Privacy Policy

Structify Solutions UG (haftungsbeschränkt)
Version 2.0 · valid from 1 November 2026

The German version prevails.

This Privacy Policy applies to all Structify products and to our website. It consists of a Core Section, which applies to everyone, and of Modules for individual products and occasions:

In addition, the AI Transparency Statement describes how we use artificial intelligence.

Core Section

G1 Controller and contact

Structify Solutions UG (haftungsbeschränkt)
Gartenstraße 8, 92348 Berg, Germany
represented by its Managing Directors Tim Rosen and Felix König
Local Court (Amtsgericht) of Nuremberg, HRB 46012

Data protection enquiries: datenschutz@structify.solutions
General enquiries: info@structify.solutions · Support: support@structify.solutions

We have not appointed a data protection officer because there is no legal obligation to do so (Article 37 GDPR, Section 38 of the German Federal Data Protection Act (BDSG)).

G2 Two roles: who is responsible for your data?

This Privacy Policy provides full information about the second row. For the first row, it describes what happens technically. If, as a project participant, you have questions about content that a Customer processes via Structify, please contact that Customer; if your enquiry reaches us, we will forward it and support the Customer.

G3 Customers, contracts, invoices and payments

Data: company name, address, contact persons, VAT identification number, booked User Seats, modules and terms, invoice, payment and accounting data, confirmations of contract documents with time and version.

Purposes and legal bases: conclusion and performance of the contract (Article 6(1)(b) GDPR); compliance with legal obligations, in particular bookkeeping, retention and verification of the VAT identification number (Article 6(1)(c) GDPR in conjunction with Section 147 of the German Fiscal Code (AO), Section 257 of the German Commercial Code (HGB) and Section 14 of the German VAT Act (UStG)); proof that the contract documents were incorporated (Article 6(1)(f) GDPR).

Payment: Payments are processed by Stripe (Stripe Payments Europe, Ltd., Ireland) as an independent controller. You enter card details in a Stripe payment environment; we do not receive complete card details, only information on the payment status. Stripe's privacy notice additionally applies.

Recipients: For bookkeeping and accounting, we use the accounting software Lexware (Haufe-Lexware GmbH & Co. KG, Germany) as a processor. Our tax advisers, who are bound by professional secrecy, receive billing documents.

G4 Referral by sales partners

We work with sales partners who refer businesses to us and receive a commission for doing so; this does not change your price. The current list of our sales partners is available at structify.solutions/rechtliches.

Attribution: If you enter a sales partner's partner code when ordering (via a partner link or in the field „Partnercode“ ("partner code")), name a sales partner to us, or if a sales partner has previously referred your company to us as a prospective customer, we attribute your contract to that sales partner unless this is excluded under our contract with the sales partner (for example because your company is or was a customer within the last twelve months, was already in individual contact with us, or is attributed to another sales partner).

Data: partner code, company name, booking date, type and number of the booked User Seats, modules and packages with billing and commission periods, net fees received including subsequent corrections. If the sales partner referred your company, the information in the referral comes from the sales partner (Module M6). If the sales partner advised you, we process its proof that it disclosed its position as a sales partner and its commission to you in advance.

Recipients: The sales partner receives the billing information mentioned above, but no names or contact details of your Users and no content from the products. If an attribution is excluded, we only inform the sales partner of the reason and, on request, of the date and type of the relevant contract or contact. We forward objections and enquiries concerning the sales partner to it. The sales partner is an independent controller and is bound to confidentiality towards us.

Legal basis: Article 6(1)(f) GDPR; our legitimate interest is the correct attribution and traceable settlement of the commission and the defence against unjustified claims.

G5 Support and communication

Support: If you contact us by e-mail or via the application, we process your details to handle your request (Article 6(1)(b) GDPR, otherwise point (f)). Our e-mail mailboxes are operated by IONOS SE, Montabaur, Germany, as a processor.

Help voice assistant: In the help area of the application, you can voluntarily speak to our help assistant (support assistant) by voice. It is an AI system, not a human. We operate it for our own purpose of helping you with questions about using Structify; we are the controller for this processing, even if you use Structify for your company. During the conversation, your voice and the content of the conversation are transferred to Retell AI, Inc., USA (voice dialogue infrastructure), and to OpenAI, L.L.C., USA (contracting entity in the EEA: OpenAI Ireland Ltd.; voice dialogue), which act as our processors in this respect. The legal basis is Article 6(1)(b) GDPR, otherwise point (f). We base the transfer to the USA on the EU standard contractual clauses, Module Two (G7). If you do not use the assistant, no voice data is transferred to these providers.

System e-mails: We send invitations, login and security notices, notifications and invoices via Plus Five Five, Inc. ("Resend"), USA, as a processor (third country: see G7).

Appointment booking: If you book a meeting with us, we use the booking service Cal.com, Inc., USA. The appointment data (name, e-mail address, time, the information you provide about the occasion) is transferred to Cal.com in the process. The booking calendar is loaded only when you open it and give your consent (Article 6(1)(a) GDPR, Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG)); the processing of the appointment data is based on Article 6(1)(b) GDPR.

G6 Recipients

Within Structify, only the persons who need access for their tasks are given access. External recipients are:

Processors for our own processing operations (Article 28 GDPR): Supabase Pte. Ltd. (Singapore; database and hosting in Frankfurt am Main), Vercel Inc. (USA; delivery of the website and the web application), Hetzner Online GmbH (Germany; encrypted backup copies), IONOS SE (Germany; e-mail mailboxes), Plus Five Five, Inc. ("Resend", USA; system e-mails), Cal.com, Inc. (USA; appointment booking), Retell AI, Inc. and OpenAI, L.L.C. (USA; help voice assistant, G5), Haufe-Lexware GmbH & Co. KG (Germany; accounting), for approaching potential customers, partners and investors Apify Technologies s.r.o. (Czech Republic), Anthropic (USA) and Instantly (USA, including the sending mailboxes "Instantly AirMail") (M5).

Sub-processors for our Customers' content: the service providers listed in the Data Processing Agreement (Schedule 3). The list is publicly available at structify.solutions/rechtliches/avv and is kept up to date there.

Independent controllers: Stripe (payments), the OpenStreetMap Foundation (map sections, M1.6), sales partners (G4), our tax advisers, operators of app stores (distribution of the apps), authorities and courts, insofar as we are legally obliged to disclose data.

Other recipients receive your data only if you or the Customer arrange this, for example by inviting project participants or by sending documents from the application.

G7 Transfers to third countries

Hosting and storage in Germany (EU). For AI analyses (voice, text, images), we use US providers (OpenAI, Anthropic; for the voice assistant, Retell AI) on the basis of data processing agreements and EU standard contractual clauses.

In detail:

• Storage location: The database and the file storage are located in the data centre in Frankfurt am Main, the encrypted backup copies in the data centre in Falkenstein.
• Other service providers based outside the EU: In addition to the AI providers, we use service providers based in the USA for delivering the web application and the website (Vercel), sending e-mails (Resend), the help voice assistant (Retell AI, G5), appointment booking (Cal.com), computing power for 3D tours (RunPod, processing in an EU region) and sending e-mails in business development (Instantly, M5). The contracting party for our database service, Supabase Pte. Ltd., is based in Singapore; support or group access from Singapore or the USA cannot be ruled out.
• Basis: We base all these transfers on the EU standard contractual clauses (Article 46(2)(c) GDPR, Commission Implementing Decision (EU) 2021/914), namely:
  • on Module Two (transfer from a controller to a processor), insofar as we process data for our own purposes, for example when operating our website (M4), for embedded content (M1.6), for support, the help voice assistant and appointment booking (G5) and when approaching potential customers, partners and investors (M5);
  • on Module Three (transfer from a processor to a sub-processor), insofar as we process content on behalf of our Customers; these sub-processors are listed in Schedule 3 to the Data Processing Agreement.
• Transfer impact assessment: For each provider, we have assessed the consequences of the transfer and defined supplementary measures, such as encryption, data minimisation, limited retention periods and the exclusion of AI training.
• Data Privacy Framework: Where a provider is certified under the EU-U.S. Data Privacy Framework, we rely on this in addition; this currently applies to Vercel, Resend, Atlassian (Loom) and, insofar as we use Google services, Google. In all cases, the standard contractual clauses and our transfer impact assessment remain the basis. There is no adequacy decision for commercial transfers to Singapore.
• Copy: You can obtain a copy of the standard contractual clauses on request from datenschutz@structify.solutions; they are also published on the website of the European Commission.

A transfer to other third countries takes place only insofar as this Privacy Policy describes it or the law permits it.

G8 Retention period

We store personal data only for as long as is necessary for the purpose or required by law.

G9 Our own use of data

No AI training without consent. We do not use our Customers' content to train AI models unless the Customer's management has expressly switched this on for its organisation. This setting is off by default. As long as we do not offer it, no training takes place. Our AI providers are contractually prohibited from using content for training.

Anonymised usage statistics. We record which functions are used, when and how (usage events with timestamp and technical metrics such as loading times or error codes), but no content. We aggregate this information into anonymous statistics in order to improve the products, secure operations, plan capacity and substantiate our performance figures. We delete the raw data after aggregation, at the latest after 90 days. Insofar as raw data relates to our Customers' content, aggregation takes place on the Customer's instructions under the Data Processing Agreement; insofar as your usage data as a User is concerned, the legal basis is Article 6(1)(f) GDPR (our legitimate interest in improving the products and operating them securely). You can object to this in accordance with G10.

We do not use advertising trackers, analytics services for advertising purposes or advertising in our products.

G10 Your rights

You have the right to

• access (Article 15 GDPR),
• rectification (Article 16 GDPR),
• erasure (Article 17 GDPR),
• restriction of processing (Article 18 GDPR),
• data portability (Article 20 GDPR),
• withdraw consent with effect for the future (Article 7(3) GDPR).

In the application, you will find a data export and the option to request deletion of your account under Einstellungen → Datenschutz & DSGVO (Settings → Privacy & GDPR). Otherwise, an informal message to datenschutz@structify.solutions is sufficient.

Right to object (Article 21 GDPR). Where we process your data on the basis of legitimate interests (Article 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. You may object to processing for direct marketing purposes at any time without giving reasons; we will then no longer use your data for this purpose.

G11 Complaint to a supervisory authority

You may lodge a complaint with a data protection supervisory authority (Article 77 GDPR), in particular in the country in which you live or work. The authority responsible for us is:

Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.

Other authorities in our sales territory:

• Austria: Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna.
• Liechtenstein: Data Protection Authority of Liechtenstein (Datenschutzstelle Liechtenstein), Kirchstrasse 8, Postfach 684, 9490 Vaduz.
• Switzerland: Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern.

Information for persons in Switzerland. Insofar as the Swiss Federal Act on Data Protection (FADP) applies, the information in this Privacy Policy applies accordingly; your rights then arise from Article 25 et seq. FADP. Under Swiss law, Germany and the EU provide an adequate level of data protection. For transfers to the USA and to Singapore, we use the standard contractual clauses with the adaptations for Switzerland. We have not appointed a representative in Switzerland (Article 14 FADP): we process data of persons in Switzerland neither regularly on a large scale nor with a high risk for the persons concerned. We will review this again if our activities in Switzerland expand.

G12 Obligation to provide data, no automated decision-making

You are not legally obliged to provide us with data. Without account, company and billing details, however, we cannot conclude a contract or set up access.

There is no decision based solely on automated processing, including profiling, that produces legal effects or similarly significant effects (Article 22 GDPR). Our AI features generate suggestions; the decision is made by a human. The only exception is automatic notifications in Structify Operate: they are triggered according to fixed rules, for example when a recorded measured value exceeds a set threshold or a fault remains unprocessed for a defined period, and not by a decision of the AI; the AI only drafts explanations and message texts. These notifications concern the operation of the installations, not decisions about persons, and have no legal or similarly significant effect within the meaning of Article 22 GDPR (details in M3.1).

G13 Data security

We protect data in accordance with the state of the art, in particular through storage in Germany, encryption in transit and at rest, strict separation of Customer data at database level, mandatory two-factor authentication for user accounts (except test and demo accounts until the end of the test phase, a review account with fictitious data for app store review and the two logged accounts of the platform administration), logging of security-relevant events and a tiered backup procedure: the database is backed up every hour, backup states are kept for up to six months and deleted files for 90 days; restoration is made to such a backup state, not to any arbitrary point in time. In addition, our hosting provider backs up the database daily and keeps these backups for seven days. Our own backup copies are encrypted before being stored and are kept in a second data centre in Falkenstein; the keys remain with us. During a backup run, a server managed by us at the same provider processes the data unencrypted for a short time, exclusively in its main memory. We check the backups automatically every week and practise restoration every quarter. Erasures take effect in the backups as those backups expire, at the latest after six months. Details are set out in Schedule 2 to the Data Processing Agreement.

G14 Changes to this Privacy Policy

We amend this Privacy Policy when our products, service providers or the legal situation change. It is provided for information and does not require consent. Each version bears the common version number of the legal documents; you can find earlier versions at structify.solutions/rechtliches. We inform you of material changes in the application.

M1 Structify Web and Structify Desktop

M1.1 Account and login

Data: name, business e-mail address, organisation, role, password (only as a hash), information on the second factor, times and circumstances of login. If your company invites you, we initially receive your name and e-mail address from your company (Article 14 GDPR).

Purposes and legal bases: provision of access and functions (Article 6(1)(b) GDPR); if you are not yourself a contracting party but a User of a Customer, the legal basis is our legitimate interest in providing the Platform to the Customer and its Users (Article 6(1)(f) GDPR). Two-factor authentication serves the security of your account (Article 6(1)(b) and (f) GDPR).

Confirmation of legal documents: We store which version of the Terms of Use and, for persons authorised to represent the Customer, of the General Terms and Conditions you confirmed and when (Article 6(1)(f) GDPR: proof).

M1.3 Server and security logs

When you access the application, we process technical access data (IP address, time, resource accessed, technical error messages) for secure operation, error analysis and the prevention of misuse (Article 6(1)(f) GDPR). We store server logs with IP address for 30 days. We log security events, such as logins, failed login attempts, changes to the second factor and the pairing of devices, including IP address and browser or app identifier, for 12 months so that we can investigate security incidents.

M1.4 Cookies and storage in the browser

We use only technically necessary cookies and comparable storage in the browser (for example for the session and your settings). The legal basis is Section 25(2) No. 2 TDDDG and, for further processing, Article 6(1)(b) or (f) GDPR. We load third-party content that is not strictly necessary only after you have given your consent (M1.6).

Fonts: We deliver the application's fonts from our own servers; no data is transferred to font providers when they are loaded.

M1.5 AI features

The application contains AI features, such as the assistant "KAI", the transcription of voice recordings, the analysis of photos and documents, and suggestions for minutes, tickets and reports. If you use these features, the content required for them (texts, recordings, photos, documents, project information) is transferred to and processed by the following providers:

• Anthropic PBC, USA (contracting entity in the EEA: Anthropic Ireland, Limited): text understanding, image and document analysis, assistant "KAI";
• OpenAI, L.L.C., USA (contracting entity in the EEA: OpenAI Ireland Ltd.): transcription of voice recordings.

Where the content concerns a Customer's data, we process it as a processor and the providers act as sub-processors. We operate the help voice assistant under our own responsibility (G5). Transfer to the USA: see G7. The providers are contractually prohibited from using content for training. We delete analysis photos from the AI photo analysis after 90 days. AI results are labelled. More information can be found in the AI Transparency Statement.

Notice before the first transfer: Before any of your content is transferred to AI services for the first time, we show you a one-time notice, uniformly in Structify Web, Structify Desktop, Structify Mobile and Structify Operate. By ticking a checkbox, you confirm that you have read and taken note of the information on the transfer to AI services, and you click „Zustimmen“ ("Agree"). In doing so, you confirm that you have taken note. The legal basis for the transfer is your company's Data Processing Agreement, not consent under Article 6(1)(a) GDPR. We store your confirmation together with the time and the version (Article 6(1)(f) GDPR: proof). You can revoke it in the settings; the notice will then be shown again before the next transfer.

M1.6 Embedded content

• Tutorial videos (Loom): Some tutorial videos come from the Loom service (Loom, Inc., a company of the Atlassian group, USA). The video and the preview image are loaded only when you click „Abspielen“ ("Play"); nothing is retrieved from Loom before that. When you click, your IP address and technical data are transferred to Loom (Article 6(1)(a) GDPR, Section 25(1) TDDDG). We base the transfer to the USA on the EU standard contractual clauses, Module Two (G7); Atlassian is additionally certified under the Data Privacy Framework.
• Map section (OpenStreetMap): If a photo in a project's photo gallery contains location information, you can have the place where it was taken displayed on an OpenStreetMap map. The map is provided by the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom (registered in England and Wales under number 05912761). The map is loaded only when you click „Karte laden“ ("Load map") in the „Standort“ ("Location") tab; nothing is retrieved from OpenStreetMap before that. When you click, your browser retrieves the map section directly from the OpenStreetMap Foundation. In the process, your IP address, technical information about your browser and device (browser type, operating system, date and time of retrieval) and the coordinates of the displayed map section are transferred; the place where the photo was taken can be derived from these coordinates. The purpose is to display the place where the photo was taken at your request. The legal basis is our legitimate interest in offering you this map function (Article 6(1)(f) GDPR); since the map is loaded only when you click, you decide yourself whether this transfer takes place. To the best of our knowledge, the embedded map does not set any cookies and does not include any audience measurement. The OpenStreetMap Foundation processes the data under its own responsibility in accordance with its privacy policy (osmfoundation.org/wiki/Privacy_Policy); according to its own information, it stores the access data only temporarily and does not specify a fixed period for this. It delivers the map page and map tiles via a worldwide network of caches; which server responds depends on your location and on the time of the request. For the United Kingdom, there is an adequacy decision of the European Commission (Article 45 GDPR; Commission Implementing Decision (EU) 2021/1772, extended by Commission Implementing Decision (EU) 2025/2574 of 19 December 2025 until 27 December 2031); further safeguards are therefore not required.

M1.7 Other functions

• Walkable 3D tours: If you upload a walkthrough video for a 3D tour, it is processed on computers of RunPod, Inc. (USA) in an EU region; persons shown are automatically blurred beforehand.
• Electronic signature: For signing documents, such as acceptance records, we use Oneflow AB (Sweden).
• Connections to services of your choice: If your company connects the application to its own accounts with other services, such as calendars or code and storage repositories, we transfer data to the Customer's account on the Customer's instructions. The respective service is responsible for the processing there in accordance with its terms.
• Data export: Download links for exports are valid for 48 hours.

M1.8 Special features of Structify Desktop

Structify Desktop accesses the same Platform as Structify Web; M1.1 to M1.7 apply. On the device, the app stores session data (the login encrypted in the operating system's keychain), settings and, temporarily, incomplete entries such as drafts and technical information on uploads that have not yet been completed. The app itself does not create its own crash reports; we process technical error messages as described in M1.3. If you obtain the app via the Mac App Store, Apple processes data relating to the download and updates as an independent controller; we receive aggregated statistics from Apple and, if you have consented in your device settings to sharing analytics data with app developers, crash reports for the app.

M2 Structify Mobile

M1.1 to M1.5 apply accordingly to Structify Mobile. In addition:

M2.1 Permissions on your device

The app requests a permission only when you use the function. You can revoke permissions in the operating system at any time. The location is not determined in the background; without location permission, photos are stored without a location. We process the content as the Customer's processor (G2).

Photo metadata: Photos may contain metadata stored by the device, such as the time of capture, the device model or the place where the photo was taken. This metadata is currently transferred and stored together with the photo.

M2.2 Storage on the device

The app keeps data captured without a network connection on the device until it has been transferred and deletes it afterwards. Entries that have not yet been transferred are retained even after logging out and are transferred when the same person logs in again. Cached project information is deleted when you log out. Uninstalling the app removes all local data. We do not create backups of local data.

M2.3 Notice before using AI

Before the first voice recording, the first dictation and the first document upload, the app shows the notice on the transfer to the AI services (Anthropic, OpenAI) in accordance with M1.5: a checkbox for acknowledgement and „Zustimmen“ ("Agree"). By clicking „Zustimmen“ ("Agree"), you confirm that you have taken note. The legal basis is your company's Data Processing Agreement, not consent under Article 6(1)(a) GDPR. The confirmation is stored together with the account identifier, the time and the version. You can revoke it under Profil → Rechtliches & KI-Transparenz (Profile → Legal & AI Transparency); the app will then ask again before the next transfer. Recordings that are already waiting to be transferred at the time of revocation will still be transferred.

M2.4 Pairing via QR code

If you pair the app with a logged-in session of Structify Web, the app generates a random device identifier. We store only its hash, a platform designation (for example „Structify-App (iPhone/iPad)“) and the times of pairing and last use (Article 6(1)(b) and (f) GDPR). The QR code for pairing can be redeemed only once and is valid for 5 minutes. A pairing is valid for at most 30 days, for test and demo accounts at most until the end of the test phase; it is deleted when it expires, when it is revoked or when the password is changed.

M2.5 App stores

Apple distributes the iOS app via the App Store; we provide the Android app as an installation file on our website. If you obtain the app via the App Store, Apple processes data as an independent controller; we receive only aggregated statistics. The app contains no advertising and no advertising trackers.

M3 Structify Operate

M3.1 Digital operations log

Data: account and login data of the Users (name, e-mail address, role Admin, Standard User or Viewer); entries in the operations log with author and timestamp; maintenance tasks and deadlines; faults and tickets; input materials and deliveries with suppliers and their contact persons; components with installation and replacement history; meter readings; photos and records of proof; information on on-call staff and notification settings (name, e-mail address, telephone number, selected types of notification).

Roles: We process the content of the operations log as the operator's processor (G2); account, security and support data as controller in accordance with M1.1 and M1.3.

Viewers: Operators can invite External Parties as Viewers with read-only access. In this case, we receive the name and e-mail address from the operator (Article 14 GDPR).

AI features: Structify Operate contains AI features, such as the assistant "KAI", analyses of operating and measurement data, calculations, recommendations on maintenance, orders and consumption, reports, text recognition from photos of meters, delivery notes and invoices, and the transcription of voice notes and shift handovers. If you use these features, we transfer the content required for them to Anthropic PBC, USA (contracting entity in the EEA: Anthropic Ireland, Limited), and, for transcription, to OpenAI, L.L.C., USA (contracting entity in the EEA: OpenAI Ireland Ltd.). M1.5 applies accordingly, including the notice before the first transfer. Structify Operate does not issue control commands to installations; recommendations are implemented only after an authorised person has reviewed and approved them. Automatic notifications according to fixed rules are excluded from this, for example when set thresholds are exceeded or faults remain unprocessed: in these cases, Structify Operate creates tickets without prior approval, marks them as „eskaliert“ ("escalated") and notifies the persons entered for this purpose in the application and by e-mail; the AI only drafts explanations and message texts. These notifications concern the operation of the installations, not decisions about persons. There is no decision based solely on automated processing (Article 22 GDPR).

Storage location and delivery: Structify Operate runs on our Platform. The database and file storage are located in the data centre in Frankfurt am Main, the encrypted backup copies in Falkenstein (G7, G13). The application is delivered at operate.structify.solutions via Vercel; we deliver fonts from our own servers.

M3.2 Information page on Structify Operate

The information page on Structify Operate does not contain its own contact form. For a demo, it refers to structify.solutions/demo; M4.3 and M4.4 apply there. We deliver fonts from our own servers. M4.1 and M4.2 apply accordingly to visits to the information page.

M4 Website structify.solutions

This Module applies to our website structify.solutions, the information page on Structify Operate and the landing pages that refer to this Privacy Policy.

M4.1 Hosting and server logs

The website is operated by Vercel Inc., USA, and delivered via the Frankfurt am Main location. When the website is accessed, technically necessary data is processed: IP address, date and time, page accessed, access status, amount of data transferred, referrer and browser identifier. The legal basis is our legitimate interest in secure operation (Article 6(1)(f) GDPR). The logs are deleted after 14 days. We base the transfer to the USA on the EU standard contractual clauses, Module Two (G7); Vercel is additionally certified under the Data Privacy Framework.

M4.2 Cookies

On the website, we use only technically necessary cookies, for example to store your decision regarding embedded content (Section 25(2) No. 2 TDDDG). We do not use tracking cookies, analytics services or advertising pixels.

M4.3 Contact and demo requests

If you request a demo via the website or write to us, we process your details (name, e-mail address, company, your message and information about your interest) in order to answer your request, prepare and conduct a demo and manage your request in our CRM system. We store the data in our database in Frankfurt am Main (Supabase). Legal bases: Article 6(1)(b) GDPR (pre-contractual measures) and point (f) (management of enquiries). Retention period: see G8.

M4.4 Appointment booking

If you book an appointment for a demo or a meeting on the website, G5 (Cal.com) applies.

M4.6 AI voice assistant "Kai"

If we offer the AI voice assistant "Kai" on the website, you can voluntarily have a voice conversation with it. Kai is an AI system, not a human. The conversation begins only after you have given your express consent in the conversation window. During the conversation, your voice data is transmitted in real time to ElevenLabs (Eleven Labs Inc., USA) and processed there to conduct the conversation. The legal basis is your consent (Article 6(1)(a) GDPR); we base the transfer to the USA on the standard contractual clauses, Module Two (G7). You can end the conversation at any time; this ends the processing. If you do not use the assistant, no voice data is processed.

M4.7 AI images

Some images on the website have been generated with artificial intelligence. The AI Transparency Statement explains which ones.

M5 Approaching potential customers, partners and investors (information under Article 14 GDPR)

This Module applies when we approach you on our own initiative for business purposes without you having provided us with your data yourself: as a contact person of a company that plans, builds or operates installations and could be a customer or partner, or as a potential investor. If a sales partner refers your contact details to us, Module M6 applies in addition.

Data: name, form of address, position, company, business contact details (e-mail address, telephone number, business address, website), the address of your public professional profile (such as LinkedIn), the industry, size and region of your company, the assignment to a target group, the result of our assessment of whether it makes sense to approach you, and the history of our contact (messages, replies, objections, appointments, notes). We do not process private contact details.

Sources: publicly accessible sources, in particular company websites and legal notices, commercial registers, professional and industry directories and publicly visible profiles on the professional network LinkedIn; in addition, meetings at events, recommendations and our own contact with you.

Purpose and legal basis: We present our products or a possible collaboration or investment to you, document the contact and avoid approaching you more than once. The legal basis is our legitimate interest in initiating business relationships in business-to-business dealings (Article 6(1)(f) GDPR, Recital 47).

E-mails only with your consent: We send you promotional e-mails only if you have expressly consented in advance (Section 7(2) No. 2 of the German Act against Unfair Competition (UWG); in Austria, Section 174 of the Austrian Telecommunications Act 2021 (TKG 2021)). Without consent, we do not approach you by e-mail. We approach you via professional networks such as LinkedIn or by telephone only insofar as competition law permits. Every message contains information on how you can refuse further contact.

Service providers and recipients:

• Research: For the automated compilation of publicly accessible information, including from databases with business contact details, we use the research tool Apify (Apify Technologies s.r.o., Vodičkova 704/36, 110 00 Prague 1, Czech Republic) exclusively via Structify's own account, as a processor.
• AI-assisted pre-selection: To assess whether your company belongs to our target group and to summarise public information, we use AI models from Anthropic PBC, USA (contracting entity in the EEA: Anthropic Ireland, Limited), as a processor. The assessment is a suggestion; a human decides whether and how we approach you.
• Storage: We store the data in our prospecting system in our database in Frankfurt am Main (Supabase); only our management has access.
• E-mail campaigns: For e-mail campaigns, we have used the Instantly platform (Foo Monk, LLC dba Instantly.ai, 30 N. Gould St., Ste. R, Sheridan, WY 82801, USA) with its included sending mailboxes "Instantly AirMail", which Instantly operates on its own servers; no campaigns are currently running there. Insofar as contact details and the history of previous campaigns are still stored there, Instantly processes them as our processor. Our other mailboxes are operated by IONOS SE (G5).
• LinkedIn: Messages that we send you via LinkedIn are processed by LinkedIn Ireland Unlimited Company, Dublin, Ireland, as an independent controller in accordance with its own privacy policy.

Transfers to third countries: Anthropic and Instantly are based in the USA; in the case of Supabase, support or group access from Singapore or the USA cannot be ruled out. We base these transfers on the EU standard contractual clauses, Module Two (G7).

Retention period: as long as a business relationship or investment realistically remains a possibility, at the latest 24 months after our last contact; if a contract is concluded, the periods under G8 apply. If you object, we store only the information needed to observe your objection permanently (suppression list; Article 6(1)(c) in conjunction with Article 21(3) GDPR).

Time of this information: We refer you to this information at the latest when we first contact you.

Your objection: You may object to processing for direct marketing purposes at any time without giving reasons, for example with a short reply to our message or by e-mail to datenschutz@structify.solutions. Your other rights are set out in G10 and G11.

M6 Customer referrals by sales partners (information under Article 14 GDPR)

Our sales partners can refer to us businesses that are interested in Structify and, in doing so, transmit names and contact details of contact persons. For each sales partner that does so, there is a separate section, which the sales partner hands over to the person referred. The list of sales partners is available at structify.solutions/rechtliches.

M6.1 Privacy notice for customer referrals – Aqua Consulting GmbH

Information under Article 14 GDPR for contact persons whose contact details Aqua Consulting GmbH transmits to us as our sales partner
Structify Solutions UG (haftungsbeschränkt) · as of 1 November 2026

You are receiving this information because Aqua Consulting GmbH, Vienna, is transmitting to us your name and your business contact details as a contact person of a company that is interested in our software "Structify". Aqua Consulting GmbH is our sales partner; it is itself responsible for its own processing of your data and informs you about this separately.

1. Controller
Structify Solutions UG (haftungsbeschränkt), Gartenstraße 8, 92348 Berg b. Neumarkt i.d.OPf., Germany, represented by its Managing Directors Tim Rosen and Felix König. Please send data protection enquiries to datenschutz@structify.solutions. We have not appointed a data protection officer because there is no legal obligation to do so.

2. What data we process and where it comes from
We process the information transmitted to us by Aqua Consulting GmbH, Taborstraße 38/9, 1020 Vienna, Austria (Article 14(2)(f) GDPR): your name, your position, your business e-mail address and, where applicable, telephone number, the company name, address, country and industry or type of office of your company, the occasion and the need, the type of first contact, whether Aqua Consulting GmbH advises your company and has disclosed to you its position as our sales partner, the date on which this information was handed over to you, and the date, channel and type of your consent to being contacted by us.

3. Purposes and legal bases
a) Business development. We contact you, present our software to you and, where appropriate, submit an offer to your company. The legal basis is Article 6(1)(f) GDPR; our legitimate interest lies in initiating business relationships with companies. We approach you by e-mail or telephone only insofar as you have consented to this (Section 7 UWG, Section 174 of the Austrian TKG 2021).
b) Attribution and settlement with our sales partner. We attribute your company to Aqua Consulting GmbH, settle its commission and document the attribution. The legal basis is Article 6(1)(f) GDPR (legitimate interest in traceable settlement with our sales partners) and, for billing documents, Article 6(1)(c) GDPR in conjunction with the retention obligations under commercial and tax law.
If a contract is concluded with your company, our Privacy Policy at structify.solutions/rechtliches/datenschutz additionally applies to any further processing.

4. Recipients
Aqua Consulting GmbH: it receives from us the confirmation of the customer referral or the reason for an objection (for example an existing contact between your company and us, with date and type), the notification of whether a contract has been concluded, for settlement purposes the company name, booking date, type and number of licences booked and the net fee, and, insofar as they concern Aqua Consulting GmbH, the withdrawal of your consent, your objection to advertising or your request as a data subject. We do not transmit any further personal data about you.
Service providers (processors under Article 28 GDPR): Supabase for database and hosting (data location EU region Frankfurt; contracting party Supabase Pte. Ltd., Singapore), IONOS SE, Germany, for our e-mail mailboxes, and Hetzner Online GmbH, Gunzenhausen, for creating and storing encrypted backup copies in the Falkenstein data centre.
Other recipients: for billing documents, the provider of our accounting software and, where applicable, our tax advisers; authorities, insofar as we are legally obliged to disclose data.

5. Transfers to third countries
Your data is stored in the EU. However, access from Singapore or the USA by our database service, for example in support cases, cannot be ruled out. There is no adequacy decision of the EU Commission for Singapore; we do not base these transfers on the EU-U.S. Data Privacy Framework. We safeguard them by means of the EU standard contractual clauses (Article 46(2)(c) GDPR, Commission Implementing Decision (EU) 2021/914, Module Two), supplemented by a transfer impact assessment. You can obtain a copy on request from datenschutz@structify.solutions; the standard contractual clauses are also published on the website of the European Commission.

6. Retention period
If no contract is concluded, we delete your data from our sales systems as soon as it is no longer required for business development and attribution, at the latest 24 months after our last contact.
The customer referral itself is business correspondence with Aqua Consulting GmbH; we retain it as a commercial letter for six years (Section 257 HGB, Section 147 AO; Article 6(1)(c) GDPR) and use it during this period only as proof.
If your company is attributed to Aqua Consulting GmbH, we store the attribution information for as long as commissions accrue and thereafter until claims arising from the sales partnership become time-barred (Article 6(1)(f) GDPR: proof and defence of legal claims).
We retain billing documents in accordance with the statutory retention periods (currently eight years for accounting records).
If you object to being contacted, we store only the information needed to observe your objection permanently (Article 6(1)(c) in conjunction with Article 21(3) GDPR).
Deleted data may still be contained in encrypted backup copies for up to six months; it is no longer used there and is rotated out automatically.

7. Your rights
You have the right of access (Article 15 GDPR), rectification (Article 16 GDPR), erasure (Article 17 GDPR) and restriction of processing (Article 18 GDPR). You can withdraw your consent to being contacted at any time with effect for the future, either towards us or towards Aqua Consulting GmbH.
Right to object (Article 21 GDPR): You may object to the processing of your data for direct marketing purposes at any time without giving reasons; we will then no longer process your data for this purpose. You may also object to processing based on our legitimate interest on grounds relating to your particular situation. An informal e-mail to datenschutz@structify.solutions is sufficient.
You may lodge a complaint with a data protection supervisory authority (Article 77 GDPR), for example with the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, or with the supervisory authority of your place of residence or place of work, in Austria with the Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna.

8. Further information
There is no automated decision-making, including profiling (Article 22 GDPR). We amend this information when the processing or the legal situation changes; you receive the current version when we first contact you and on request from datenschutz@structify.solutions.