Privacy Policy

Last updated: April 2025 · Data controller: Marten Zöllner, AI-Champion, Weingartenstraße 54, 44263 Dortmund, Germany, info@ai-champion.com

This website is operated under German law. The original German version of this privacy policy is the legally binding document.

1. Privacy at a Glance

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to personally identify you. Detailed information can be found in the sections below.

2. Data Controller (Art. 13 GDPR)

Marten Zöllner
AI-Champion
Weingartenstraße 54
44263 Dortmund
Germany
Email: info@ai-champion.com
Phone: +49 162 5202010

If you wish to contact a data protection supervisory authority, the responsible authority for North Rhine-Westphalia is: Landesbeauftragte für Datenschutz und Informationsfreiheit NRW, Postfach 20 04 44, 40102 Düsseldorf, www.ldi.nrw.de.

3. Legal Bases for Processing

We process personal data on the following legal bases:

Art. 6(1)(a) GDPR – Consent (e.g. newsletter, marketing cookies)
Art. 6(1)(b) GDPR – Performance of a contract / pre-contractual measures (contact requests, quote enquiries)
Art. 6(1)(f) GDPR – Legitimate interests (security, fraud prevention, server logs)

4. Hosting: Vercel

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Server log files are automatically collected with each page request (IP address, browser, timestamp). Transfer to the USA is based on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). A data processing agreement (DPA) has been concluded. Legal basis: Art. 6(1)(f) GDPR. Privacy policy: vercel.com/legal/privacy-policy

5. Fonts (Self-Hosted)

We use the fonts Outfit and DM Sans. These fonts are downloaded at build time via next/font and served from our own servers. No data is transferred to Google servers. No cookie consent is required.

6. Database: Supabase

Form data (contact forms, quiz results, consent logs) is stored in a PostgreSQL database by Supabase. The database servers are located in the EU (Frankfurt, Germany). A data processing agreement (DPA) has been concluded. Legal basis: Art. 6(1)(b) and (f) GDPR. Privacy policy: supabase.com/privacy

7. CRM System: HubSpot

We use HubSpot (HubSpot Inc., 25 First Street, Cambridge, MA 02141, USA) as our CRM system for managing customer enquiries and lead follow-up. Data submitted via forms (name, email, phone, industry) is stored in HubSpot. HubSpot processes data on servers in the EU (Frankfurt). Transfer to the USA is based on EU Standard Contractual Clauses. A data processing agreement (DPA) has been concluded. Legal basis: Art. 6(1)(b) and (f) GDPR. Privacy policy: legal.hubspot.com/privacy-policy

8. Appointment Scheduling: Calendly

We use Calendly (Calendly LLC, 3423 Piedmont Rd NE, Atlanta, GA 30305, USA) for appointment scheduling. When you book an appointment via the “Book appointment” button, you are redirected to Calendly. The data entered there (name, email, appointment request) is transmitted directly to Calendly. Transfer to the USA is based on EU Standard Contractual Clauses. Calendly does not set cookies on our website. No separate cookie consent is required. Legal basis: Art. 6(1)(b) GDPR. Privacy policy: calendly.com/privacy

9. AI Chatbot (Anthropic / Claude)

On certain pages of this website, an AI-powered chatbot is integrated. This assistant is operated by Anthropic, PBC (548 Market St, PMB 90375, San Francisco, CA 94104, USA) and is labelled as artificial intelligence in accordance with the EU AI Act. Your chat inputs are transmitted to Anthropic in real time to answer your enquiry. No chat content is permanently stored unless you enter personal data in the chat yourself. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing an interactive demo). Further information: AI Transparency page. Privacy policy: anthropic.com/privacy

10. Analytics: Vercel Analytics

We use Vercel Analytics (Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA), a privacy-friendly web analytics service that:

does not set cookies
does not collect or store personal data
does not create user profiles
only captures aggregated, anonymised usage statistics

Cookie consent is not required for Vercel Analytics. Legal basis: Art. 6(1)(f) GDPR. Privacy policy: vercel.com/legal/privacy-policy

11. Google Tag Manager and Google Ads Conversion Tracking

We use Google Ads conversion tracking via Google Tag Manager to measure the effectiveness of our advertising campaigns. This tracking is only loaded after your explicit consent (cookie consent “Marketing”). Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Tag Manager itself does not collect personal data but acts as a container for other tags. Without your consent, no Google scripts are executed. Via the Tag Manager, Google Ads conversion tracking records conversions (e.g. appointment bookings, form submissions) in anonymised form. Legal basis: Art. 6(1)(a) GDPR (consent). You can revoke your consent at any time by clearing your browser cache and cookies and reloading the page. Privacy policy: policies.google.com/privacy

12. Cloudflare Turnstile (Spam Protection)

We use Cloudflare Turnstile to protect our forms from spam and automated abuse. Turnstile is a CAPTCHA alternative that analyses browser behaviour without requiring user interaction (puzzle-free). Provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. When you interact with a protected form, technical metadata (IP address, browser, timestamp) is transmitted to Cloudflare for bot detection. Transfer to the USA is based on EU Standard Contractual Clauses. A data processing agreement (DPA) has been concluded. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in protecting our forms from spam and automated abuse). DPA: cloudflare.com/cloudflare-customer-dpa/ · Privacy policy: cloudflare.com/privacypolicy/

13. YouTube Videos (Google LLC)

We embed videos from YouTube (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Videos are only loaded after your explicit consent (2-click solution). Before you click Play, no data is transmitted to Google. When you click Play, YouTube may set cookies and collect data (IP address, viewing behaviour). The privacy-enhanced mode (youtube-nocookie.com) is used to minimise tracking. Legal basis: Art. 6(1)(a) GDPR (consent). Privacy policy: policies.google.com/privacy

14. Contact Forms and Lead Collection

When you use our contact forms, the AI Potential Check or the ROI Calculator, we collect the following data: name, email address, optionally phone number and industry. This data is stored in our Supabase database and in HubSpot (see above).

Every form submission requires confirmation of our privacy policy (mandatory checkbox). The exact consent text and timestamp are recorded in a separate consent log (Art. 7(1) GDPR – accountability obligation).

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(a) GDPR for the newsletter.

15. Newsletter

You may optionally subscribe to our newsletter. This is done exclusively by actively checking the newsletter checkbox (opt-in) – there is no pre-selected checkbox (GDPR-compliant). Your email address is stored in HubSpot and used solely for newsletter delivery. You can unsubscribe at any time via the unsubscribe link in the newsletter or by email to info@ai-champion.com. Legal basis: Art. 6(1)(a) GDPR.

16. Data Retention

We follow a documented data deletion concept. Data is deleted automatically once the purpose of processing has been achieved or the statutory retention period expires:

Leads / contact enquiries: automatically deleted after 24 months (unless business relationship exists or statutory retention periods apply – 6 or 10 years under German commercial/tax law)
Chat sessions: deleted after 30 days
AI chat content: no permanent storage – processed in real time, not logged
Consent logs: 3 years (Art. 7(1) GDPR accountability obligation)
Rate-limit records: deleted after 7 days
Server log files: 7 days
Cookie-consent cookie: 1 year

17. WhatsApp Business (Meta)

On our website we offer a WhatsApp contact button. Clicking the button opens WhatsApp on your device with a pre-filled message and our phone number. No automatic data transfer occurs on page load — only when you actively click the button. When you contact us via WhatsApp, the privacy policies of Meta/WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland apply. Legal basis: Art. 6(1)(a) GDPR (consent through active click). Privacy policy: whatsapp.com/legal/privacy-policy-eea

18. Data Processors (Art. 28 GDPR)

The following service providers have been engaged as data processors and a DPA has been concluded with each:

Vercel Inc. (hosting) – USA, SCC
Supabase Inc. (database) – EU (Frankfurt)
HubSpot Inc. (CRM) – EU (Frankfurt)
Anthropic PBC (AI chatbot) – USA, SCC
Google LLC / YouTube (video embedding, 2-click) – USA, SCC
Cloudflare, Inc. (Turnstile spam protection) – USA, SCC

SCC = EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.

19. Your Rights as a Data Subject

You have the following rights regarding your personal data:

Access (Art. 15 GDPR): Information about what data we have stored about you
Rectification (Art. 16 GDPR): Correction of inaccurate data
Erasure (Art. 17 GDPR): “Right to be forgotten”
Restriction (Art. 18 GDPR): Restriction of processing
Data portability (Art. 20 GDPR): Data in a machine-readable format
Objection (Art. 21 GDPR): Objection to processing based on legitimate interests
Withdrawal (Art. 7(3) GDPR): Withdrawal of consent with future effect
Complaint (Art. 77 GDPR): Complaint to the competent data protection supervisory authority

To exercise your rights, please contact us by email: info@ai-champion.com

Note: This privacy policy was prepared to the best of our knowledge. We recommend regular review and legal consultation before going live. Last updated: April 2025.