GuCoIA Logo
EN DE

Privacy Policy

Data protection information for GuCoIA website

Your data protection is important to us. Here you can find out how we handle your data.

1. Data Protection at a Glance

General Information
The operator of this website takes the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations (GDPR, BDSG) and this privacy policy.

Responsible Body
GuCoIA – Mike Thieke
c/o Online-Impressum #9725
Europaring 90
53757 Sankt Augustin, Germany
Email: kontakt@gucoia.de

2. Hosting and Server Log Files

This website is hosted by an external service provider: netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany.

When the website is accessed, the hosting provider automatically collects and stores information in so-called server log files. These are in particular:

  • IP address of the accessing device
  • date and time of access
  • page/file requested
  • amount of data transferred
  • browser type and operating system (user agent)
  • referrer URL

This processing serves to deliver the website, to ensure stability and security, and to defend against attacks. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest). A data processing agreement (DPA) under Art. 28 GDPR is in place with the hosting provider.

3. Local Browser Storage (No Cookies)

This website does not use cookies. For basic functionality, the website stores technically necessary settings only locally in your browser (localStorage), specifically your choice between light and dark mode, the display status of the newsletter prompt and your progress in the AI Readiness Check (see section 7). This information stays on your device and is never transmitted to us. The legal basis is § 25 (2) TDDDG (technically necessary) or Art. 6 (1) (f) GDPR.

4. Web Analytics (Plausible Analytics)

We use Plausible Analytics (https://plausible.io), a privacy-friendly analytics service. We run Plausible self-hosted on the netcup GmbH server named in section 2; the access data is processed on our own infrastructure and is not transmitted to the Plausible provider or any other third party. Plausible does not use cookies and is designed for GDPR, CCPA, and PECR compliance.

  • No storage of personal data in a form identifiable to us
  • No sharing with third parties for advertising purposes
  • Anonymized evaluation of visits

The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in needs-based design of the website). Since we run Plausible on our own server (netcup, section 2), no additional data processing agreement with an analytics provider is required; the processing is covered by the hosting arrangement (section 2).

Since Plausible operates without cookies and does not require consent under § 25 (1) TDDDG, no cookie consent banner is required for the web analytics on this website (see Plausible: “Do you need a cookie consent banner on your website?”, https://plausible.io/blog/cookie-consent-banners).

5. Newsletter

If you sign up for our newsletter, we process the email address you provide and, if you choose to give it, your name. The email address is used to send the newsletter; the name is used for a personal salutation. Giving your name is voluntary — you can sign up without it (Art. 5 (1) (c) GDPR, data minimisation). Registration uses the double opt-in procedure: after signing up you receive a confirmation email with which you confirm your registration.

The legal basis is your consent under Art. 6 (1) (a) GDPR. You can withdraw your consent at any time with effect for the future, e.g. via the unsubscribe link in every newsletter email or by message to kontakt@gucoia.de. The newsletter is currently sent and the recipient list managed via our self-hosted ERPNext system, operated on the netcup GmbH server named in section 2; no separate data processing agreement is required for this, as no external service provider is involved. Your details are stored there both in the recipient list and as a prospect record — in both cases solely for the newsletter purposes named above and on the basis of the same consent. When you withdraw your consent, both records are deleted.

6. Contact Form

If you use our contact form, we process the data you enter — name, email address, subject and message — for the purpose of handling your enquiry and any follow-up communication.

The legal basis is Art. 6 (1) (b) GDPR insofar as your enquiry is aimed at concluding or initiating a contract, and otherwise Art. 6 (1) (f) GDPR (legitimate interest in responding to enquiries).

Processing takes place via our self-hosted ERPNext system, operated on the netcup GmbH server named in section 2. No data processing agreement beyond the hosting arrangement is required, as no external service provider is involved. We store your details until the enquiry has been conclusively handled; statutory retention periods remain unaffected.

7. AI Readiness Check

The “AI Readiness Check” page lets you run a self-assessment of AI use in your company. You answer the questions entirely in your browser. As long as you do not request the result, no data is transmitted to us. Your progress is saved locally in your browser (localStorage) so that you can interrupt the check; that storage stays on your device and is not visible to us (see section 3).

Only when you request the evaluation at the end do we transmit, in a single operation:

  • Contact details: email address (required) and, where you provide them, name, company and phone number. Everything other than the email address is voluntary (Art. 5 (1) (c) GDPR, data minimisation).
  • Your answers: the answer options and slider values you selected, and your free-text answers to the three open questions.
  • The evaluation result: total score, maturity level and the values of the individual dimensions.
  • Your consent declarations together with the wording of the consent texts shown to you (record under Art. 7 (1) GDPR), the address of the page you were on and the selected language.

The purpose of the processing is to produce and deliver your evaluation by email. The legal basis is your consent under Art. 6 (1) (a) GDPR. Without that consent we cannot send you the evaluation.

If you also tick the second, optional box (“I am interested in discussing the evaluation”), we create a prospect record for your email address in our CRM and contact you to discuss the evaluation. A summary of your result is attached to that record as a note. The legal basis is likewise Art. 6 (1) (a) GDPR. Without that tick no prospect record is created and we do not use your data to contact you.

You may withdraw your consent at any time with effect for the future, informally by message to kontakt@gucoia.de. The lawfulness of processing carried out before the withdrawal is unaffected (Art. 7 (3) GDPR).

Processing takes place via our self-hosted ERPNext system on the netcup GmbH server named in section 2. No data processing agreement beyond the hosting arrangement is required, as no external service provider is involved. Your data is not passed on to third parties.

The evaluation is calculated from your answers on a rule basis. It is not an automated decision in an individual case within the meaning of Art. 22 GDPR; it produces no legal effect concerning you and does not similarly significantly affect you.

The questions are written so that entering confidential information is not necessary. Please do not enter personal data of third parties or trade or business secrets in the free-text fields.

We delete your answers and the evaluation result six months after receipt. If you consented to a discussion, the prospect record and the result summary attached to it are retained beyond that until you withdraw that consent. Statutory retention periods remain unaffected.

8. Social Media / External Links

The footer of this website contains a link to our LinkedIn profile. This is a plain hyperlink, not an embedded social media plugin — merely visiting our page does not transmit any data to LinkedIn. Only when you click the link and visit LinkedIn does LinkedIn’s privacy policy apply.

9. Your Rights

You have the following rights regarding your personal data:

  • Right to information (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object (Art. 21 GDPR)
  • Right to withdraw consent given (Art. 7 (3) GDPR)

Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data (Art. 77 GDPR). The competent authority is the data protection supervisory authority of the federal state of our place of business (North Rhine-Westphalia): Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany. Complaints can also be submitted via the LDI NRW online form at https://www.ldi.nrw.de/beschwerde.

10. Retention Period

We store personal data only for as long as is necessary for the respective purposes or as required by statutory retention periods. After that, the data is deleted. For consent-based processing (e.g. newsletter) we store the data until withdrawal. For the AI Readiness Check, the six-month period stated in section 7 applies in addition.

11. Contact

For any questions regarding data protection, please contact us at:
Email: kontakt@gucoia.de