Privacy Policy

1. Controller

2. Hosting and server log files

This website is no longer hosted by Strato AG. It is hosted and delivered exclusively via Cloudflare Pages; the technical connection data processed in that process (including the IP address) and the responsible provider are described in section 3 “Cloudflare”.

Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in secure operation of the website).

3. Cloudflare

This website is hosted and delivered via Cloudflare Pages (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). Cloudflare processes visitors' IP addresses as technically necessary information.

Cloudflare's Data Processing Addendum (DPA) including EU Standard Contractual Clauses and EU-US Data Privacy Framework is automatically part of the terms of service. More information: cloudflare.com/trust-hub/gdpr/. Legal basis: Art. 6 (1) lit. f GDPR.

4. Cloudflare Turnstile

Our forms are protected by Cloudflare Turnstile to prevent spam and automated submissions. Turnstile processes the IP address and browser information but does not set tracking cookies and does not perform cross-site tracking.

Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in spam protection).

5. Contact form

If you contact us via the contact form, we process the data you provide (name, email, optionally phone, company, topic and message) to handle your enquiry. The data is forwarded by email only to our internal mailboxes and is not permanently stored in a database.

The internal notification email contains: the details you enter in the form (first and last name, email address, phone, company, topic, message; for the quick enquiry possibly the system or version used, and for a ransomware emergency report also your details on the situation and the affected systems), the country of origin of your request as a country code, your IP address in anonymised form (for IPv4 the last octet, for IPv6 the last four groups set to 0), a lead ID assigned by us (e.g. “L-20261015-K7QF”) and, where you have consented to “Marketing” or the details are contained in the page you opened, the “Herkunft / Source” block (Google click ID, UTM parameters, landing page, referrer; see section 13). The lead ID contains no personal data and is used to match enquiries internally.

Confirmation email: after you submit the form we automatically send an acknowledgement to the email address you provided. It contains your name, the topic or situation you selected and our company name and website (for emergency reports also our phone number), but not your message. Both emails are sent via Mailjet (see section 7).

Abuse protection: to prevent the forms from being misused in bulk, we limit the number of submissions per IP address and hour (this also applies to the application form). For this, a keyed hash (HMAC-SHA-256 with a secret key) is formed from your IP address and the current hour, and only this counter is stored in Cloudflare Workers KV for at most one hour; the IP address itself is not stored there. Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in preventing abuse).

Legal basis: Art. 6 (1) lit. a GDPR (consent) and Art. 6 (1) lit. b GDPR (pre-contractual measures). Retention: until your enquiry has been fully processed, then deletion after no more than 12 months, unless legal retention obligations apply.

6. Application form

When using the quick-apply form, we process the data you provide (name, email, phone, desired position, start date, profile links, stack experience, free description) exclusively for the application process. The data is forwarded by email to our applications mailbox ([email protected]); you also automatically receive an acknowledgement at the email address you provided.

Legal basis: § 26 BDSG in conjunction with Art. 88 GDPR. Retention: maximum 6 months after the application process is concluded, unless you consent to longer retention for future positions.

7. Email delivery

Form messages are sent via the Mailjet API (Mailgun Technologies, Inc. / Sinch, 50 rue de Londres, 75008 Paris, France) using a TLS-encrypted connection. Mailjet processes email addresses and message content as a data processor.

Mailjet is ISO 27001 certified. The data processing agreement is part of the terms of service. More information: mailjet.com/gdpr/. Legal basis: Art. 6 (1) lit. f GDPR.

8. Cookies

We use technically necessary storage access (e.g. saving your cookie choice in your browser and the protection mechanisms of our forms) without consent pursuant to § 25 (2) no. 2 TDDDG.

This also includes the cookie “cf_clearance”, which Cloudflare may set during security checks (bot protection); it serves solely to protect the website (§ 25 (2) no. 2 TDDDG).

All other services (statistics and marketing, see sections 9 to 13) are only loaded after you have expressly consented in the banner (§ 25 (1) TDDDG, Art. 6 (1) lit. a GDPR). Without your consent no scripts from Google or Microsoft are loaded and no corresponding cookies are set.

Note: cookies that Google sets on its own domains after your consent (e.g. “test_cookie” on doubleclick.net) cannot be deleted by us on withdrawal. Withdrawing does, however, stop the loading of the scripts and any transmission by us. You can delete such cookies in your browser settings.

You can change or withdraw your choice at any time: Open cookie settings

9. Consent management (cookie banner)

On your first visit a banner asks whether we may use statistics and marketing services. We store your choice in your browser's local storage (localStorage, key “cs_consent”: banner version, time, your choice and a randomly generated identifier). This storage access is technically necessary for your decision to be respected (§ 25 (2) no. 2 TDDDG).

Proof of consent: to be able to prove that and when you consented or declined (Art. 7 (1) GDPR), your browser sends the random identifier, the banner version, the time and your choice to our function on Cloudflare, where we store these details for three years (Cloudflare Workers KV). We store neither your IP address nor any browser details; the identifier is not linked to your name or your form data. Technically, Cloudflare processes the IP address when the request is made (see section 3). The consent record is kept for three years without the IP address. Legal basis: Art. 6 (1) lit. c GDPR in conjunction with Art. 7 (1) GDPR (accountability).

Abuse protection: to prevent the endpoint from being misused in bulk, we count requests per hour. For this, a keyed hash (HMAC-SHA-256 with a secret key) is formed from your IP address and the current hour, and this counter is stored in Cloudflare Workers KV for at most one hour; the IP address itself is not stored. Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in preventing abuse and keeping the service secure).

Withdrawal: you can withdraw or change your consent at any time with effect for the future, via the “Cookie settings” link in the footer of every page. Withdrawing is as easy as giving consent. On withdrawal we stop further transmission to the respective services and delete their cookies on this website. The lawfulness of processing carried out until then remains unaffected.

10. Google Analytics 4

With your consent to the “Statistics” category we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, USA). We use it to understand which pages are visited and whether visitors send a contact request, book a call or call or email us. The Google script is only loaded after you have consented.

Data processed: pseudonymous usage data such as pages viewed, events (e.g. “contact request sent” – without your input, name or email address), device and browser information, approximate location and an identifier in the cookies “_ga” and “_ga_<ID>” (stored for up to 2 years). Google Signals are always disabled. The ad personalisation signals in Google Analytics (allow_ad_personalization_signals) follow your choice for “Marketing”: they are enabled only if you additionally consent to “Marketing” and otherwise remain disabled. Event data is retained in our Google Analytics account for no more than 2 months.

Legal basis: Art. 6 (1) lit. a GDPR (consent) and § 25 (1) TDDDG. Third-country transfer: a transfer to Google LLC in the USA relies on the European Commission's adequacy decision on the EU-US Data Privacy Framework (Google LLC is certified). You can withdraw your consent at any time via “Cookie settings” in the footer.

11. Google Ads

With your consent to the “Marketing” category we use Google Ads (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, USA) to measure whether an ad led to a contact request (conversion measurement). For this, the Google script is loaded after your consent and the cookies “_gcl_au”, “_gcl_aw” and “_gcl_gb” may be set (stored for up to 90 days). When you submit a request we tell Google that a conversion took place, together with the ad click identifier; your form input is not transmitted.

For calls after an ad click, Google may replace the displayed and clickable phone number with a Google forwarding number with your marketing consent. Calls are forwarded to our normal business number. Call metadata such as time, duration, connection status and the caller's number may be processed. Calls of at least 60 seconds count as conversions; this does not establish that the caller is a qualified new customer. Withdrawing marketing consent restores our normal number on the open page.

With your consent to “Marketing” we also pass the consent signals ad_storage, ad_user_data and ad_personalization to Google (Google Consent Mode). This allows Google to show you personalised ads from us based on your visit (remarketing), e.g. in Google Search. Without this consent all four signals stay “denied” and no Google script is loaded. Legal basis: Art. 6 (1) lit. a GDPR and § 25 (1) TDDDG. Third-country transfer: as with Google Analytics, based on the EU-US Data Privacy Framework.

12. Microsoft Clarity

With your consent to the “Statistics” category we use Microsoft Clarity, a service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (parent company: Microsoft Corporation, USA). Clarity creates anonymised session recordings and heatmaps (mouse movements, clicks, scrolling) so that we can see where visitors have difficulties with the website. The Clarity script is only loaded after your consent and then sets the cookies “_clck” (up to 1 year) and “_clsk” (1 day).

Input is masked; our forms (contact, emergency, application) and the AI assistant are excluded from recording, so what you type and your chat messages are never recorded. Clarity's advertising storage is disabled. Legal basis: Art. 6 (1) lit. a GDPR and § 25 (1) TDDDG. Third-country transfer: based on the EU-US Data Privacy Framework (Microsoft is certified). According to Microsoft, session recordings are deleted after 30 days.

13. Source of the enquiry (campaign parameters)

If you reach our website through an ad or a link with campaign parameters (e.g. the Google click ID “gclid”, “gbraid”, “wbraid” or UTM parameters such as utm_source and utm_campaign), we send these details, together with the landing page and the referrer address, along with your enquiry when you submit a form. They appear in the “Source” block of the internal notification email and serve solely to understand which campaigns lead to enquiries.

Without your consent to “Marketing” we only use the parameters of the page on which you submit the form and store nothing on your device. With your consent we remember where your first page view came from until the end of the browser session, in your browser's session storage (sessionStorage, key “cs_attr”; § 25 (1) TDDDG, Art. 6 (1) lit. a GDPR). Processing of the parameters themselves is based on Art. 6 (1) lit. f GDPR (legitimate interest in measuring the success of our advertising); the details are treated like your enquiry and deleted after 12 months at the latest (see section 5). You may object to this processing under Art. 21 GDPR.

14. AI assistant (“Solvi”)

Our website offers an AI-powered chat assistant named “Solvi”. When you chat with Solvi, you are interacting with an AI system, not a member of our staff; this is labelled “AI assistant” in the chat window itself. Solvi answers questions about Central Solution GmbH and our services automatically and exclusively on the basis of the content of our own website; it does not draw on external sources or general world knowledge. Answers are generated automatically by a language model, may contain errors, and do not replace either individual advice or a legally binding statement. If Solvi cannot find reliable information, it refers you to our team.

Data processed: when you send a message (maximum 500 characters), your text and, if present, up to the last four messages of the current conversation are transmitted to our chat server and processed there only in working memory for the duration of the request. The website section in which you opened the chat (e.g. “leistungen/ki”) is also transmitted so Solvi can give a more relevant answer. Before the request is passed to the language model, an automatic filter removes recognisable personal data from your text (including email addresses, phone numbers, IBANs, card numbers, street addresses, and names following phrases such as “my name is …”) and replaces it with the placeholder “[removed]”; you receive a brief notice about this in the chat. Please still do not enter personal data in the chat; use our contact form for that instead (section 5).

Before your first message, your browser automatically solves a small computational task locally (ALTCHA, a privacy-friendly proof-of-work method) to make automated bulk requests harder; this involves no third-party service, sets no cookie, and makes no link to your identity. Once solved, your browser receives an anonymous session token, valid for at most 30 minutes and containing no identifier, which avoids repeating that computation for further messages in the same conversation.

Your IP address is not stored. To prevent abuse (e.g. automated bulk requests), a checksum is derived from it using a secret key that changes daily; this checksum exists only briefly in working memory and is never written to disk or logged.

No conversation storage, no cookies, no web storage: our chat server stores no conversations and holds no state between requests. The prior history is kept, cryptographically signed, exclusively in your browser's working memory and resent with every new message; it is deleted as soon as you close the chat window or leave the page. Neither the chat assistant nor the short greeting bubble that may appear the first time you open a page uses cookies, local storage, session storage, IndexedDB or similar storage technologies; whether that bubble is shown is freshly re-evaluated on every page load, based solely on the technical origin information of that page load (the referrer) — nothing is stored or recognised.

Taking your statements into account during the conversation: so that Solvi can tailor answers to your situation and ask sensible follow-up questions, it remembers, within one conversation, rough statements you make yourself — only as predefined categories (e.g. the system used and its version, the approximate number of users as a range, industry, goal, whether the system is heavily customised), never names, company names or free text. This “conversation note” is cryptographically signed, kept exclusively in your browser's working memory and resent with every new message; our server does not store it, builds no profile from it and does not link it to earlier or later conversations. It is deleted as soon as you start a new conversation, close the chat window or leave the page. The legal basis here, too, is Art. 6 (1) lit. f GDPR; there is no permanent profiling and no tracking. In addition, every sentence of an answer is checked automatically against the content of our website; unsupported sentences are discarded.

Transfer to the contact form only with your consent: when Solvi offers to request a free initial call, or you ask Solvi to put you in touch with a person, it first asks explicitly: “Use your details from the chat?”. Only if you click “Yes, use them” is a short summary composed of your conversation note and your last (cleaned) question (e.g. “Topic: NAV upgrade · System: Navision 2013 · Users: 10–49”) entered into the message field of the contact form — directly in your browser, without detour via our server. You see and can edit the text before sending; nothing is sent automatically. If you choose “Without details”, the form opens empty. Contact details continue to reach us only through the form (section 5).

Processor: the chat server and the language model used are operated exclusively by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany, in a data centre in Germany. A signed data processing agreement under Art. 28 GDPR is in place with IONOS. The language model “Mistral Small 24B” is used to generate text, and the embedding model “BAAI bge-m3” to match the topic of your question, both via the IONOS AI Model Hub. A standby model with a second provider that the system supports is currently disabled and not in use. No data is transferred outside the EU/EEA.

Anonymous statistics: to improve the assistant we record anonymous technical metrics per request: the date, the language used, the website section, the detected answer type, the topic category of your enquiry where applicable, a coarse response-time bucket, whether you were forwarded to our contact form, your optional thumbs-up/down rating, in the advisory mode also the type of response (e.g. answer, follow-up question, hand-over), the contact level shown (none, hint, offer or card), whether the offer button was clicked, the number of follow-up questions asked, a rough estimate of purchase intent (none, weak, strong) and the number of sentences discarded by the automatic fact check (in each case only a choice from fixed categories or a number), and — only when no answer was found on our website — a keyword about the missing content that has already been cleared of personal data; such a keyword only becomes visible at all in our internal reporting once at least three similar entries exist. The wording of your question or answer, your IP address, and any user-related identifier are not stored in this statistic. The individual records are deleted after 90 days; before that they are rolled up into aggregated daily counts (volume, hand-overs, and positive/negative ratings per day, language, answer type and topic) that no longer allow any conclusions about an individual request.

Legal basis: Art. 6 (1) lit. f GDPR (legitimate interest in answering questions about our services and in preventing abuse) and, where your enquiry aims at a contract, Art. 6 (1) lit. b GDPR. You can object to this processing under Art. 21 GDPR by not using the chat and using our contact form instead (section 5); contact details reach us only through that form, never through the chat server. Solvi does not make any automated decision within the meaning of Art. 22 GDPR that produces legal effects or similarly significantly affects you — it only informs and, at most, forwards enquiries to our team, which decides on everything further.

15. Fonts and assets

All fonts (Bricolage Grotesque, Hanken Grotesk, IBM Plex Mono) and images are served locally from our server. No external providers (Google Fonts, Adobe Fonts etc.) are embedded.

16. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You may withdraw a granted consent at any time with effect for the future.

To exercise your rights, an informal message to [email protected] is sufficient.

17. Supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for us is: