in place. sipgate privacy policy →
Newsletter
Art. 6(1)(a) GDPRFor the newsletter we store your email address on the basis of your consent (double opt-in). Subscriber management is carried out in a self-hosted newsletter system (listmonk) on our own infrastructure in Germany; email delivery is handled by the data processor Mailjet (EU data centres, see above). Unsubscription is possible at any time via the unsubscribe link in each email. After unsubscription your email address will be erased within 30 days.
Webinar registration
Art. 6(1)(a) GDPRWhen registering for one of our webinars (live event or recording) we process your email address and the selected webinar format. Registration uses double opt-in: you first receive a confirmation email with a verification link; after confirming your email address we review your registration. If approved, we manually set up your personal access to the AWARE7 Academy and send you the access details by email. We reserve the right to decline registrations and not to create an account. Legal basis: Art. 6(1)(a) GDPR (consent); you provide consent by actively registering and confirming via the verification link. Subscriber list management is carried out in our self-hosted newsletter system (listmonk) on our own infrastructure in Germany; confirmation and access emails are sent via the data processor Mailjet (EU data centres, see above). Your email address will be removed from the webinar registration list once the purpose of processing has ceased - as a rule after the webinar date or after the recording is made available. If you optionally consented to the newsletter during registration, your email address will continue to be stored in the newsletter list (see Newsletter section).
Appointment booking for initial consultation (termin.a7.de)
Art. 6(1)(b) GDPRFor online booking of consultation appointments (e.g. the free initial consultation) we use a self-hosted booking system at termin.a7.de on Hetzner infrastructure in Germany (see Hosting section). During booking we process your name, email address, chosen appointment and time zone, your message from the free-text field, and the method of delivery you selected. Legal basis: Art. 6(1)(b) GDPR (performance of pre-contractual measures at your request). Email addresses of additional participants that you may optionally provide are used solely for the invitation to this appointment (Art. 6(1)(f) GDPR; legitimate interest in organising the jointly requested appointment). We store booking data for as long as it is required for agreeing, conducting and following up on the appointment; if a contractual relationship arises, the data is further processed for contract performance and erased after expiry of statutory retention periods.
Method of delivery: Nextcloud Talk or Microsoft Teams
The consultation takes place as a video conference; connection data (e.g. IP address, browser information) as well as audio and video data are processed in real time. The default is our self-hosted Nextcloud Talk instance on Hetzner infrastructure in Germany; processing is carried out exclusively by us and our data processors, no transfer to other controllers takes place. Alternatively you may choose Microsoft Teams at booking (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland), for example if your corporate network blocks the connections required for Nextcloud Talk. In this case a transfer of personal data to the USA cannot be excluded; it is based on the adequacy decision of the European Commission on the EU-US Data Privacy Framework (Microsoft is certified thereunder), supplemented by EU Standard Contractual Clauses. Microsoft privacy statement →
Cookies
No consent requiredThis website uses exclusively technically necessary cookies. Session cookies are automatically deleted when the browser is closed. On selected pages (e.g. offer pages, events) you may optionally consent to anonymous success measurement via the cookie banner (see section 5). Without your consent no tracking cookies are set.
4 Web Analytics with Matomo
We use Matomo (open source, formerly Piwik) - self-hosted at statistik.a7.de in Germany. Matomo helps us to:
- Detect and fix 404 error pages and broken links
- Understand which content visitors view and for how long
- Identify technical problems (e.g. high bounce rates on specific pages)
- Measure the reach of our content anonymously
Data transmitted per page view
IP anonymisation: The last two octets (IPv4) or the last 80 bits (IPv6) are set to 0 before storage. Identification of your person is no longer possible by general assessment.
No cross-session re-identification: No cookies, localStorage or fingerprinting techniques are used for analytics. Section 25(1) TDDDG (German Telecommunications and Digital Services Data Protection Act) therefore does not apply to the analytics. Only the opt-out status (see below) is stored in localStorage at your request - this is permissible without consent pursuant to Section 25(2)(2) TDDDG, as it is strictly necessary to implement your objection.
Right to object (Art. 21 GDPR): Activate "Do Not Track" in your browser - Matomo respects this signal automatically. Alternatively you can disable web analytics directly here or contact us by email: datenschutz@a7.de.
Matomo opt-out
Optional cookie extension (statistics)
In addition to the cookie-free standard analytics described above, you may optionally consent via the cookie banner (category "Statistics") to cross-session re-identification by cookie. This enables us to attribute visits across multiple sessions to the same person in order to understand which channels generate enquiries (multi-channel attribution). Matomo sets two cookies for this purpose: _pk_id.* for re-identification (lifetime 13 months) and _pk_ses.*, which groups the page views of a single visit (lifetime 30 minutes). Without your consent the web analytics remains entirely cookie-free as described above - this extension is purely optional and not required to use the website.
Legal basis: Consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. Consent is given via the cookie banner (category "Statistics") and may be withdrawn there at any time. Upon withdrawal the cookie is deleted immediately.
5 Conversion Tracking (Google Ads, Microsoft Advertising & OpenAI Ads)
On our website we ask you via the cookie banner whether we may use Google Ads Conversion Tracking. This serves to measure whether an advertisement has led to a contact enquiry. Without your consent no Google code is loaded and no data is transmitted to Google.
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google LLC (USA) is certified under the EU-US Data Privacy Framework (DPF) (adequacy decision of the European Commission pursuant to Art. 45 GDPR, C(2023) 4745).
Google Tag: We use the Google Tag with the ID AW-774147734. This tag is only loaded after your consent via the cookie banner.
Scope: The Google Tag is loaded exclusively after your consent and is then active site-wide to correctly attribute conversions. Conversion events are only triggered on confirmation pages after form submission or appointment booking. Without consent no Google code is executed on any page.
Cookies: Upon consent Google may set cookies (including _gcl_aw, lifetime: 90 days). These serve exclusively to attribute a conversion to an advertisement.
Enhanced Conversions
In addition to standard conversion tracking we use the Enhanced Conversions feature. When you submit a contact form on our website and have previously consented to marketing cookies via the cookie banner, your email address is hashed using the SHA-256 algorithm (one-way encryption) before transmission to Google. Google uses this hash value to attribute the conversion to your ad click - even if the conversion cookie has since been deleted.
Important: Hashed data is not anonymised under the GDPR definition, but pseudonymised. They remain personal data. Google stores hashed data for a maximum of 20 days and then deletes it. Without your consent via the cookie banner no data is transmitted to Google.
Legal basis: Consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. Consent is given via the cookie banner (category "Marketing").
Google Consent Mode v2
We implement Google Consent Mode v2 in the Basic implementation. This mode informs Google which cookie categories you have accepted or declined (ad_storage, analytics_storage, ad_user_data, ad_personalization).
Upon rejection: No cookies are set, no scripts are loaded and no data is sent to Google. No cookieless data collection ("pings") takes place. We expressly do not use the "Advanced Mode".
Upon consent: Google Ads Conversion Tracking and Enhanced Conversions are activated as described above.
Legal basis: Consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. The storage and reading of cookies on your device and the transmission of hashed form data require your consent. You give this consent via our cookie banner (category "Marketing"). You may withdraw your consent at any time by deleting the cookie cc_cookie in your browser or changing the cookie settings via the banner.
Objection: You can additionally disable the personalisation of Google ads in your Google account settings.
To measure whether an advertisement in Microsoft Search (Bing) has led to a confirmed contact enquiry or appointment booking, we use Microsoft Advertising UET and the server-side Offline Conversion API. Without your consent via the cookie banner no Microsoft code is loaded, no offline conversion is triggered and no ad click identifier is transmitted to Microsoft.
Provider: Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Microsoft Corporation (USA) is certified under the EU-US Data Privacy Framework (DPF) (adequacy decision pursuant to Art. 45 GDPR).
UET tag: We use the UET tag with the ID 97212986. It is only loaded after your consent. Confirmation pages serve solely for user guidance and are not in themselves evidence of a conversion.
Processed data: Page URL and referrer called (without confirmation tokens or lead references - these are removed before transmission), IP address, browser and device information and the click identifier msclkid. Microsoft stores UET data for up to 390 days.
Offline Conversion API: When an enquiry has been successfully stored in our system or an appointment booking has been confirmed as BOOKING_CREATED, we transmit to Microsoft - where marketing consent is present - exclusively the msclkid, the conversion goal, the conversion time, the attributed value and the currency. Email address, name, phone number and hashed contact data are not transmitted to Microsoft. We do not pass click identifiers or UTM parameters to our self-hosted booking system at termin.a7.de. For professional attribution, a non-personal consultation topic selected from a fixed list (for example data protection or penetration testing) may be transmitted. Only where marketing consent is present, at most a signed, opaque consent reference is additionally stored; only the booking webhook received by us can server-side attribute this reference to the ad attribution stored with us.
Retention: The encrypted conversion payload in the running offline conversion queue is stored for at most 30 days. Rotating database backups also contain this payload only in encrypted form and are deleted no later than a further 7 days. Purely technical delivery metadata, such as status, number of attempts and a Microsoft return ID, is stored for at most 180 days for error analysis and proof of proper transmission.
Purpose: Solely measurement of confirmed conversions and evaluation of campaign quality. We use no remarketing audiences, no Microsoft Clarity (session recordings) and no UET Insights.
Cookies: Upon consent, first-party cookies are set: _uetsid (1 day), _uetvid (13 months), _uetmsclkid (90 days) as well as our signed, opaque consent references a7_marketing_grant (at most 30 days, server-side readable only) and a7_cal_marketing_grant (at most 2 hours). On Microsoft's own domains Microsoft additionally sets identifiers such as MUID and MSPTC; these we cannot delete.
Legal basis: Consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG, given via the cookie banner (category "Marketing"). Upon withdrawal we delete the attribution cookies stored by us, block the server-side consent reference, stop conversion jobs not yet sent to Microsoft and reload the page without Microsoft code. A transmission process already passed to the Microsoft API that is technically still running cannot be reliably recalled and may therefore complete. We do not record any further attributions thereafter. Withdrawal does not affect the lawfulness of processing that took place on the basis of your consent prior to the withdrawal.
Objection: You can additionally disable personalised Microsoft advertising in Microsoft advertising settings.
To measure whether an advertisement in ChatGPT has led to a confirmed contact enquiry or appointment booking, we use the OpenAI Ads Conversions API. Unlike Google and Microsoft, we do not load any code from OpenAI for this: there is neither a pixel nor a script from OpenAI on this website.
Provider: OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. Under the Conversion Terms and the Ad Tools DPA of OpenAI, OpenAI and we each act as independent controllers. The recipient of our transmission is OpenAI Ireland Limited. Pursuant to clause 3.2 of the Ad Tools DPA, OpenAI Ireland Limited processes data from the EEA and undertakes to use a valid transfer instrument for onward transfers to countries without an adequate level of protection, in particular to OpenAI OpCo, LLC (USA). We have not concluded separate Standard Contractual Clauses with OpenAI OpCo, LLC. The adequacy decision of the European Commission for the USA (EU-US Data Privacy Framework) only applies to certified entities; we were unable to confirm certification of OpenAI at the time of this version.
Processed data: When you click on an advertisement in ChatGPT, OpenAI appends a pseudonymous click reference (oppref) to the address of our landing page. Without OpenAI's data, this reference cannot be attributed to any person by us. OpenAI can attribute it to the ad click and thus to the account there. We retain this reference only after your consent in our first-party cookie a7_ad_params (at most 30 days). If within 7 days of the click an enquiry is successfully stored in our system or an appointment booking is confirmed as BOOKING_CREATED, we transmit from our server to OpenAI exclusively this click reference, the type of event (contact enquiry or appointment booking), the time, the page address without address parameters and an internal transaction number of the enquiry as well as technical constants to label the event. Email address, name, phone number and hashed contact data are not transmitted to OpenAI. Confirmation pages serve solely for user guidance and are not in themselves evidence of a conversion.
Retention: The click reference is part of the encrypted request payload for at most 30 days in our delivery queue, in rotating database backups also only encrypted and for at most a further 7 days. Purely technical delivery metadata (status, number of attempts) is stored for at most 180 days. OpenAI as an independent controller determines its own storage period. No fixed deadline is stated in the terms; details can be found in OpenAI's privacy policy.
Purpose: Solely measurement of confirmed conversions and evaluation of campaign quality. We do not build audiences and do not conduct remarketing on the basis of this data. OpenAI uses the transmitted event data in accordance with its Conversion Terms also for the provision, measurement and improvement of its products and services; we have no influence on this.
Cookies: OpenAI does not set cookies on this website. The click reference is stored after consent together with other campaign identifiers in the already described cookie a7_ad_params; the server-side consent reference a7_marketing_grant applies accordingly.
Legal basis: Consent pursuant to Art. 6(1)(a) GDPR, for the cookie in conjunction with Section 25(1) TDDDG, given via the cookie banner (category "Marketing"). Only consents given after inclusion of this section are valid. Upon withdrawal we delete the attribution cookies, block the server-side consent reference and discard conversion jobs not yet sent to OpenAI. We do not record any further attributions thereafter. Although the cookie exists for up to 30 days, we use the click reference only within 7 days of the click for attribution. Events already transmitted to OpenAI cannot be recalled; withdrawal takes effect for the future and does not affect the lawfulness of processing that took place prior to the withdrawal.
Objection: Information on your rights vis-a-vis OpenAI is contained in OpenAI's privacy policy. At your request we will communicate your withdrawal or erasure request to OpenAI insofar as this is possible for us.
6 Embedded Content
Video streaming (Bunny Stream)
EU-only CDNVideos are delivered via Bunny Stream (BunnyWay d.o.o., Slovenia). Data is stored exclusively on EU servers (location: Frankfurt am Main) and distributed via European CDN nodes. No third-country transfer takes place. No tracking cookies are set. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the efficient delivery of video content). Bunny.net privacy policy →
YouTube videos (click-to-load)
Art. 6(1)(a) GDPR (consent)In individual blog posts we embed YouTube videos. We use a privacy-friendly click-to-load facade: when the page loads, only a locally stored preview image is loaded; no connection to Google servers takes place. Only when you actively click on the preview image is a connection to youtube-nocookie.com established and the video player embedded as an iframe. From this point connections to Google servers are made (including youtube-nocookie.com, googlevideo.com, gstatic.com, google.com, googleapis.com) and the following data is transmitted:
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Purpose: Playback of the selected video. Google also processes the data for its own purposes (including statistics, security and abuse detection, improvement of services).
Legal basis: By actively clicking on the preview image you give consent to the transfer of data to Google and to the storage and reading of information on your device by YouTube (Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG). Without this click no connection to Google takes place.
Third-country transfer to the USA: Google LLC (USA) is certified under the EU-US Data Privacy Framework (DPF) (adequacy decision of the European Commission pursuant to Art. 45 GDPR, C(2023) 4745). The transfer is based on this adequacy decision.
Retention: AWARE7 itself stores no data in connection with YouTube. The retention period for cookies and other data is determined by Google; details can be found in Google's privacy policy →
Prevention and withdrawal: Since data transfer is only triggered by your active click, you prevent it by not starting the video. Data already transmitted to Google after the click cannot be recalled; withdrawal takes effect for the future. YouTube cookies can be deleted in your browser settings. Your rights are set out under Your rights as a data subject.
7 Social Networks
We operate a presence on LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland). For the usage statistics of our company page (Page Insights) there is joint controllership (gemeinsame Verantwortlichkeit) pursuant to Art. 26 GDPR between us and LinkedIn. The key content of the agreement is available at LinkedIn Page Insights Joint Controller Addendum. LinkedIn may additionally process data to create interest-based profiles. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in communication and reach). Objection possible at any time directly in your LinkedIn privacy settings.
8 Application Procedure
For the processing of personal data in connection with application procedures, please refer to our separate privacy notice.
Privacy notice for applicants (German)9 Your Rights as a Data Subject
Access
You may request information about all personal data we process about you.
Rectification
You have the right to immediate rectification of incorrect or incomplete data.
Erasure
You may request erasure of your data once the legal basis for processing has ceased to apply.
Restriction
Instead of erasure you may request restriction of processing.
Data portability
You may request your data in a machine-readable format and transfer it to another provider.
Objection
You may object at any time, with effect for the future, to processing based on legitimate interest.
Complaint to supervisory authority
Competent authority: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen.
To exercise your rights please contact: datenschutz@a7.de
10 Web Hosting
This website is hosted on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. For every page request, server log files are created for technical reasons (see section 3). All data remains on servers in Germany.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in reliable provision of the website). A data processing agreement (DPA) pursuant to Art. 28 GDPR has been concluded with Hetzner.
11 Content Delivery Network (CDN)
This website is delivered via the Content Delivery Network (CDN) of BunnyWay, informacijske storitve d.o.o. (bunny.net), Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia. A CDN is a network of servers that caches content geographically closer to the visitor, thereby reducing load times.
Processed data
For every page request your IP address is technically transmitted to a Bunny.net server. IP anonymisation is active - IP addresses are not stored in logs. Beyond this no personal data is processed by the CDN. Bunny.net sets no cookies in the current configuration.
Server locations
We use exclusively European server locations (EU-only routing). No data transfer to third countries takes place. Non-EU regions (USA, Asia, etc.) are disabled in our configuration.
Legal basis
The CDN is used on the basis of our legitimate interest in the secure and efficient provision of the website pursuant to Art. 6(1)(f) GDPR. A data processing agreement (DPA) pursuant to Art. 28 GDPR has been concluded with BunnyWay d.o.o.
Further information: bunny.net/privacy
12 Recipients of Data
Where we engage data processors (Auftragsverarbeiter) for the operation of the website (in particular hosting, form processing and analytics), these are engaged exclusively on the basis of a data processing agreement pursuant to Art. 28(3) GDPR. Disclosure to third parties for advertising purposes takes place only within the scope of the conversion measurement described in section 5 (Google, Microsoft, OpenAI) and only after your consent. These providers are not data processors in this regard but process the data in the roles described in section 5 respectively.
13 Business Contacts
AWARE7 GmbH processes personal data of contact persons at customers, suppliers and partners in connection with business relationships. The following essential information applies to this processing activity:
Purpose: Initiation, conduct and maintenance of business relationships (Anbahnung und Pflege von Geschäftsbeziehungen), including pre-sales communication, contract management and ongoing service delivery.
Legal basis: Art. 6(1)(b) GDPR (contract performance or pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in maintaining business relationships).
Recipients: Internal sales and project teams; our self-hosted CRM system EspoCRM on Hetzner infrastructure in Germany. For contacts who arrived via a Google Ads campaign (Google Click Identifier, GCLID) and have given explicit marketing consent, contact data may be transferred to advertising platforms (Google Ads Customer Match, LinkedIn Matched Audiences) for targeted follow-up; no further transfer of business contact data to third parties for advertising purposes takes place beyond this.
Third-country transfer (USA): The platform operators based in Ireland (Google Ireland Limited, LinkedIn Ireland Unlimited Company) may transfer the pseudonymised data to their US parent companies (Google LLC, Mountain View, CA, USA; LinkedIn Corporation, Sunnyvale, CA, USA) as part of the matching process. The transfer is based on the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission pursuant to Art. 45 GDPR of 10 July 2023, C(2023) 4745) in conjunction with supplementary EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.
Retention: Business contact data is retained for the duration of the business relationship and erased after its end, subject to statutory retention obligations: 6 years for business correspondence (§ 257 HGB); 10 years for accounting records and invoices (§ 257 HGB, § 147 AO).
For full details in German, see our separate privacy notice for business contacts:
Privacy notice for business contacts (German)14 AI Systems
For client services (e.g. penetration test analysis and report support) AWARE7 operates its own AI cluster with locally hosted open-source models on dedicated hardware in Germany. Client and principal data does not reach external AI services. External AI services are only used for marketing purposes - without personal client data.
Details are governed by Annex 1 (Technical and Organisational Measures) of our data processing agreement (German). Background: Digital sovereignty at AWARE7.
As of September 2026
datenschutz@a7.de
