Privacy Policy

1. Controller

9brains GmbH
Sonnwendstr. 1b
83229 Aschau im Chiemgau, Germany
Email: info@9brains.de

When you visit our website, information of a general nature is automatically collected. This information, known as server log files, includes for example the type of web browser, the operating system used, the domain name of your internet service provider and similar technical data.

2. Purposes, Legal Bases, Data Categories

• Operation of the website, security and error analysis
  • Art. 6(1)(f) GDPR
  • Data: server log data, in particular truncated IP, date and time, referrer, user agent, technical identifiers
• Contact requests by email or telephone
  • Art. 6(1)(b) GDPR
  • Data: contact details, content of the request
• Web analytics (Umami)
  • Art. 6(1)(f) GDPR
  • Data: anonymized usage data, for example page views and events, without any personal reference
• Video hosting and video analytics (Tella)
  • Art. 6(1)(f) GDPR for providing and analyzing product videos on the website
  • Art. 6(1)(a) GDPR for webinar recordings and their provision, insofar as consent is obtained for this
  • Data: IP address, browser and device information, referrer, country, video views, playback duration, drop-off points, interaction and reach data, and, for identified viewers, possibly also email address and individual viewer activities
• Legal obligations
  • Art. 6(1)(c) GDPR

3. No Cookies – Zero-Cookie Policy

This website does not use cookies for its own analytics purposes. We use neither our own cookies nor third-party cookies for tracking purposes. No cookie-like technologies such as local storage or session storage are used for tracking purposes.

This also applies to the purely cookieless web analytics with Umami.

When Tella is used as a video and webinar service, however, technical or comparable technologies as well as usage analytics may occur in connection with the provision and evaluation of videos. Insofar as cookies or similar technologies are used for this, this is done only on the basis of consent, where such consent is required under applicable law.

4. Services Used and Processors

4.1 Hosting and CDN – Cloudflare Pages

• Purpose: hosting, CDN, performance
• Data: IP address, request metadata such as URL, user agent, referrer, timestamp
• Retention period: Cloudflare processes IP addresses for delivery and stores log data for a maximum of 72 hours
• Region: global CDN network, EU locations prioritized
• Legal basis: Art. 6(1)(f) GDPR
• A data processing agreement has been concluded with Cloudflare

4.2 Web Analytics – Umami

• Purpose: anonymized web analytics to optimize our offering
• No cookies: Umami works cookieless
• IP hash anonymization: IP addresses are hashed and not stored in plain text
• No personal data: identification of individual persons is not possible
• Server location: Germany
• Legal basis: Art. 6(1)(f) GDPR
• No consent required, as no cookies and no personal data are processed

4.3 CRM and Newsletter Delivery – Brevo

• Purpose: management of customer and prospect data, sending newsletters and marketing emails
• Data: contact details, newsletter subscription data, communication content, delivery and interaction data, technical metadata
• Legal basis: Art. 6(1)(a) GDPR for newsletter delivery, Art. 6(1)(b) GDPR for pre-contractual or contractual communication, Art. 6(1)(f) GDPR for CRM use
• Third-country transfer: according to Brevo, processing and storage generally take place within the EU. Third-country transfers may occur in individual cases via sub-processors or group companies; according to Brevo, these are safeguarded in particular through Standard Contractual Clauses and additional protective measures.
• A data processing agreement has been concluded with Brevo

4.4 Appointment Booking – Calendly

• Purpose: online appointment scheduling, for example for consultations
• Data: contact details such as name and email, preferred appointment times, communication content and technical metadata
• Legal basis: Art. 6(1)(a) and (b) GDPR
• Third-country transfer: we use Calendly, USA, for appointment booking. Your data may be transferred to the USA. Calendly is certified under the EU-US Data Privacy Framework; in addition, Calendly refers to further appropriate safeguards, in particular Standard Contractual Clauses.
• A data processing agreement has been concluded with Calendly

4.5 Video Hosting and Video Analytics – Tella

• Purpose: provision of product videos on the website as well as webinar recordings and replays
• Data: IP address, browser and device information, referrer, country, video views, playback duration, drop-off points, interaction and reach data, and, for identified viewers, possibly also email address and individual viewer activities
• Legal basis: Art. 6(1)(f) GDPR for product videos and their analysis, Art. 6(1)(a) GDPR for webinar recordings and their provision, insofar as consent is obtained for this
• Third-country transfer: processing in the USA possible, additionally via sub-processors in further third countries
• A data processing agreement has been concluded with Tella
• Tella processes the data as a processor; for third-country transfers, Tella refers to Standard Contractual Clauses and additional protective measures

4.6 Advertising Performance Measurement – Google Ads

• Purpose: measuring the effectiveness of our Google Ads campaigns in order to use our advertising budget efficiently
• How it works: if you visit our website via a Google ad, the URL contains a pseudonymous click identifier assigned by Google. If your visit shows interest in our services, for example based on the time spent on the site or the pages viewed, we report this click identifier together with a timestamp via our own servers to Google Ads as a conversion event. If you subsequently register for the 9brains platform, the platform's privacy policy additionally applies.
• Data: click identifier, event type, timestamp. We cannot identify any person from this data. Google may link the identifier to the ad click and, where applicable, to a Google account, and processes this data under its own responsibility.
• No cookies: the measurement works without cookies and without storing any information on your device. Consent under Section 25 of the German TDDDG is therefore not required.
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest in measuring and optimising our advertising). You may object to this processing at any time (Art. 21 GDPR).
• Recipient and third-country transfer: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework.
• Retention period: on our systems only until transmission to Google Ads, deletion after 90 days at the latest

5. Google Integrations (Platform Feature)

Within the 9brains platform you can optionally connect your own Google services with your Google account (currently Google Ads, Google Analytics, Google Search Console and Google Workspace) to analyze their data through the AI assistant and, where the respective integration supports it, manage them. This feature concerns the use of the platform, not visits to this website. The connection is established exclusively through Google's official OAuth 2.0 flow and only after your explicit consent.

• Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
• Legal basis: Art. 6(1)(b) GDPR for providing the feature you use; Art. 6(1)(a) GDPR (consent) for connecting your Google account, which you may withdraw at any time
• Access and scope: After your authorization, 9brains accesses the respective Google API on your behalf (delegated, using your own account permissions). Only data your connected Google account already has access to is processed. Depending on the integration, this includes in particular:
  • Google Ads: campaigns, ad groups, keywords, budgets and performance metrics (e.g. impressions, clicks, cost, conversions)
  • Google Search Console: search performance data (search queries, clicks, impressions, positions), indexing status of individual URLs and sitemaps (read-only access)
  • Google Workspace: depending on the permissions granted, calendar, contacts, tasks, documents, spreadsheets, presentations, individual Drive files, forms, and sending e-mails via Gmail
• Purpose: The data is used solely to carry out the tasks you request in the assistant: analyses and reports as well as, where the respective integration supports changes, actions that you explicitly confirm beforehand
• Storage: Your Google OAuth access and refresh tokens are stored encrypted so that the connection persists, and can be revoked at any time. The retrieved Google data is processed only for the duration of the respective request and is not stored persistently beyond that (except for results you deliberately choose to save)
• Third-country transfer: Google may also process data in the USA (Google LLC). Google is certified under the EU-US Data Privacy Framework; additionally, Google relies on Standard Contractual Clauses and further safeguards
• Withdrawal: You can disconnect any connection at any time in the 9brains settings and additionally revoke access at https://myaccount.google.com/permissions

Sharing and Limited Use: Google user data is not sold, not used for advertising, not used to train AI models, and not shared with third parties. 9brains's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Contact and Email

We process your information to handle your request pursuant to Art. 6(1)(b) GDPR.

Retention period: until completion of the request and in accordance with statutory retention periods.

7. External Links

Our website contains links to external third-party websites, in particular Calendly for appointment booking and possibly further services in the context of communication or appointment scheduling. The respective operators are responsible for the content and data protection practices of external sites.

8. Retention Periods

• Server logs (Cloudflare): maximum 72 hours
• Umami analytics data: indefinite, as fully anonymized and without any personal reference
• Contact requests: 6 months after completion of the request, unless statutory retention obligations require otherwise
• Contract data: up to 10 years after the end of the contract in accordance with commercial and tax retention obligations
• Tella video data and webinar replays: until the video is deleted or until the end of the provision purpose; for account data in the Tella account in accordance with the Tella DPA, upon deletion no later than 90 days after termination of the account, unless statutory retention obligations require otherwise
• Google OAuth tokens (all Google integrations): stored encrypted for the duration of the connection; deleted when the connection is disconnected or revoked. Retrieved Google data is processed only for the duration of the respective request and is not stored persistently.

9. Data Subject Rights

You have the following rights regarding your personal data:

• Access pursuant to Art. 15 GDPR
• Rectification pursuant to Art. 16 GDPR
• Erasure pursuant to Art. 17 GDPR
• Restriction of processing pursuant to Art. 18 GDPR
• Data portability pursuant to Art. 20 GDPR
• Objection pursuant to Art. 21 GDPR
• Withdrawal of consent given

Contact: datenschutz@9brains.de

10. Right to Lodge a Complaint with a Supervisory Authority

Complaint: Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), https://www.lda.bayern.de

11. Security

TLS encryption, access management, security headers and further technical and organizational measures.

12. Changes

We update this policy when services or processes change. The version published here at any given time applies.