Privacy Policy for Business Services

Note on this translation: This English version is provided as a courtesy translation for convenience only. Solely the German version of this privacy policy is legally binding. In the event of any discrepancies or conflicts between the German original and this translation, the German version shall prevail.

This privacy policy applies to the access-restricted services of denkbares GmbH, in particular ticket tracking and account management (“Business Services”). A separate privacy policy applies to visits to our public website, available at https://www.denkbares.com/datenschutz/.

1. Name and Address of the Controller

The controller within the meaning of the GDPR and other data protection regulations is:

denkbares GmbH
John-Skilton-Straße 8
97074 Würzburg
Germany
Phone: +49 931 / 900050-00
E-mail: info@denkbares.com

For questions regarding data protection, you can reach us at datenschutz@denkbares.com.

2. Collection and Storage of Personal Data

2.1 Technical Access Data

When accessing our Business Services, information transmitted by your device with your request is automatically collected. This includes:

  • date and time of the request,
  • the URL of the request,
  • the website from which the access originated (HTTP referrer),
  • the originating IP address of the request, and
  • the client software (browser) used by you.

We process this data to ensure a technically flawless connection, to guarantee the security and availability of our services, and for further administrative purposes. The legal basis is Art. 6 (1) sentence 1 lit. f GDPR; our legitimate interest follows from the purposes stated above. The collected data is deleted 14 days after the access. In case of suspected misuse, we expressly reserve the right to analyze the collected data.

2.2 denkbares ID

If you are in a business relationship or an employment relationship with denkbares GmbH, you may be granted access to the Business Services via a so-called “denkbares ID”. To create a denkbares ID, the following data is collected and processed:

  • your first and last name,
  • your business e-mail address,
  • your company affiliation.

The legal basis is Art. 6 (1) sentence 1 lit. b GDPR insofar as the processing serves the performance of a contractual relationship, and otherwise Art. 6 (1) sentence 1 lit. f GDPR. Our legitimate interest lies in being able to offer personalized access, implement authorizations, and prevent misuse. The collected data is deleted no later than 90 days after the end of the business relationship. You may at any time request the deletion of your denkbares ID or the modification of the data stored about you.

2.3 Ticket Tracking

As part of ticket tracking, we process the ticket content created by you as well as the associated account data (in particular your name as creator, editor, or commenter of a ticket). The purpose of this processing is the execution and documentation of joint projects. The legal basis is Art. 6 (1) sentence 1 lit. b GDPR. Ticket data is stored for the duration of the respective project as well as statutory retention periods.

3. Use of AI Services for Ticket Management

3.1 Scope and Purpose of Processing

To support the management of tickets (e.g., summarization, categorization, prioritization, and assignment of tickets within projects), we use AI services from the following providers:

  • Anthropic PBC, 500 Howard Street, San Francisco, CA 94105, USA (“Claude”),
  • OpenAI, L.L.C., 1455 3rd Street, San Francisco, CA 94158, USA.

In doing so, we transmit the ticket content required for ticket management as well as the name of the person who created the respective ticket or is mentioned therein to these providers. The providers process the data exclusively on our behalf as processors pursuant to Art. 28 GDPR. The transmitted data is not used for training the AI models.

3.2 Legal Basis

The legal basis for this processing is Art. 6 (1) sentence 1 lit. f GDPR. Our legitimate interest lies in the efficient, consistent, and timely handling of tickets created in our projects.

3.3 Transfers to Third Countries

The aforementioned providers are based in the USA; processing of personal data in the USA can therefore not be ruled out. The transfer takes place on the basis of the Standard Contractual Clauses adopted by the EU Commission pursuant to Art. 46 (2) lit. c GDPR, which we have concluded with both providers. In addition, we have agreed upon or implemented supplementary technical and organizational safeguards, in particular transport encryption, data minimization, and contractual restrictions on the purposes of processing. You may request a copy of the Standard Contractual Clauses at datenschutz@denkbares.com.

3.4 Storage Period and Objection

The data transmitted to the AI providers is retained there only for the duration of the respective processing and is deleted afterwards; permanent storage takes place exclusively in our own systems (see Section 2.3). You may object to the processing of your data by AI services at any time with effect for the future (see Section 6.2); your tickets will then be managed exclusively manually.

4. Disclosure of Data

denkbares GmbH processes personal data on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. A corresponding data processing agreement pursuant to Art. 28 GDPR is in place.

Your personal data will not be transferred to third parties except in the cases mentioned in this policy (in particular Section 3), unless:

  • you have given your express consent (Art. 6 (1) sentence 1 lit. a GDPR),
  • the disclosure of the data is required by law (Art. 6 (1) sentence 1 lit. c GDPR), or
  • the transfer is legally permissible and necessary for the performance of contractual relationships with you (Art. 6 (1) sentence 1 lit. b GDPR).

5. Cookies

Our Business Services use only technically necessary cookies, in particular for session management (login) and for storing settings such as language selection. The storage of these cookies is strictly necessary for the operation of the services; consent is not required pursuant to Section 25 (2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG). The legal basis for the associated data processing is Art. 6 (1) sentence 1 lit. f GDPR. You may configure your web browser to delete or block cookies; in this case, you must expect limitations in the functionality of our services.

6. Your Rights

6.1 Rights of Data Subjects

If your personal data is processed by us, you are a data subject within the meaning of the GDPR. As a data subject, you have the right:

  • to obtain information about your personal data processed by us. In particular, you may request information about the purposes of processing, the categories of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the origin of your data if it was not collected from us, and the existence of automated decision-making including profiling and, where applicable, meaningful information about its details (Art. 15 GDPR),
  • to obtain the immediate rectification of inaccurate personal data or the completion of your personal data stored by us (Art. 16 GDPR),
  • to request the erasure of your personal data stored by us, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defense of legal claims (Art. 17 GDPR),
  • to request the restriction of the processing of your personal data insofar as the accuracy of the data is contested by you, the processing is unlawful but you oppose its erasure and we no longer need the data, but you require it for the establishment, exercise, or defense of legal claims, or you have objected to the processing pursuant to Art. 21 GDPR (Art. 18 GDPR),
  • to receive your personal data that you have provided to us in a structured, commonly used, and machine-readable format, or to request its transmission to another controller (Art. 20 GDPR),
  • to withdraw any consent you have given at any time (Art. 7 (3) GDPR),
  • to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement (Art. 77 GDPR).

6.2 Right to Object

Insofar as your personal data is processed on the basis of legitimate interests pursuant to Art. 6 (1) sentence 1 lit. f GDPR, you have the right pursuant to Art. 21 GDPR to object to the processing of your personal data, provided that there are grounds relating to your particular situation. This applies in particular to the processing by AI services pursuant to Section 3.

To exercise your right to object or withdraw consent, please send an e-mail to datenschutz@denkbares.com.

7. Final Remarks

This privacy policy is currently valid and was last updated in August 2026. Changes to the scope of functions of our services may result in changes to this privacy policy. The current version can always be found here.