Privacy notice

Controller

Scope and principles

This notice applies to our website, digital contact points, sales and support communications and, where no more specific notice applies, our software products and digital services.

We process personal data only for defined purposes and on a lawful basis, including consent, steps before or performance of a contract, legal obligations and legitimate interests. We do not make solely automated decisions that produce legal or similarly significant effects.

Website access, hosting and server logs

When you access the website, the technical infrastructure processes information including IP address, date and time, requested URL, referrer, browser, operating system, status and data volume. This is necessary to deliver the website, analyse errors and defend against attacks.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is secure and stable operation. Hosting and infrastructure partners act as processors under Article 28 GDPR where required. Logs are deleted when no longer needed for operations or security investigations; statutory evidence and specific security incidents may require longer retention.

Contact, landing pages and lead funnels

When you contact us through a form, landing page, email or phone, we process the information you provide. This may include your name, business contact details, company, role, phone number, message, requested appointment and use-case information. Campaign source, campaign and UTM parameters may also be associated with the enquiry.

The purpose is to handle and qualify your enquiry, arrange an appointment and, where requested, prepare a proposal. The legal basis is Article 6(1)(b) GDPR for pre-contractual steps and Article 6(1)(f) GDPR for structured B2B communication. Tracking data is linked only with your consent. External funnel, CRM, scheduling or email services are used only with an appropriate contractual and data-protection basis.

We generally delete enquiries that do not lead to a contract within twelve months unless a retention or evidence obligation or an ongoing matter requires otherwise.

Registrations for third-party events

Purposes and legal bases

On our website we promote events at which we participate as a partner and exhibitor without being the organiser. If you register through our form, we first process your details in our customer management system in order to handle your request, and then transmit them to the organiser so that they can manage your attendance.

The legal basis for the handling and for the transfer is Article 6(1)(b) GDPR, because both are necessary in response to your request and to enable your attendance. The organiser is independently responsible for the further processing of your data; their privacy notice applies to that.

Organiser

The organiser of the event “KI-Fabrik und digitale Souveränität” on 22 October 2026 in Munich, promoted on this website, is blu Professionals GmbH, Elsenheimerstr. 61, 80687 Munich. CodeXaureus GmbH is a partner and exhibitor at this event, not its organiser. The organiser's privacy notice applies to the running of the event: bluprofessionals.com/info/datenschutz.

Data processed

First and last name, business email address, company and position and, where you provide them, phone number, details of an accompanying person and your question. We also process the time and content of your registration and the record of the consents you have given. Where you have agreed in the privacy settings, we associate source and campaign information with your registration.

Mandatory and optional information

We need the fields marked as mandatory in the form in order to process your registration; without them a registration is not possible. All other information is optional and has no effect on your attendance.

Business development

We also process your details on the basis of Article 6(1)(f) GDPR in order to look after you as part of our business development and to offer you suitable services. Our legitimate interest lies in approaching potential business partners. You may object to this processing at any time under Article 21 GDPR. You will receive marketing emails only if you have given us your consent to do so.

Recipients

Within our company, only those people involved in handling enquiries and events have access to your data. We also use service providers for hosting, email delivery and customer management, who are contractually bound under Article 28 GDPR and may not use the data for their own purposes. The transfer to the organiser takes place as described above.

Retention

We delete your details no later than twelve months after the event, provided that no business relationship arises and no statutory retention obligations apply. Records of consents given are kept until the relevant limitation periods expire.

Withdrawal and objection

You may withdraw consents you have given at any time with effect for the future; the lawfulness of processing carried out up to the withdrawal remains unaffected. You may object at any time under Article 21 GDPR to processing based on Article 6(1)(f) GDPR. To do so, please contact contact@codexaureus.de.

Customer, partner and contract data

For proposals, projects, products, support and billing, we process business contact details, contract and project data, communication history and billing information. The legal bases are Articles 6(1)(b) and (c) GDPR and Article 6(1)(f) GDPR for efficient customer care and the establishment, exercise or defence of claims. Statutory commercial and tax retention periods remain unaffected.

Software products and processing for customers

Depending on the product and configuration, account, authentication, usage and system metadata may be processed. The specific processing is described in the contract, product-specific notices and, where we process data for a customer, a data processing agreement under Article 28 GDPR. Customer data is not used for our own advertising profiles or to train third-party models unless expressly and lawfully agreed otherwise.

Consent and privacy settings

Optional analytics and marketing technologies are loaded only after your explicit choice. Storage of or access to information on your device is based on section 25(1) TDDDG; subsequent processing of personal data is based on Article 6(1)(a) GDPR. Necessary storage is based on section 25(2) TDDDG and, where personal data is involved, Article 6(1)(f) GDPR.

Your choice is stored locally in the browser with a version and timestamp. You can change or withdraw it at any time with effect for the future.

Open privacy settings

Google Tag Manager

We use Google Tag Manager to manage analytics and marketing tags in a controlled manner. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The container is loaded on all pages, but under Google Consent Mode v2: analytics and advertising storage are denied by default before the container starts. Without your consent, no analytics or marketing cookies are set and no identifiers are stored. Cookieless signals without a user identifier may be transmitted to Google, from which Google models aggregate, non-personal reporting only. Once you consent, that consent is passed to the container and the corresponding services are activated. Tag Manager does not perform its own content analysis; the services activated through it determine the subsequent processing.

The legal basis is your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. Further information is available in Google's data processing terms.

Google Analytics 4

With your consent, we use Google Analytics 4 (GA4) provided by Google Ireland Limited. GA4 measures how pages and features are used and which campaigns generate visits. Data may include a random client ID in the first-party _ga cookie, page views and interactions, referrer and campaign information, approximate region, and browser and device data. Google states that the IP address is used at collection time to determine location and discarded before it is stored in Analytics.

The purposes are audience measurement, improvement of user journeys and campaign attribution. The legal basis is Article 6(1)(a) GDPR together with section 25(1) TDDDG. Event and user data in exploratory reports is limited to 14 months. Google Signals and personalised Google advertising features are not part of the standard configuration; consent and this notice would be updated before any later activation.

Further information: Google Analytics Datenschutz und Datensicherheit.

Meta Pixel

With your marketing consent, we use the Meta Pixel provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The pixel may record page views, interactions and defined conversion events such as a form submission. URL, referrer, time, browser and device data, IP address and cookie or event identifiers may be sent to Meta. Free-text content from contact enquiries is not transmitted as pixel event content.

The purposes are campaign measurement, attribution, optimisation and, where you permit it, the creation of audiences for advertising on Meta platforms. The legal basis is Article 6(1)(a) GDPR together with section 25(1) TDDDG. Advanced matching with our own contact data is not part of the standard configuration.

For the collection and transmission of certain event data, we and Meta act as joint controllers under the Meta Controller Addendum. Meta acts independently for subsequent processing. Details are available in the Meta Privacy Policy.

Business information and newsletters

We send promotional email to individuals only with consent or another lawful basis. For subscriptions we process email address, subscription time, consent evidence and technical delivery information. You can unsubscribe at any time using the unsubscribe link or by email. Individual B2B communication may rely on our legitimate interest in relevant business development; you may object at any time.

Recipients and processors

Internally, data is available only to people who need it for sales, projects, support, billing or website operations. External recipients may include hosting, IT, email, CRM, funnel, scheduling, analytics and marketing providers as well as legal, tax or audit advisers. They also include organisers of events for which you register through our website, insofar as the transfer is necessary to enable your attendance. Processors are contractually bound under Article 28 GDPR. Data is also disclosed where required by law or necessary to establish, exercise or defend claims.

Processing outside the EEA

Google, Meta and certain technical providers may process data in the United States or other countries outside the European Economic Area. We rely on an adequacy decision, valid certification under the EU-US Data Privacy Framework or appropriate safeguards such as EU Standard Contractual Clauses. Residual risks may arise in particular from statutory access rights of foreign authorities.

Retention

We keep data only for as long as it is needed for the relevant purpose. We then delete or anonymise it unless statutory retention obligations, consent records, security interests or limitation periods for potential claims require longer storage. Specific periods are stated in the relevant sections; statutory business records are retained in line with commercial and tax requirements.

Data security

We apply appropriate technical and organisational measures to protect data against loss, alteration, unauthorised disclosure or access. These include role-based access, encryption in transit, secure configuration, logging and regular review of the systems used. No transmission or storage system can guarantee absolute security.

Your rights

Subject to the statutory conditions, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18), data portability (Article 20) and objection (Article 21). You may withdraw consent at any time for the future. Contact contact@codexaureus.de. We may request proof of identity to handle the request securely.

Right to complain

You may lodge a complaint with a data protection supervisory authority. The authority generally responsible for our company is:

Changes to this notice

We update this notice when processing, providers or the legal position changes materially. The date above identifies the published version. For material changes to consent-based services, we will request a new choice.