Privacy policy
privacy policy
This website processes personal data only to a limited extent: content details only if you provide them to us yourself – for example in the project profile form or by email – as well as technical access data (see “Server access”) and data from audience measurement with Plausible Analytics (see “Audience measurement”).
Controller
acessio — Victor Knapp, Königstraße 35, 70173 Stuttgart, Germany, [email protected]
Server access
This website is hosted on Cloudflare Pages (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA; in Europe Cloudflare Germany GmbH). When the website is accessed, technically necessary access data is logged there (IP address, user agent, timestamp, requested resource). The website is delivered via Cloudflare's European network; a transfer to the USA cannot be ruled out. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and functioning operation); for the transfer to a third country, the EU Standard Contractual Clauses. Storage period: short-term, exclusively for troubleshooting and preventing misuse.
Project profile form
If you fill in the project profile form, your details are processed exclusively to answer your enquiry. Legal basis: Art. 6(1)(a) GDPR (consent) or (b) (steps prior to entering into a contract). Your phone number is optional; we use it on the same legal basis exclusively for the call-back you requested. The form is sent technically via the service provider FormSubmit (see “Enquiry forms”); beyond that, we do not pass your data on to third parties and store it only for as long as necessary for the process. You can withdraw your consent at any time, informally by email.
Call-back appointment (cal.com)
If you choose a call-back appointment on the project profile page, we send your name, your phone number and the time you selected to our calendar service Cal.com, Inc. (cal.com), which enters the appointment in our calendar and notifies us. The legal basis is Art. 6(1)(b) GDPR (arranging an appointment at your request) and your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time. Available times are retrieved without your data. Further information: cal.com/privacy.
Enquiry forms
You can send us an enquiry via the forms on this website. The details you enter are transmitted (name, phone number, optionally email address and district, device and your message). The form is sent technically via the service provider FormSubmit (operator based in the USA), which forwards the message to our email inbox; data may be transferred to the USA in the process. Legal basis: Art. 6(1)(a) GDPR (your consent, which you give in the form) or (b) GDPR (steps prior to entering into a contract); for the transfer to a third country, Art. 49(1)(a) GDPR. If you would like to avoid this, you can reach us just as well by phone or email. The details are used only to process your enquiry and are deleted as soon as they are no longer needed.
Contact by phone and WhatsApp
If you call us or send us a WhatsApp message, we process the resulting data (phone number, content of your message, time) exclusively to respond to your request and to arrange appointments. Legal basis: Art. 6(1)(b) GDPR. Please note: WhatsApp is operated by Meta Platforms Ireland Ltd.; using it generates connection and usage data there over which we have no influence. Phone and email are available to you as alternatives.
WhatsApp consent for the free check
If you request a free website and workflow check via acessio.de/whatsapp/ (page in German) , we process your name, company or practice, your WhatsApp number, optionally the website address, as well as the consent text, time, source and technical proof. The sole purpose is a one-off WhatsApp contact regarding this check. The legal basis is Art. 6(1)(a) GDPR. The details are stored in the Cloudflare hosting account and used internally only for this contact request. No contact request is created without successfully stored proof. You can withdraw your consent at any time by replying “Stop” in WhatsApp or by email to [email protected] . Your number is then blocked for further marketing contact; the proof of withdrawal is retained insofar as this is necessary to respect your objection.
Audience measurement
Some pages of this website include the statistics script of Plausible Analytics (loaded from plausible.io, configured for the domain acessio.de). When such a page is delivered, your browser loads the script from Plausible's server; for technical reasons, your device's IP address is also transmitted to Plausible, and visits to the page are recorded there. The script is included on many pages, including the enquiry forms. In addition to page views, we count confirmed form submissions and technical errors as events there, without transmitting form content to Plausible. The provider is Plausible Insights OÜ, based in Estonia (EU). Plausible does not set cookies, does not store anything on your device and does not create profiles; it counts page views, referring page, country, device type and browser. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in data-minimising audience measurement). Plausible itself does not use analytics or marketing cookies.
AI check
If you enter a website address and, optionally, your industry at acessio.de/ki-check/ (page in German) , we send these details to the OpenAI programming interface to create the analysis. Data may be transferred to the USA in the process. You do not enter any personal data for this; please do not include private data in the address. Legal basis: Art. 6(1)(b) GDPR (your request for the analysis). We keep the result for an address for up to 24 hours so that the same query does not cause costs again.
If you have the report sent to you, we store your email address, the address checked, industry, result, time and wording of your consent, as well as the country of your access, in the Cloudflare hosting account. Legal basis: Art. 6(1)(a) GDPR. You can withdraw your consent at any time by email to [email protected] ; we will then delete the details unless there is an obligation to retain them.
Storage in the browser
If you close the “Not quite sure yet?” notice, your browser remembers this for the current session in the so-called session storage. The entry is not transmitted to us and is deleted when you close the tab. It is required for the function you requested (Section 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG).
Fonts
All fonts on this website are delivered from our own server. Your browser does not connect to Google Fonts or any other font service for this purpose. Your IP address is not transmitted to any font provider.
Direct marketing by post (Art. 14 GDPR)
If we contact business contacts by letter for the first time to draw their attention to acessio's services and did not collect the contact details from the person concerned, the following information also applies.
Categories of data. We process the name and business function of a contact person, the company name, the business postal address, publicly visible information on industry, offering, location and website, the respective source with the date of retrieval, and the dispatch and objection status. We do not use special categories of personal data or private contact details for this purpose.
Sources. We obtain this information from publicly accessible service, contact or team pages of the company concerned, from map services and the business profiles published there, from industry and business directories, association or trade profiles and business delivery or booking platforms, as well as from editorial company portraits and publicly accessible company registers. We do not use legally required information from a legal notice (Impressum) as a source of personal data for direct marketing. On request, we will tell you the specific source and the date of retrieval of the information used about you.
Purpose, legal basis and legitimate interest. The purpose is a one-off postal approach, limited to the recognisable business context, regarding our own web design and digital services. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in acquiring business customers and in presenting our own offer to companies for which it may be relevant based on publicly recognisable characteristics. Before any use, we check whether this interest outweighs the interests, fundamental rights and freedoms of the person concerned in the specific case.
Recipients and processors. For printing, enveloping and dispatch, we transmit the letter and the recipient's address to A&O Fischer GmbH & Co. KG, Maybachstraße 9, 21423 Winsen (Luhe), Germany, which operates the LetterXpress service as a processor. Postal and transport service providers are used for delivery. No further disclosure for their own advertising purposes takes place.
Storage period and advertising block. If no business relationship or further communication results, we delete the contact and research data no later than twelve months after the last research or the one-off letter. We store data that is subject to statutory retention obligations or is required for the establishment, exercise or defence of legal claims only for the respective period. According to its current data processing agreement, LetterXpress stores the recipient and letter data transmitted for 60 days for processing and tracking the order and then deletes it. After an objection to advertising, we cease all advertising use and permanently store only the identification data and the blocking note required to reliably respect the objection.
No automated decision-making. No decision based solely on automated processing with legal or similarly significant effects within the meaning of Art. 22 GDPR takes place. We do not create detailed personal advertising profiles.
Your rights and the specific origin of the data. In addition to the right to object to advertising at any time, you have in particular the right to access, rectification, erasure, restriction of processing and to lodge a complaint with a data protection supervisory authority. You can obtain information about the data stored about you, including its specific origin, informally via [email protected] or at the postal address given above.
As of: 22 September 2026
Your rights
Under the GDPR, you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), objection (Art. 21) and data portability (Art. 20). You can lodge complaints with the competent supervisory authority (in Baden-Württemberg: the State Commissioner for Data Protection and Freedom of Information).
Contact for data protection enquiries
Client portal and acessio assistant
In the client portal at app.acessio.de, we use names and email addresses to assign access, and project status, files, invoices, feedback and messages for the commissioned collaboration. Passwords are stored exclusively as hashes. The app keeps this data in its own protected storage on the server operated by acessio.
The public assistant answers prepared questions about acessio. Name, contact method and message in the enquiry form are used to process the request you explicitly submitted. Automatic forwarding is not yet connected; the interface shows the direct contact route. Private portal views require an assigned client login. There is currently no marketing tracking and no automatic transmission of project content to an AI provider.
Sessions and security logs serve to protect access and to make changes traceable; IP addresses are stored in the app only as hashes. The app has configurable retention values for this security data, currently 30 days for old sessions/login attempts and 180 days for audit logs; manual clean-up is prepared, automatic clean-up is currently not activated. Project and invoice documents are handled separately within the scope of the collaboration and the applicable retention obligations.
Logged-in clients can export their own data as a JSON file and flag data for rectification or erasure. Flagging is not automatic erasure and is currently not yet forwarded automatically. Please also contact [email protected] or +49 1525 6201306to have it processed. The general information on responsibility and data subject rights on this page also applies here.