Privacy policy

1. Controller

The controller for data processing on this website within the meaning of Article 4(7) GDPR is:

SempreAI GmbH i.Gr.
Rheinpromenade 13
40789 Monheim am Rhein
Germany

Email: schmidt@sempreai.de

Represented by: Michael Schmidt

For data protection questions you can reach us at the address above or by email.

2. Data protection officer

The legal conditions for appointing a data protection officer under Article 37 GDPR in conjunction with section 38 of the German Federal Data Protection Act are not currently met. Please direct data protection enquiries to the controller named above. Should this assessment change, the contact point will be published here.

3. Principles of processing

We process personal data only to the extent necessary to provide a functional website together with our content and services, or where you have given consent. Processing takes place exclusively on one of the following legal bases:

• Article 6(1)(a) GDPR – your consent, for example for analytics and marketing.
• Article 6(1)(b) GDPR – performance of a contract or pre-contractual measures, for example in the case of a project enquiry.
• Article 6(1)(c) GDPR – compliance with legal obligations, for example commercial and tax retention periods.
• Article 6(1)(f) GDPR – protection of legitimate interests, for example the secure and uninterrupted operation of this website.

In addition, the storing of information on your device and access to information already stored are governed by section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG).

4. Hosting

This website is operated with an external service provider. The provider is Hostinger International Ltd., Švitrigailos str. 34, 03230 Vilnius, Lithuania. The servers delivering this website are located within the European Union.

The provider processes all data collected through this website, in particular IP addresses, access times, metadata and communication content. The legal basis is Article 6(1)(f) GDPR; our legitimate interest lies in the secure, stable and efficient provision of our online offering. A data processing agreement under Article 28 GDPR is in place with the provider.

5. Server log files

When this website is accessed, information transmitted by your browser is automatically stored in what are known as server log files. These are:

• shortened IP address of the requesting device
• date and time of access
• name and URL of the file retrieved and volume of data transferred
• notification of successful retrieval (HTTP status code)
• browser type and version used, and the operating system
• previously visited page (referrer URL), where transmitted

This data cannot be attributed by us to any specific individual and is not merged with other data sources. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in technical delivery, operational security, and the investigation and prevention of attacks. Log files are deleted automatically after 14 days at the latest, unless they are required for longer in an individual case to investigate a security incident.

6. Contact by form and email

If you contact us through the contact form or by email, we process the details you provide – name, company, email address, telephone number where given, the selected topic and the content of your message – solely to handle your request and for any follow-up questions.

The legal basis is Article 6(1)(b) GDPR where your enquiry is directed at concluding or performing a contract. In all other cases we base the processing on your consent under Article 6(1)(a) GDPR and on our legitimate interest in responding to enquiries under Article 6(1)(f) GDPR.

The form is transmitted exclusively in encrypted form over HTTPS. To protect against automated submissions we use a hidden form field and a server-side plausibility check. No external captcha service is used, so no data is transferred to third parties for this purpose.

Your details remain with us until you ask us to delete them, withdraw your consent, or the purpose for storage ceases to apply – for example once your request has been dealt with. Mandatory statutory provisions, in particular commercial and tax retention periods, remain unaffected.

7. Consent management and local storage

Without your consent this website sets no cookies for analytics or marketing purposes. The following are strictly necessary:

• an entry in your browser’s local storage containing your choice in the consent banner, so that the request is not repeated on every page view,
• a session cookie which is set only when the contact page is opened and which enables the form to be protected against third-party submissions.

These storage operations do not require consent under section 25(2) no. 2 TDDDG, as they are strictly necessary to provide the service you expressly requested. The legal basis for the associated processing is Article 6(1)(f) GDPR.

You can change or fully withdraw your consent decision at any time using the “Cookie settings” button in the page footer. Withdrawal takes effect for the future; the lawfulness of processing carried out until then remains unaffected.

8. Reach measurement with Google Analytics 4

Where you have consented to the “Statistics” category in the consent banner, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics uses cookies and comparable technologies that enable an analysis of your use of this website. In particular, pages viewed, time on site, approximate location based on the shortened IP address, device used and the source of the visit are recorded. The IP address is shortened before any further processing. It is not merged with other data available to us.

The legal basis is exclusively your consent under Article 6(1)(a) GDPR in conjunction with section 25(1) TDDDG. Without that consent the analytics script is not loaded and no connection to Google servers takes place.

A transfer of personal data to the United States cannot be excluded. Google LLC is certified under the EU-US Data Privacy Framework; in addition, standard contractual clauses under Article 46(2)(c) GDPR are in place. Despite these safeguards there remains a risk that US authorities may access data and that fully equivalent legal remedies before European courts may not be available to you. By giving your consent you also consent to the transfer under Article 49(1)(a) GDPR.

The event data recorded is deleted automatically by Google after 14 months by default. Further information is available in Google’s privacy policy at policies.google.com/privacy.

9. Google Ads and conversion measurement

Where you have consented to the “Marketing” category in the consent banner, we use Google Ads including conversion measurement. The provider is likewise Google Ireland Limited.

If you reach this website through one of our advertisements, a cookie is set. This allows us to establish whether an advertisement led to an enquiry. We receive only aggregated statistics on the total number of users who responded to an advertisement. Identifying individuals on the basis of this data is not possible for us.

The legal basis is your consent under Article 6(1)(a) GDPR in conjunction with section 25(1) TDDDG. Without consent no corresponding scripts are loaded. The statements in section 8 regarding a possible transfer to the United States apply accordingly.

10. Typefaces and external content

All typefaces, graphics and scripts on this website are served exclusively from our own server. No content is loaded from content delivery networks, Google Fonts or comparable services. Your IP address is therefore not transmitted to third parties.

This website embeds no map services, social media plugins, video platforms or external buttons.

11. Recipients and processing on our behalf

Your data is only passed on to third parties where this is necessary to perform a contract, where we are legally obliged to do so, where you have consented, or where there is an overriding legitimate interest. Current recipients are:

• our hosting provider as a processor under Article 28 GDPR,
• our email service provider for delivering messages sent through the contact form,
• where consent has been given: Google Ireland Limited for reach and advertising performance measurement.

Agreements meeting the requirements of Article 28 GDPR are in place with all processors.

12. Retention periods

We process personal data only for as long as necessary for the relevant purpose. The following apply:

• server log files: deleted after 14 days at the latest,
• enquiries without business relationship: deleted no later than six months after the request has been dealt with,
• enquiries with a contractual context: retained in line with commercial and tax periods of six and ten years respectively,
• consent records: retained for the duration of the consent plus three years thereafter as evidence under Article 7(1) GDPR.

13. Your rights as a data subject

You have the following rights vis-à-vis the controller:

• access to the data processed about you under Article 15 GDPR,
• rectification of inaccurate data or completion of incomplete data under Article 16 GDPR,
• erasure of the data stored with us under Article 17 GDPR, unless a statutory retention obligation prevents it,
• restriction of processing under Article 18 GDPR,
• data portability in a structured, commonly used and machine-readable format under Article 20 GDPR,
• objection to processing based on Article 6(1)(f) GDPR, under Article 21 GDPR,
• withdrawal of consent given, with effect for the future, under Article 7(3) GDPR.

An informal message to the contact details given above is sufficient to exercise these rights.

14. Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you have the right under Article 77 GDPR to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement.

The supervisory authority responsible for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

15. Necessity of providing data

Providing personal data is neither legally nor contractually required. To answer an enquiry through the contact form, however, we need at least your name, an email address and your message. Without these details we cannot deal with your request. No further disadvantages arise for you.

16. No automated decision-making

Automated decision-making, including profiling, within the meaning of Article 22 GDPR does not take place. Where we use AI-assisted tools in our consulting work, this is exclusively supportive; every professional assessment and decision is made and owned by people.

17. Security of processing

This website is delivered exclusively over a TLS-encrypted connection (HTTPS). In addition we apply technical and organisational measures under Article 32 GDPR, including security headers in the delivery process, a restrictive referrer policy and regular updating of the components in use.

18. Changes to this privacy policy

We adapt this privacy policy whenever changes to our processing or to the legal framework make it necessary. The version published on this page applies to each of your visits.

Version of this privacy policy: 24.09.2026