Privacy Policy

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

RhymeQ Technologies GmbH

Donaustraße 9

76199 Karlsruhe
Germany

Represented by the Managing Director Dr. Daniel Volz

Email: info@rhymeq.com

We are not legally required to appoint a data protection officer and have not done so. For any privacy questions, please contact us at the email address above.

Legal bases. We only process personal data where a legal basis exists, in particular Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (contract or pre-contractual measures), Art. 6(1)(c) GDPR (legal obligation) and Art. 6(1)(f) GDPR (legitimate interests). Where information is stored on or accessed from your device, this is based on Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) (consent) or, where strictly necessary, Section 25(2) TDDDG.

Retention. We store personal data only as long as necessary for the respective purpose or as required by statutory retention periods (in particular under the German Commercial Code and Fiscal Code, six or ten years). The data is then deleted.

Recipients. We use carefully selected service providers as processors (Art. 28 GDPR) and have data processing agreements in place with them.

Transfers to third countries. Some of the providers named below are based in the USA or process data there. The USA is considered a safe third country for companies certified under the EU-U.S. Data Privacy Framework (DPF) (European Commission adequacy decision of 10 July 2023). Where no certification exists, transfers are based on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

You have the right at any time to:
- access your stored data (Art. 15 GDPR)
- rectification of inaccurate data (Art. 16 GDPR)
- erasure (Art. 17 GDPR)
- restriction of processing (Art. 18 GDPR)
- data portability (Art. 20 GDPR)
- withdraw any consent given, with effect for the future (Art. 7(3) GDPR)
- lodge a complaint with a data protection supervisory authority (Art. 77 GDPR)

Right to object (Art. 21 GDPR). Where we process data based on Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. You may object to processing for direct marketing purposes at any time without giving reasons.

Our competent supervisory authority is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

Our website is hosted using Webflow, provided by Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA. Webflow and its infrastructure providers process the technical information needed to deliver the website and its content, maintain availability and protect the service against misuse. This includes the information described in section 5.

The legal basis is our legitimate interest in operating a secure and reliable website under Art. 6(1)(f) GDPR. Webflow processes personal data on our behalf under its Data Processing Addendum.

Processing may take place in the United States and other countries. Webflow states that it participates in the EU–U.S. Data Privacy Framework. Where applicable, transfers are covered by the corresponding adequacy decision; Webflow's Data Processing Addendum also provides contractual transfer safeguards, including EU Standard Contractual Clauses where required.

Further information: Webflow's EU and Swiss Privacy Policy and Data Processing Addendum

When you access our website, your browser transmits technical information to Webflow and the infrastructure used to deliver the website. This includes your IP address, the date and time of access, the requested page or resource, browser and operating-system information, HTTP request information and, where transmitted, the referring page.

This information is processed to deliver website content, maintain service availability, diagnose technical problems and detect or investigate security incidents. The legal basis is Art. 6(1)(f) GDPR, reflecting our legitimate interest in the secure and reliable operation of the website.

Technical records are retained for the period necessary for these operational and security purposes and any applicable legal obligations. Storage and deletion within the hosting infrastructure follow Webflow's applicable retention arrangements. This technical processing is separate from the consent-based website analytics described in section 7.

For security reasons, this website uses SSL/TLS encryption. You can recognise an encrypted connection by "https://" in the address bar and the lock icon in your browser.

Our website uses cookies and similar technologies, including browser local storage. Some are necessary to provide website functions or remember your privacy choices. Others support website analytics or the delivery of external content.

Where storing information on, or accessing information from, your device is strictly necessary to provide a service you expressly request, the legal basis is Section 25(2) TDDDG. Other device storage or access takes place with your consent under Section 25(1) TDDDG. Where personal data is processed on the basis of that consent, Art. 6(1)(a) GDPR also applies.

You can accept, reject or change the available consent categories through our consent banner. You can reopen it at any time using the Cookie Settings button on the website. Withdrawing consent takes effect for the future and does not affect the lawfulness of earlier processing. You can also delete cookies and local storage through your browser settings.

We use the KookiOk consent-management service to obtain, remember and document your privacy choices. KookiOk acts as our processor for visitor consent data. The provider can be contacted at contact@kookiok.com.

Consent records include a pseudonymous consent identifier, your choices, the time of the decision, browser information, an anonymised IP address, any Global Privacy Control signal and derived country and language information. Your choice is also remembered in a first-party cookie.

Processing necessary to administer and demonstrate consent is based on Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR. The necessary device storage is based on Section 25(2) TDDDG.

KookiOk states that its consent platform is hosted in the European Union and that consent records are retained for five years under its standard retention schedule. This is the provider's retention period, rather than a universal statutory requirement to retain every consent record for five years.

With your consent, we use Webflow Analyze, provided by Webflow, Inc., to understand how visitors use our website and improve its content and usability. Analyze records usage information such as pages visited, sessions, time spent on pages, clicks and other engagement events, referring sources, device information and approximate geographical information.

Webflow Analyze uses browser local storage and visitor identifiers rather than cookies to recognise visits. We receive website-usage reports and aggregated statistics. Analyze tracking is enabled only after you give consent through our consent-management system.

The legal bases are Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your analytics consent through Cookie Settings at any time. Information about Webflow and international transfers is provided in section 4.

Webflow's published documentation specifies retention of up to 180 days for behavioural audience data. This should not be confused with the lifetime of information stored in your browser or the retention of separate hosting records.

If you contact us by email, we process your details (email address, name, content of your message) to handle your request. The legal basis is Art. 6(1)(b) GDPR where your request relates to a contract or pre-contractual measures, and otherwise our legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR). For email communication we use Microsoft 365, provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Microsoft is certified under the EU-U.S. Data Privacy Framework. We delete your data once your request has been fully handled and no retention obligations apply.

You can use the form embedded on our website to request early access to RHYME or express interest in our products and developer community. The form is provided through HubSpot, which we also use to manage the resulting contact records, as described in section 10.

We process the first name, last name, email address, company or institution and role you provide, together with the submission time and records of your consent. HubSpot also processes technical connection and browser information needed to provide and secure the form.

We use this information to manage early-access requests and the waitlist, respond to enquiries and send the communications covered by your consent. If you select Enterprise, your request is routed internally to our sales team so that an appropriate team member can follow up. Other role selections are recorded in our contact-management system. This routing does not itself create a contract or determine your eligibility for access.

Waitlist registration and the email communications covered by your consent are processed on the basis of Art. 6(1)(a) GDPR. Where your enquiry concerns steps requested by you before entering into a contract with you, Art. 6(1)(b) GDPR applies to that handling. For enquiries made on behalf of an organisation, we rely where applicable on Art. 6(1)(f) GDPR, reflecting our legitimate interest in responding to business enquiries.

The fields marked as required must be completed for an online request to be submitted. Your consent choices are recorded separately from your cookie preferences. You can withdraw consent at any time, for example by using an unsubscribe link in our emails or contacting info@rhymeq.com. Withdrawal does not affect processing carried out lawfully before withdrawal.

We retain request and waitlist information for as long as needed to manage the waitlist and handle your request. Following withdrawal, we stop the processing covered by that consent. Limited information may be retained where necessary to document consent or withdrawal, comply with legal obligations or establish, exercise or defend legal claims. Information needed for a subsequent customer relationship is retained for that separate purpose on its applicable legal basis.

We use HubSpot for contact management (CRM) and email communication. The provider is HubSpot Ireland Limited, 1 Sir John Rogerson's Quay, Dublin 2, Ireland. The parent company HubSpot, Inc. is based in the USA and certified under the EU-U.S. Data Privacy Framework.

Processing of contact data is based on the legal bases named in sections 8 and 9. We have a data processing agreement with HubSpot. More information: https://legal.hubspot.com/privacy-policy

Our website contains links to external social-media profiles. These links are distinct from embedded content: opening an external link takes you to the provider's website, where its own privacy information applies.

We embed videos from YouTube. For users in the European Economic Area, Google's services are provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The YouTube player is blocked until you give the relevant consent through our consent-management system. Once enabled, a connection is established to Google/YouTube. The provider can receive your IP address, browser and device information, the page from which the player is loaded, and information about video playback and interactions. Depending on the player and your settings, cookies or similar technologies may be used. If you are signed in to a Google account, Google may associate activity with that account.

The legal bases for enabling the player and the associated consent-based processing are Art. 6(1)(a) GDPR and, where information is stored on or accessed from your device, Section 25(1) TDDDG. You can withdraw the relevant consent through Cookie Settings, after which the player will no longer be available unless you consent again.

Google may process information outside the European Economic Area, including in the United States. Google's further processing, retention and applicable international-transfer safeguards are described in its Privacy Policy.

We update this privacy policy when our website or the legal situation changes. The version published here applies.