Legal information
Privacy policy
Last updated: August 2026. This English text is a translation for convenience; the German version is legally binding.
1. Controller
ECG GmbH, IT security & cloud operations
Authorised representative: Jürgen Leichtenberger (Managing Director)
Address, phone, email: see the legal notice.
2. Contact point for privacy requests
Please address privacy requests to info@ecg-gmbh.eu. Should a data protection officer be appointed, their name and contact details will be published here.
3. Processing on our behalf
Implementation and operation of the marketing web app are carried out by sensified.AI GmbH as processor within the meaning of Art. 28 GDPR. The service is hosted in Frankfurt am Main (AWS eu-central-1) and a data processing agreement is in place. Further processors and the applicable transfer safeguards are listed in section 5.
4. Purposes and legal bases
- Contact form — Art. 6 (1) (b) GDPR (pre-contractual measures) and Art. 6 (1) (f) GDPR (legitimate interest in answering enquiries). We process your name, email address and message. Delivery runs through Resend as processor; the enquiry arrives as an email in our mailbox. We delete the message at the latest 90 days after the enquiry has been dealt with, unless a contract results.
- Demo appointment requests — Art. 6 (1) (b) GDPR (pre-contractual measures).
- Internal lead qualification — Art. 6 (1) (f) GDPR (legitimate interest in direct customer contact; a documented balancing test takes account of the data subject is documented).
- Security and audit logging — Art. 6 (1) (f) GDPR (protection of integrity, availability and confidentiality; hash chain with anonymised content).
5. Recipients
- sensified.AI GmbH (processor, EU)
- Vercel Inc. (edge hosting via EU region fra1; DPA in place)
- Supabase EU (Postgres & storage, eu-central-1; DPA in place)
- Resend / Postmark for transactional email (EU routing active; standard contractual clauses under Art. 46 GDPR in place)
- Plausible Analytics (self-hosted in the EU, cookieless, no personal data to third countries)
6. Your rights
- Art. 15 — access
- Art. 16 — rectification
- Art. 17 — erasure
- Art. 18 — restriction of processing
- Art. 20 — data portability
- Art. 21 — objection to processing based on Art. 6 (1) (f)
- Art. 77 — complaint to a supervisory authority. Following the registered seat of ECG GmbH in Darmstadt, the competent authority is the Hessian Commissioner for Data Protection and Freedom of Information, Postfach 3163, 65021 Wiesbaden.
7. Retention periods
- Lead data without a contract: 90 days at most
- Lead data with a pilot or full contract: the contractually agreed term plus the statutory commercial and tax retention periods (§ 257 HGB, § 147 AO)
- Audit log: seven years (SHA-256 hash chain with anonymised subject content)
8. Cookies, tracking, analytics
We use Plausible Analytics in a self-hosted EU variant. Plausible sets no cookies, does not fingerprint devices and transfers no personal data to third countries (§ 25 TDDDG: no consent required). Optional Sentry for error tracing is only activated after explicit consent in the cookie banner (Art. 6 (1) (a) GDPR and § 25 (1) TDDDG).
9. AI-generated content (EU AI Act Art. 50)
The people shown on this website are not real employees or hotel guests but AI-generated visualisations. The models used, the watermarking methods (SynthID, C2PA) and the disclosure mechanisms can be viewed at /en/ai-disclosure.
10. Security
TLS 1.3 transport encryption, EU data residency, row-level security in the database, secrets held exclusively in Vercel encrypted environment variables or AWS KMS.
11. Contact for privacy requests
Email: info@ecg-gmbh.eu. Target response time: 14 days. Target for deletion or correction: 30 days.