Privacy Policy

At a glance

This privacy policy explains which personal data dcyphr.® GmbH ("we") processes when you visit our websites dcyphr.ai, dcyphr.io and aicon26.com, contact us, subscribe to our newsletter, attend one of our events (AICon, dcyphr.events) or work with us. It also applies, in addition, to the dcyphr.® and AICon presences on social networks.

Controller

Our contact person for data protection is our Managing Director Matthias Alexander Walenda. For privacy requests please contact hello@dcyphr.io. No data protection officer has been appointed, as the statutory conditions requiring one (Art. 37 GDPR, § 38 BDSG) are currently not met.

Principles and legal bases

We process personal data only where a legal basis permits it. The relevant laws are the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and – for access to terminal equipment such as cookies – the German Telecommunications Digital Services Data Protection Act (TDDDG). The legal bases in detail:

• Art. 6 (1) (a) GDPR – consent (e.g. newsletter, optional form fields). You may withdraw consent at any time with effect for the future.
• Art. 6 (1) (b) GDPR – contract or pre-contractual steps (e.g. ticket purchase, consulting engagement, exhibitor or sponsoring contract, enquiries).
• Art. 6 (1) (c) GDPR – legal obligation (e.g. commercial and tax retention duties).
• Art. 6 (1) (f) GDPR – legitimate interest (e.g. secure website operation, documentation of our events, direct marketing to existing customers, enforcing claims). You may object to processing on this basis at any time.
• § 25 TDDDG – storing or accessing information on your device (cookies, local storage). Without consent only where strictly necessary (§ 25 (2) TDDDG).
• § 26 BDSG – job applications and employment.

Website: hosting, server logs, fonts

Hosting

Our website dcyphr.ai is hosted by STRATO GmbH (Otto-Ostrowski-Straße 7, 10249 Berlin, Germany) in data centres in Germany. dcyphr.io is delivered via Webflow, Inc. (San Francisco, USA; certified under the EU-US Data Privacy Framework). Data processing agreements pursuant to Art. 28 GDPR are in place with both providers. The legal basis is our legitimate interest in the secure and efficient provision of our online offering (Art. 6 (1) (f) GDPR).

Server logs

Each time the site is accessed, the server automatically processes the following data transmitted by your browser: IP address (truncated), date and time, page or file requested, data volume, status code, referrer URL, browser type and version, operating system. This data is required to deliver the site, analyse errors and defend against attacks (Art. 6 (1) (f) GDPR). It is not combined with other data sources and is deleted after 14 days at the latest unless a security-related analysis is required.

Fonts

We use the IBM Plex Sans and IBM Plex Mono typefaces. The font files are hosted on our own server; no connection to Google servers is established when the page loads.

Analytics and marketing services

We load analytics and marketing services only with your consent; which services these are is explained in the section "Web analytics, tag manager and marketing pixels".

Cookies and consent

Without your consent this website sets no tracking or marketing cookies. Two strictly necessary storages exist nonetheless. When you switch the language (DE/EN/FR) we remember your choice solely in your browser's local storage; this value never leaves your device and is strictly necessary for the "remember language" function (§ 25 (2) no. 2 TDDDG). You can delete it at any time via your browser settings. The second is the consent banner’s cookie, which records your choice – including when you reject everything.

Consent banner (Cookiebot). To obtain, store and evidence your consent we use Cookiebot, a service of Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark. Cookiebot sets the CookieConsent cookie, which records your choice and the time it was made, and in doing so processes your IP address in truncated form together with details of your browser and device. This processing is strictly necessary in order to act on your decision at all and to evidence it as the law requires; it therefore also takes place without your consent (§ 25 (2) no. 2 TDDDG, Art. 6 (1) (c) GDPR). A data processing agreement pursuant to Art. 28 GDPR is in place.

Where links on our website take you to ticket shops or partner sites, the privacy notices and cookie settings of the respective provider apply there.

We use analytics and marketing services (see next section) only if you have consented via a consent banner. There you can change or withdraw your selection at any time; the banner can be reopened via the "Cookie settings" link in the footer of the respective website.

Web analytics, tag manager and marketing pixels

To measure reach and the success of our campaigns we use the following services on this website – only with your consent given via the consent banner (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). You can consent to the “Statistics” and “Marketing” categories separately. You can withdraw your consent at any time with effect for the future; the withdrawal is reachable via the “Cookie settings” link in the footer of this website.

The loading of every service below is controlled by Google Tag Manager (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland). The tag manager itself sets no cookies and loads only the services you have consented to (Google Consent Mode v2).

With your consent to the “Statistics” category

• Google Analytics 4 (Google Ireland Ltd.): measurement of page views, time on site, traffic source and device based on truncated IP addresses; usage data is deleted after 14 months. Data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework.
• Hotjar (Hotjar Ltd., Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville, St Julian’s STJ 3141, Malta; part of the Contentsquare group): recording of session journeys – mouse movement, clicks and scrolling – and creation of aggregated heatmaps, so we can see which content is found and which is not. What you type into form fields is suppressed by Hotjar by default and replaced with asterisks; we have additionally locked that suppression across all fields, so it cannot be lifted for individual fields either. According to Hotjar, IP addresses are not stored in clear text.

With your consent to the “Marketing” category

• LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland): conversion measurement and retargeting for LinkedIn campaigns; LinkedIn Corporation (USA) is certified under the EU-US Data Privacy Framework.
• TikTok Pixel (TikTok Technology Ltd., Dublin, Ireland): conversion measurement for ads on TikTok; transfers to third countries are based on EU standard contractual clauses. We have switched off the automatic reading of contact details from forms (“Advanced Matching”).
• X Pixel (Twitter International Unlimited Company, Dublin, Ireland): conversion measurement for ads on X; transfers to the USA are based on EU standard contractual clauses.

What happens without your consent. Hotjar, the LinkedIn Insight Tag and the TikTok and X pixels are not loaded at all; there is then no connection whatsoever to those providers. Google Tag Manager, by contrast, does load, and sends Google a cookieless signal stating that no consent is present (Google Consent Mode v2). This transmits your IP address, the time and address of the page view, and details of your browser and operating system to Google. According to Google the IP address is evaluated only for coarse location and is not stored; no identifier that would make you recognisable across several page views is stored or transmitted. The legal basis for this transmission is our legitimate interest in being able to control the analytics services on a consent basis at all (Art. 6 (1) (f) GDPR). You can prevent this transmission too, by disabling JavaScript or using a content blocker.

The providers may link the data collected with your respective user account and use it for their own purposes; details can be found in the privacy notices of Google, Hotjar, LinkedIn, TikTok and X. In addition to withdrawing consent via the banner, you can disable personalised advertising in the settings of your respective account.

Contact by e-mail, phone or appointment booking

If you contact us by e-mail, phone or via an appointment link, we process the data you provide (name, contact details, content of the enquiry, company) to handle your request and follow-up questions. The legal basis is Art. 6 (1) (b) GDPR where the enquiry aims at a contract, otherwise Art. 6 (1) (f) GDPR (our interest in answering enquiries). For online appointment booking (“Book an intro call”) we use Microsoft Bookings; when you open the booking link you leave our website and Microsoft processes the data you enter (name, e-mail, preferred time, topic) on our behalf. We use Microsoft 365 (Microsoft Ireland Operations Ltd., Dublin) for e-mail, calendar and appointment booking; data is processed in EU data centres under a data processing agreement including EU standard contractual clauses. Enquiries are deleted once resolved and no retention duties apply, at the latest after three years.

Forms on the website

On our website you can write to us using forms – for example to register for courses of the dcyphr.® Academy, to apply as a trainer or as a dcyphr.® Expert, for training requests, “Request info”, job applications and feedback on the book “KI verstehen”. The data is sent encrypted (HTTPS) to a script on our web server, which forwards it as an e-mail to our mailbox; we do not store it in a database. We only process what you enter and use it solely to handle your request. The legal basis is Art. 6 (1) (b) GDPR where your request aims at a contract (e.g. course registration, training request), § 26 BDSG for job applications, and otherwise your consent, which you give with the checkbox in the form (Art. 6 (1) (a) GDPR) and can withdraw at any time with effect for the future.

To prevent abuse, the script checks that the form comes from our website and counts submissions per IP address; for this the IP address is stored only as a checksum (hash), not in plain text, and is irrelevant after one hour (Art. 6 (1) (f) GDPR, interest in fending off automated mass submissions). If you tick the box to remember your name, e-mail and phone number on your device, your name, e-mail and phone number are kept only in your browser (localStorage) to prefill the next form; they are not transmitted to us, and you can delete them in your browser at any time.

The skill challenges on our job pages and the matchmaker on the job overview send their result to us even without an application so that we can improve the questions – without a name or identifier, with the IP address truncated (IPv4 to /24, IPv6 to /48). We keep these anonymous results for 365 days. If you apply, your result is sent with your application and treated like it.

Test readers “KI verstehen”

At dcyphr.ai/ki-verstehen/ you can read the draft of the book “KI verstehen – 100 Dinge, die du jetzt über KI wissen musst” and send us feedback. Name, postal address and e-mail address are optional. We use your feedback solely to revise the book. We use your postal address solely to send you a copy of the printed book as a thank-you; for shipping we pass name and address to the commissioned carrier (e.g. Deutsche Post/DHL). The legal basis is your consent (Art. 6 (1) (a) GDPR). We delete name, address and e-mail address once the book has been sent, and the feedback itself once the revision is complete, at the latest after two years. We only use your e-mail address for news about volume 2 if you explicitly tell us so. If you send us the annotated draft by e-mail instead, the section “Getting in touch” applies. Your progress in the exercises and your answers before sending are stored only in your browser (localStorage) and are not transmitted to us. The pages under /ki-verstehen/ set no cookies and use no analytics or marketing services.

Newsletter

For our newsletter (e.g. "Frontline" – applied AI, AICon event news) we need your e-mail address; further details are optional. Subscription uses double opt-in: you receive a confirmation e-mail with which you actively confirm your subscription. We log subscription, confirmation and IP address to be able to prove consent. The legal basis is your consent (Art. 6 (1) (a) GDPR, § 7 (2) no. 3 UWG). You can unsubscribe at any time via the link at the end of every issue or by e-mail to hello@dcyphr.io.

We use Brevo (Sendinblue SAS, 7 rue de Madrid, 75008 Paris, France) for dispatch. Brevo processes the data on our behalf within the EU. We measure whether newsletters are opened and which links are clicked in order to improve content; you can object to this measurement by unsubscribing.

We occasionally send existing customers information on similar services of our own on the basis of § 7 (3) UWG (Art. 6 (1) (f) GDPR); you may object at any time free of charge.

Events: AICon and dcyphr.events

Ticket purchase and registration

For ticket sales and attendee registration we use the ticketing provider vivenu (vivenu GmbH, Völklinger Straße 33, 40221 Düsseldorf, Germany), which processes the data on our behalf in data centres within the EU (data processing agreement pursuant to Art. 28 GDPR). We collect name, e-mail address, company and position where applicable, ticket category, payment information (the payment itself is handled by the payment provider; we do not receive full card details) and invoicing data. The legal bases are performance of the contract (Art. 6 (1) (b) GDPR) and compliance with tax law (Art. 6 (1) (c) GDPR).

Attendee directory, badges and networking

Your badge shows your name and company. For networking formats (e.g. speed dating, matchmaking app) we process your details only if you sign up for them (Art. 6 (1) (a) or (b) GDPR). We do not pass attendee lists to third parties; sponsors and exhibitors receive contact details only if you expressly agree at their stand (e.g. via badge scan).

Speakers, exhibitors, sponsors, partners

From speakers and from contact persons at exhibitors, sponsors and partners we process name, role, company, contact details, short biography, photo and talk content in order to create, publish and promote the programme (Art. 6 (1) (b) GDPR). Programme publication on the web, in apps and in print is part of the agreed service.

Security and admission

Tickets are scanned for access control. In the event of security incidents we may pass data to the venue, the security service or the authorities (Art. 6 (1) (c) and (f) GDPR).

Photo and video recordings at events

Photo, video and audio recordings are made at AICon events and dcyphr.events (stage programme, exhibition, networking, atmosphere). We use them for documentation and reporting, for our media library, to promote future events and on social media and in press releases. The legal basis is our legitimate interest in public relations (Art. 6 (1) (f) GDPR) in conjunction with §§ 22, 23 of the German Art Copyright Act (KUG); we point out recordings at the entrance, on tickets and on signage.

Your objection: if you do not wish to be recognisably depicted, please say so at the entrance (you will receive a marker) or approach the photo team. You can object to a publication at any time afterwards at hello@dcyphr.io; we will remove the recording concerned as far as technically and legally possible. Talks are recorded and published only with the speakers' consent.

Clients, partners and suppliers

In the context of consulting, development, sponsoring and exhibitor contracts we process contract, contact and billing data as well as project-related content (Art. 6 (1) (b) and (c) GDPR). To manage contacts and projects we use the CRM and project management system monday.com (monday.com Ltd., Tel Aviv, Israel – the European Commission has recognised Israel as providing an adequate level of protection; data can be stored in EU data centres on request) as well as Microsoft 365. Data is stored for the duration of the business relationship and thereafter in accordance with statutory retention periods.

Job applications

We process application documents to decide on establishing an employment relationship (§ 26 BDSG, Art. 6 (1) (b) GDPR). After the process is completed we delete the documents after six months at the latest, unless you have consented to inclusion in our talent pool (then up to two years) or we are entitled to retain them longer.

Social media and video platforms

We maintain presences on LinkedIn (LinkedIn Ireland Unlimited Company, Dublin), YouTube and Instagram (Google Ireland Ltd. and Meta Platforms Ireland Ltd., Dublin), X (Twitter International Unlimited Company, Dublin) and TikTok (TikTok Technology Ltd., Dublin). When you use these services, the respective provider processes your data under its own responsibility; for page statistics ("insights") we are joint controllers with the provider (Art. 26 GDPR). No social media plugins are embedded on this website; videos are only linked. When you click a link to YouTube or LinkedIn, the privacy policy of the respective provider applies.

Use of AI tools

As an AI-first company we use AI-supported tools to assist with writing, translation, research, analysis and organisation. We enter personal data into such systems only to the extent required for the respective purpose and only with providers with whom a data processing agreement is in place and which do not use inputs to train their models. We make no automated decisions with legal effect within the meaning of Art. 22 GDPR. Where AI systems interact with you (e.g. voice or chat assistants), we make this transparent in accordance with Art. 50 of the EU AI Act (Regulation (EU) 2024/1689).

Specifically, we work with Claude (Anthropic PBC, San Francisco, USA; EU contracting entity: Anthropic Ireland, Limited, Dublin) and ChatGPT (OpenAI Ireland Ltd., Dublin, on behalf of OpenAI, L.L.C., San Francisco, USA). We use business or team plans under which the providers are contractually barred from using inputs to train their models and data processing agreements pursuant to Art. 28 GDPR are in place. Transfers to the USA are based on the EU-US Data Privacy Framework or EU standard contractual clauses. We enter personal data only to the extent required for the purpose and pseudonymise it wherever possible.

Transfers to third countries

Where we use service providers outside the EU/EEA, we ensure an adequate level of data protection: through an adequacy decision of the European Commission (e.g. the EU-US Data Privacy Framework for certified US providers, the adequacy decision for Israel), through EU standard contractual clauses (Art. 46 (2) (c) GDPR) with supplementary measures or – in individual cases – through your explicit consent (Art. 49 (1) (a) GDPR). A copy of the respective safeguards is available on request.

Retention periods

Your rights

With regard to personal data concerning you, you have the following rights against us:

• access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20);
• objection (Art. 21 GDPR) to processing based on legitimate interests – to direct marketing at any time without giving reasons;
• withdrawal of consent with effect for the future (Art. 7 (3) GDPR);
• complaint to a supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany, baden-wuerttemberg.datenschutz.de.

An e-mail to hello@dcyphr.io is sufficient to exercise your rights.

Data security

Our website is delivered over TLS encryption (HTTPS). We apply technical and organisational measures pursuant to Art. 32 GDPR to protect your data against loss, misuse and unauthorised access, and keep them in line with the state of the art.

Changes to this privacy policy

We review this policy at least once a year and update it when our processing or the legal situation changes. The version published on this page applies.

Last updated: September 2026 · In case of doubt the German version prevails.