Privacy policy (Datenschutzerklärung)

1. Controller

GenAIze Technologies UG (haftungsbeschränkt), Rosenthaler Str. 72a, 10119 Berlin, Germany, represented by Managing Director Aqsa Mushtaq Peer. Email: admin@genaizetech.com. Further details are in our imprint.

2. Summary

• We do not use analytics, advertising or tracking tools. The only cookie we set is a strictly necessary sign-in cookie for the GenAIze Academy, and only after you sign in.
• The AI Act Checker runs entirely in your browser. Your answers are not sent to us.
• Fonts are hosted on our own website; no connection is made to third-party font servers.
• We only receive personal data if you sign in to the Academy, join the early-access list, book a call, use the contact form or email us.

3. Hosting and server logs

This website is hosted by Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA. When you visit the site, Netlify processes technical data that your browser sends automatically, in particular your IP address, the date and time of the request, the page requested, the referrer URL and your browser and operating system. This is necessary to deliver the website and to keep it secure.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure, reliably delivered website). Processor: we have a data processing agreement with Netlify (Art. 28 GDPR). Transfer to the USA: Netlify relies on the EU-U.S. Data Privacy Framework (adequacy decision under Art. 45 GDPR) and, as a fallback, on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Retention: Netlify keeps server logs only as long as needed to operate and secure the service, as set out in its data processing agreement. We do not analyse them.

4. AI Act Checker

The checker processes your answers in your browser only. Nothing you enter is transmitted to us or stored on our servers. If you copy your summary, it goes to your own clipboard. If you print or save your action plan as a PDF, or download the deadline calendar file, the file is created in your browser and is not sent to us.

We do not use AI to make decisions about you or to profile you. How we do use AI is explained on our page How GenAIze Technologies uses AI.

5. GenAIze Academy: sign-in, cookie and browser storage

Sign-in. The Academy is free. The module overview and the first lesson of Module 1 are open to everyone; to unlock the other lessons and quizzes, you sign in with your email address. We email you a personal sign-in link that is valid for 24 hours. We only store your address once you click the link: it is then added to our list of Academy learners together with the date of your last sign-in. Your verified email address also appears on the completion records you create.

Purpose and legal basis: giving you access to the Academy you requested and showing your verified address on your records, Art. 6(1)(b) GDPR. Signing in does not subscribe you to any emails beyond the sign-in link. Joining the early-access list is a separate, optional choice (section 6).

Processor: the sign-in emails are sent, and the learner list is stored, by Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany (part of the Brevo group, Sendinblue SAS, Paris) under the data processing agreement described in section 6. The sign-in request passes through a function on our website host Netlify (section 3) and is not stored there.

Sign-in cookie. After you click the sign-in link, we set one cookie (__Host-gz_academy). It contains your email address and an expiry date, protected by a digital signature, and keeps you signed in for up to 180 days. It is strictly necessary to provide the service you requested (§ 25(2) no. 2 TDDDG). It is deleted when you sign out or when it expires.

Browser storage. The modules store your course progress, quiz answers and completion record (including the name and role you enter) in your browser's local storage, so you can continue where you left off. This data stays on your device and is not sent to us. Storing it is strictly necessary to provide the course you requested (§ 25(2) no. 2 TDDDG). You can delete it at any time by clearing your browser's site data.

Retention: we delete your address from the learner list 24 months after your last sign-in, or earlier if you ask us to. Sign-in emails that were never confirmed are not stored by us; our email provider keeps its sending logs for its own limited retention period.

6. Early-access list

You can join the early-access list from the AI Act Checker or, with the optional box, when you sign in to the Academy. If you join, we process your email address to send you the emails you agreed to: the launch of the GenAIze Technologies platform, early-access offers and AI Act deadline reminders. Only if you sign up from the checker and tick the optional box do we also receive a summary of your check (company size, number of systems assessed and highest risk class).

Double opt-in: after you sign up, we email you a confirmation link, and you are only added to the list once you click it. To prove your consent, we log the time of sign-up and confirmation, the version of the consent text shown and the IP address used to confirm.

Processor: we send the confirmation email and the early-access emails, and store the list and consent log, using Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany (part of the Brevo group, Sendinblue SAS, Paris), under a data processing agreement (Art. 28 GDPR). The provider is based in the EU; where it uses sub-processors outside the EU/EEA, it relies on adequacy decisions, including the EU-U.S. Data Privacy Framework, or the EU Standard Contractual Clauses with supplementary measures (Art. 45, 46(2)(c) GDPR), as set out in Brevo's data processing agreement (Appendix 3 to its terms of use). The sign-up is passed to the provider through a function on our website host Netlify (see section 3) and is not stored there.

Legal basis: your consent, Art. 6(1)(a) GDPR, for the emails and the optional summary; for the consent log, Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR and Art. 6(1)(f) GDPR (our legitimate interest in being able to prove consent). You can withdraw your consent at any time with effect for the future, using the unsubscribe link in every email or by emailing us.

Retention: we delete your email address and check summary when you withdraw your consent or when the early-access programme ends. We keep the consent log for three years after that, to defend ourselves against claims (§§ 195, 199 BGB), and then delete it.

7. Contact by email, contact form or booked call

If you email us or use the contact form in our imprint, we process your name, email address and message to answer your enquiry. Contact-form messages are received and stored by Netlify on our behalf (Netlify Forms). To protect the form against spam, Netlify checks submissions automatically; for this purpose, submission content and technical data may be transmitted to Netlify's sub-processor Automattic Inc. (Akismet), USA, on the transfer basis set out in Netlify's data processing agreement. Emails to us, and notifications of form submissions, are processed by our email provider Google Cloud EMEA Limited, Velasco, Clanwilliam Place, Dublin 2, Ireland (Google Workspace) on our behalf under a data processing agreement (Art. 28 GDPR). Google may process this data, or have it processed by its sub-processors, outside the EEA, including in the USA; such transfers are covered by Google's Cloud Data Processing Addendum (section 10), which relies on a recognised transfer framework, such as the EU-U.S. Data Privacy Framework under which Google LLC is certified (Art. 45 GDPR), or otherwise on the EU Commission's standard contractual clauses (Art. 46(2)(c) GDPR). Google lists its sub-processors at workspace.google.com/terms/subprocessors.

Legal basis: Art. 6(1)(b) GDPR where your enquiry relates to a contract, otherwise Art. 6(1)(f) GDPR; our legitimate interest is answering your enquiry. We delete the data once your enquiry has been dealt with, unless statutory retention periods apply.

Booking a call. If you book a walkthrough, you use a booking page provided by Google Calendar, which opens on Google's website. You enter your name and email address and, if you wish, a note on your company and what you would like to see. Google adds the appointment, with a Google Meet video link, to our company calendar and sends confirmation and reminder emails to you and to us. We use this data only to hold the call and follow up on it. Google processes it on our behalf as part of Google Workspace, under the data processing agreement and transfer safeguards described above. When the booking page is open, Google may also process technical data about your visit, as described in Google's privacy policy; we do not receive that data.

Legal basis: Art. 6(1)(b) GDPR (steps taken at your request before a possible contract) or, where no contract is in view, Art. 6(1)(f) GDPR (our legitimate interest in holding the call you asked for). Retention: we delete the appointment and your details from our calendar 12 months after the call, or earlier if you ask us to, unless they become part of a contract or statutory retention periods apply.

8. Required data and automated decisions

You are not legally or contractually obliged to provide personal data. Without an email address, we cannot unlock the Academy for you, add you to the early-access list, book a call with you or reply to your message. We do not make decisions based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR.

9. Right to object (Art. 21 GDPR)

Where we process your personal data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time, on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. If we process your data for direct marketing, you can object at any time without giving reasons, and we will stop processing it for that purpose. To object, email admin@genaizetech.com.

10. Your other rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20 GDPR), and to withdraw consent at any time with effect for the future (Art. 7(3) GDPR). To exercise them, email us.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin.

11. Changes

We update this policy when our website or the law changes. The current version is always available on this page.