Privacy policy

This is a convenience translation. The German version of this page is the legally binding one.

This page explains which data we process when you visit orbanta.ai, why we do so and which rights you have.

Controller

Petersen Digital Solutions, owner Carsten Petersen, Staberger Str. 17, 58511 Lüdenscheid, Germany. Phone: +49 2351 9233010. Email: info@petersen-digital-solutions.de

Principle

We process personal data only where this is necessary to operate this website and to answer your enquiry, or where you have given your consent. We do not pass data to third parties for advertising purposes.

Website delivery and server log files

When you open this website, your browser transmits technical data that the server records in log files: IP address, date and time of access, the address requested, the volume of data transferred, a message about whether the request succeeded, the referring page and details about your browser and operating system. This processing is technically necessary to deliver the page and to keep it running securely. The legal basis is our legitimate interest in stable and secure operation under Art. 6 (1) (f) GDPR. Log data is deleted as soon as it is no longer required for that purpose.

Getting in touch

When you send us the contact form, we process the information you provide there: your name, optionally your business, email address, optionally your phone number, the topic of your enquiry, the size of your business, the pilots you selected and your message. In addition, we store the full address of the form page including any additions in the link (for example campaign parameters) and a campaign identifier (parameter “pk”) if it is contained in that address. We use this information to handle your enquiry personally and reply to you; to do so, we create it as a contact in our own business software Orbanta (app.orbanta.ai). Website enquiries do not lead to automated prospecting. We only send you documents or news if you have expressly ticked this in the form.

The legal basis for handling your enquiry is Art. 6 (1) (b) GDPR (steps prior to entering into a contract) or Art. 6 (1) (f) GDPR (our legitimate interest in answering enquiries). For sending documents or news, the legal basis is your consent under Art. 6 (1) (a) GDPR; you can withdraw it at any time with effect for the future.

Recipients and notification: Orbanta runs on servers of IONOS SE (Montabaur, Germany) in a data centre in the EU; the database is provided by Supabase (Supabase Inc., database region EU, eu-west-1). Both act as our processors under Art. 28 GDPR. We notify the management about a new enquiry as a notice in Orbanta, as a web push notification via the push services of Apple or Google, and as a message via Telegram. The Telegram message states only that there is a new enquiry and the name of the business; it is delivered via the servers of Telegram FZ-LLC (Dubai, United Arab Emirates). There is no adequacy decision of the EU Commission for this country; the transfer is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) or, where these do not apply, on Art. 49(1) GDPR. Web push notifications are delivered on the same bases. The legal basis for the notification is our legitimate interest in handling your enquiry quickly under Art. 6(1)(f) GDPR.

We keep the details for as long as we need them to handle your enquiry and any follow-up questions, and beyond that only where statutory retention obligations require it.

Booking a demo

Through our demo flow (orbanta.ai/en/get-a-demo) you can book a personal Orbanta demo. In doing so, we process the information you enter in the individual steps: your name, the name and website of your business, industry, company size, your goals, the tools you use today, the pilots you are interested in, your description of where things are stuck, your email address if you choose email confirmation or provide it voluntarily, your phone number for a phone demo or if you provide it, the demo format you prefer (phone or video) and the time slot you chose or your preferred time. In addition, we store the language, the full address of the booking page including any additions in the link (for example campaign parameters), a campaign identifier (parameter “pk”) if it is contained in that address, and the time and version of your agreement as proof. So that you can pause the booking and continue later, your browser stores your selections and your description locally (not your name, email address, phone number or website); this saved progress is deleted as soon as you submit or discard the booking.

We use this information to arrange and confirm your appointment, tailor the demo to your business and follow up with you as a prospective customer afterwards. To do so, we create your request as a contact in our own business software Orbanta (app.orbanta.ai). For a fixed slot, we send confirmation using your chosen method. Email confirmations include a calendar file and a link to reschedule or cancel; reminders are also scheduled 24 hours and 2 hours beforehand. WhatsApp confirmations contain the appointment details and, where applicable, the meeting link. If you gave a preferred time instead of a fixed slot, we agree the appointment with you personally.

The legal basis is Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract). Where we store referral information and follow up with you as a prospective customer after the demo, we rely on our legitimate interest in handling and maintaining our customer enquiries under Art. 6(1)(f) GDPR. By ticking the box in the booking form you confirm that your information may be processed to prepare and hold the demo; we store the time and version as proof.

Recipients: Your booking is transmitted to Orbanta. Orbanta runs on servers of IONOS SE (Montabaur, Germany) in a data centre in the EU; the database is provided by Supabase (Supabase Inc., database region EU, eu-west-1). If you choose email confirmation, we send the confirmation and reminders from our mailbox info@petersen-digital-solutions.de at IONOS. IONOS and Supabase act as our processors under Art. 28 GDPR. If you choose a video demo, it takes place in our video room in Orbanta. If Orbanta cannot accept your booking at that moment, we temporarily store your information on our web server at IONOS. For temporary delivery failures, we retry the transmission. Only confirmed acceptance by Orbanta deletes this temporary entry; permanently rejected or unresolved older entries require internal review.

LiveKit: For the video demo we use the cloud service LiveKit Incorporated (USA). It processes audio and video and the connection data required to establish and conduct the video call. We do not give an assurance that processing takes place exclusively in the EU.

Internal notification: We notify our team about a new booking – as a notice in Orbanta, as a web push notification and as a message via Telegram. The Telegram message to the management states only that a new booking has been received and the name of the business. For a fixed slot, an additional appointment message is sent via Telegram to all team members with access to our appointment management; it contains only structured appointment details (business, appointment and demo format). Telegram messages are delivered via the servers of Telegram FZ-LLC (Dubai, United Arab Emirates). There is no adequacy decision of the EU Commission for this country; the transfer is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) or, where these do not apply, on Art. 49(1) GDPR. The web push notification contains your name, your business and the appointment; its delivery via the push services of Apple or Google takes place on the same bases. The legal basis for the notification is our legitimate interest in handling your booking quickly under Art. 6(1)(f) GDPR.

Storage period: We store your information for as long as we need it to prepare and hold the demo and to follow up on your enquiry afterwards. We then delete it unless statutory retention obligations apply. If you would like it deleted earlier, a short message to the address given in the section “Controller” is enough.

You can reschedule or cancel your appointment via the link in the email confirmation. If you chose WhatsApp or have no link, please contact us. You can object at any time to processing based on our legitimate interest. If you would like us to stop using your information, we will cancel the demo and delete your information unless a statutory obligation prevents this – an informal message to the address given in the section “Controller” is enough.

Appointment confirmation via WhatsApp

If you choose WhatsApp as your confirmation method when booking a demo, we send the appointment confirmation to the WhatsApp number you provide. No email address is required. We process this number and the time and version of your consent as evidence. The message contains only appointment details (date, time, demo format) and, where applicable, the meeting link, with no other booking details. A preferred-time request does not trigger an automatic WhatsApp message; we first agree the appointment with you.

The legal basis is your consent under Art. 6(1)(a) GDPR. Consent is voluntary: you can choose email as your confirmation method instead. We then use your email address for the confirmation and do not send a WhatsApp message.

You can withdraw your consent at any time with effect for the future – most easily by sending the WhatsApp message “STOP” to our number or a short email to the address given in the section “Controller”. After that you will receive no further WhatsApp messages from us; the lawfulness of processing carried out until then remains unaffected.

Recipients: Messages are sent from the WhatsApp Business account of Petersen Digital Solutions (+49 2351 9233010). To deliver the message, your phone number is transmitted to WhatsApp Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland), a company of the Meta group; the controller for users in the European Economic Area is Meta Platforms Ireland Limited. WhatsApp processes connection and usage data under its own responsibility; details can be found in WhatsApp’s privacy policy.

Third-country transfer: Delivery via WhatsApp may involve a transfer of data to Meta Platforms, Inc. in the USA. Meta is certified under the EU-U.S. Data Privacy Framework; the transfer is therefore based on the adequacy decision of the EU Commission (Art. 45 GDPR) and, in addition, on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Storage period: We store your WhatsApp number and the proof of your consent for as long as the other appointment data (see section “Booking a demo”). After a withdrawal we send no further WhatsApp messages; we keep the record of the withdrawal as far as we need it for our accountability obligations.

Consent and local storage

On your first visit we ask which processing you want to allow. We store your decision locally in your browser so that we do not have to ask again on every page. That storage is technically necessary to give your choice effect. You can change your decision at any time via the “Privacy settings” link in the footer.

Nova chat assistant

On orbanta.ai you can chat with “Nova”, our AI-powered assistant. She answers questions about Orbanta and our pilots and points you to the right ways to get in touch. Nova is a guidance and information aid; no contracts or offers are concluded through the chat.

AI notice: in the chat you are not talking to a human but to an AI system (automated text assistance). We point this out visibly in the chat window (Art. 50 of Regulation (EU) 2024/1689, the AI Act). If someone from our team takes over the conversation, you will see that in the chat window too.

Technical delivery: the chat window is loaded as an embedded element (iframe) from our own server at nova.orbanta.ai. Petersen Digital Solutions operates this server itself on rented infrastructure from IONOS SE (Montabaur, Germany) in a data centre in the EU. When it loads, your IP address is transmitted to this server for technical reasons – just as with any page request – so that the chat window can be delivered. No conversation content is transmitted at this stage, and as long as you do not start the chat, Nova stores neither cookies nor any other data in your browser. The legal basis is our legitimate interest in delivering the assistant function securely and reliably under Art. 6 (1) (f) GDPR.

Active use (consent): before your first message is processed, we ask for your permission. The chat window first shows you a notice with the purpose, the recipient (OpenAI, USA) and a link to this privacy policy; only after you confirm (“Start chat”) is any message transmitted at all. The legal basis for processing your chat input, transmitting it to the AI provider and storing the conversation history is your consent under Art. 6 (1) (a) GDPR. After you start, your browser remembers your consent and a random session identifier in sessionStorage so that your conversation can be kept together within the browser tab; both are deleted when the tab is closed. If you minimise the chat window, your browser remembers that setting in localStorage for seven days. Both kinds of storage are necessary so that the chat you requested works the way you set it up (Section 25 (2) no. 2 TDDDG).

Data processed: the messages you type, Nova’s replies, the conversation history so far (it is sent along to the AI service to answer your follow-up questions), the orbanta.ai page from which you started the chat (source page), the time of the messages and a handling status of the conversation. If you voluntarily provide contact details in the chat – such as your name, email address or phone number for a callback or a demo – we process those too in order to get back to you. Please do not enter sensitive data in the chat (for example health data); for personal matters, please use our contact channels instead.

Recipients: IONOS SE (Montabaur, Germany) provides the server infrastructure on which we operate Nova under our own responsibility (data centre in the EU, processing agreement under Art. 28 GDPR). OpenAI (OpenAI, L.L.C., USA, or OpenAI Ireland Ltd.) generates the AI replies; only the message texts needed to answer and the conversation so far are sent there. OpenAI acts as our processor, does not use input submitted via the API to train its models according to its own commitment, and may retain it for up to 30 days for abuse monitoring before it is deleted. Supabase (Supabase Inc., database region EU, eu-west-1) provides the database in which the conversations and the technical counters for abuse protection are stored. Telegram FZ-LLC (Dubai, United Arab Emirates) and the push services of Apple and Google deliver our internal notifications – only with a short preview of your message of at most 160 characters, never with the full conversation history.

Notification and live handover: so that we can reply to you promptly, we are notified about new chat messages – as an alert in our operations software, as a web push notification on our team’s devices and as a message via Telegram. Web push is delivered technically via the push services of Apple or Google, Telegram via the servers of Telegram FZ-LLC. Along with the note that there is a new conversation, only a short preview of your message of at most 160 characters is transmitted on these channels; the full history stays on our server and in the database mentioned above. Someone from our team can take over the conversation at any time and reply to you directly in the chat (live handover). The legal basis is our legitimate interest in handling your enquiry quickly and personally under Art. 6 (1) (f) GDPR, and Art. 6 (1) (b) GDPR where a contractual or pre-contractual service is concerned.

Retention: we store conversations (messages, replies, source page, timestamps, handling status and – if provided – your contact details) in the database mentioned above so that we can handle your enquiry, continue a conversation that has been taken over and answer follow-up questions in context. A conversation is automatically and completely deleted 90 days after the last activity; the deletion runs daily. To protect against abuse and overload, we also store a hash value of your IP address that cannot be traced back to you, used to limit the request rate (deleted after 24 hours), and aggregated, non-personal daily metrics on the use of the service (up to 12 months).

Transfers to third countries: the message texts needed to answer are sent to OpenAI in the USA. This transfer is based on the EU standard contractual clauses (Art. 46 (2) (c) GDPR) and supplementary safeguards; insofar as OpenAI is certified under the EU-U.S. Data Privacy Framework, it is additionally based on the adequacy decision of the EU Commission (Art. 45 GDPR). The short preview of your message (at most 160 characters) for our internal notification is transmitted to Telegram in the United Arab Emirates, for which no adequacy decision exists. This transfer is limited to the short preview and is based on the EU standard contractual clauses (Art. 46 (2) (c) GDPR) or, where these do not apply, on Art. 49 (1) GDPR. Delivery of web push notifications via Apple or Google takes place on the same bases. The chat window is delivered and the conversations are stored exclusively in the EU.

Your rights in the chat: you can withdraw your consent at any time with effect for the future by no longer using the chat or closing the chat window; this does not affect the lawfulness of processing carried out up to that point. You can request access to your chat data and early deletion of your conversation history: write to the email address given in the “Controller” section and tell us the approximate time of the conversation so that we can find it. In any case, the history is automatically deleted no later than 90 days after your last activity. Your other rights are listed under “Your rights”.

Audience measurement

Only if you allow “Statistics” in the consent window does this website load a small measurement script from our own server app.orbanta.ai. It shows us which pages are read and how visitors find us. Without your consent, no audience measurement takes place.

Data processed: the page you visit (without additions in the address), the domain of the website you came from, campaign details from the link (utm_source, utm_medium, utm_campaign), the width of your browser window, scroll depth, time on page, page load time, clicks on marked buttons and links on our site (which element, including several rapid clicks in a row), clicks on phone and email links, on links to other websites and on downloads (each with the target address), the submission of a form (only which form, not its content), whether the browser is being automated, and the time. Form entries are not recorded.

No cookies: The measurement script sets no cookies and stores nothing in your browser. So that we can group several page views of the same visit, our server creates a truncated check value (HMAC-SHA-256 hash) from your IP address, browser identifier (user agent), language setting and the website visited, using a secret key that changes daily. The IP address itself is not stored. A day's secret key is deleted about two days after that day ends; visits on different days therefore cannot be linked – only a visit that continues past midnight is still recognised as the same visit during the first 30 minutes of the new day. To protect against abuse and overload, we also use a hash of your IP address solely to limit the number of requests. We do not link the measurement data to your name, your contact details or your enquiries.

The legal basis for loading the script and for the measurement is your consent under Section 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act) and Art. 6(1)(a) GDPR. You can withdraw it at any time via “Privacy settings” in the footer; measurement then stops as soon as you reload the page or visit it again – switching between subpages is not enough.

Storage period and recipients: We store the measurement data in our database at Supabase (Supabase Inc., database region EU, eu-west-1), which acts as our processor under Art. 28 GDPR. Individual measurement events are deleted automatically after 90 days. Aggregated visit data is kept for up to 400 days; the check value is removed from it after 30 days. Advertising or analytics providers such as Google are not involved.

Who receives your data

Within Petersen Digital Solutions, only the people who handle your enquiry have access. To operate our services we use providers who act on our instructions as processors: IONOS SE (Montabaur, Germany) for servers and email, and Supabase (database region EU) for our database. Which further recipients are involved when you contact us, book a demo, use the chat assistant Nova and for audience measurement is stated in the respective section.

Your rights

You have the right to access the data we hold about you, to have inaccurate data corrected, to erasure, to restriction of processing, to data portability, and to object to processing that we base on a legitimate interest. Simply write to the email address given above.

Withdrawing your consent

You can withdraw consent you have given at any time with effect for the future. In the page currently open, we then stop new collection and transmission without reloading; information already sent is not removed retrospectively. This does not affect the lawfulness of processing carried out up to that point.

Complaints to a supervisory authority

If you believe that we process your data unlawfully, you can lodge a complaint with a data protection supervisory authority — in particular the authority where you usually reside, or the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, which is responsible for us.

Encrypted transmission

This website is transmitted exclusively over an encrypted connection. You can tell by the “https” in your browser address bar.

Changes to this policy

We update this policy when the website or the legal situation changes. The version published here is the one that applies.