DE Free live demo

Privacy Policy for Customers and Prospective Customers

Download PDF

This privacy policy for customers and prospective customers contains the necessary information regarding the processing of personal data in accordance with Art. 13 and Art. 14 GDPR. Below, we would like to inform you which personal data we process from you in connection with the contract concluded with you or with initiating a business relationship (including our sales activities by post, email, LinkedIn and telephone), where we obtain your data if we have not collected it from you directly, what rights you have in this regard, and how you can contact us.

Data Controller

The controller within the meaning of the GDPR is:

Genow GmbH, Grafenstraße 19, 64283 Darmstadt, Germany, Tel.: +49 (0) 6151 3942692, E-mail: hey@genow.ai

Genow GmbH is registered in the commercial register under HRB 105742 (Darmstadt District Court). The management consists of Dr. Timo Koppe, Adrian Glauben, and Dr. Sara Jourdan.

Contact for data protection inquiries:

E-mail: privacy@genow.ai

External Data Protection Officer:

DataCo GmbH, Sandstr. 33, 80335 Munich, Germany, Tel.: +49 (0) 89 452459 900, E-mail: datenschutz@dataguard.de

Type of Data and Purpose of Data Processing

We generally process your data only for the purposes for which we received or collected it. Processing for other purposes only takes place in compliance with the legal requirements pursuant to Art. 6 (4) GDPR.

Data Processing for the Performance of a Contract (Art. 6 (1) (b) GDPR)

The following stored data primarily serves to fulfill the contract or license agreement concluded with you regarding the use of an offered product or service, including payment processing and delivery.

  • Name, address and contact details
  • Order data (e.g. products, services, software usage)
  • Invoice data/order data (e.g. invoice number, item, article, name, address)
  • Data for payment processing (e.g. credit card details, bank account details, payment date, reminders)
  • Documents (e.g. correspondence, appointment scheduling)
  • Cost estimates and offers
  • Customer contact person (e.g., name, contact details, status)
  • Project data (e.g., customer requirements, responsibilities)
  • Ticket data (e.g. errors and events that occurred, measures taken, responsibilities, contact details)
  • Data on complaints and their outcomes
  • User data during software use (e.g., username, password, access log data)
  • Contract data (e.g. license agreements or data processing agreements)
  • Calendar and appointment data
  • Remote maintenance data (e.g. session ID, date and time of remote maintenance, duration, computer name)

We also store much of the data listed above in order to comply with legal obligations, e.g., accounting obligations.

This includes invoice data, delivery data, and payment processing data.

You are not obligated to provide the aforementioned personal data. However, the data you provide may be necessary for establishing and executing a contractual relationship and fulfilling the associated contractual obligations. Without providing this data, we may not be able to communicate with you or conclude or execute the contract.

Data Processing Based on a Legitimate Interest (Art. 6 (1) (f) GDPR)

In connection with the use of our software, user metadata is processed.

  • Date and time the software was retrieved
  • IP address of the requesting computer
  • Hostname of the accessing computer
  • Transferred data volumes
  • Notification of whether the retrieval was successful
  • Information about the browser type and the operating system version used.

Data Processing for Sales and Business Development (Art. 6 (1) (f) GDPR)

If you are a prospective customer or a contact person at a company that may be interested in our products and services, or if you are an existing customer, we process your business contact data in order to initiate and maintain business relationships and to inform you about our products and services (direct marketing). We contact you via the following channels:

  • Post
  • Email
  • LinkedIn (e.g., connection requests and messages)
  • Telephone

We send advertising emails and make advertising telephone calls only where the requirements of unfair competition law (in particular Sec. 7 of the German Act against Unfair Competition, UWG) are met, e.g., on the basis of your consent or, for telephone calls to business contacts, your presumed consent.

For these purposes, we process the following categories of data:

  • Name, job title, position and department
  • Company name, industry, company size and business address
  • Business contact details (e.g., email address, telephone numbers)
  • URL of your professional profile (e.g., LinkedIn)
  • Communication and interaction history (e.g., date and content of contacts, replies, appointments, interest in our products)
  • Information on any objection to direct marketing (suppression list)

Source of the data (Art. 14 (2) (f) GDPR): If we have not collected your data directly from you, we obtain it from the following sources:

  • Publicly accessible sources, in particular company websites (e.g., legal notice) and public registers (e.g., commercial register)
  • Professional networks, in particular LinkedIn and LinkedIn Sales Navigator
  • B2B lead databases, in particular lemlist, which we use to identify relevant contact persons and to supplement and verify business contact data
  • Trade fairs, events and business cards you have handed to us

Legitimate interest: Our legitimate interest lies in acquiring new customers, promoting our products and services and maintaining business relationships (direct marketing, cf. Recital 47 GDPR). We only process data relating to your professional role. You are not obliged to provide this data. You may object to this processing at any time (see section “Rights of Those Affected”).

If you contact us yourself (e.g., by an inquiry or a demo request), we process your data to answer your request and to carry out pre-contractual measures on the basis of Art. 6 (1) (b) GDPR. Where we ask for your consent, processing is based on Art. 6 (1) (a) GDPR; you may withdraw your consent at any time with effect for the future.

Storage Duration

The data you provide will only be stored for as long as necessary for the respective purpose of data processing. This includes storing data due to legally mandated retention obligations under Secs. 146 et seqq. AO, Sec. 257 HGB and Sec. 74 (4) BDSG, as well as deleting the data after the statutory retention periods have expired and warranty claims have expired.

Data of prospective customers that we process for sales and business development purposes will be deleted no later than 24 months after our last contact with you, unless a business relationship has been established in the meantime. If you object to the use of your data for direct marketing, we will delete your data; only your name, email address, company and the date of your objection will be stored in a suppression list to ensure that you are not contacted again (Art. 6 (1) (c) GDPR in conjunction with Art. 21 (3) GDPR).

The data is processed on the basis of the following legal grounds:

  • For the purposes of processing orders and handling complaints and warranty claims: Art. 6 (1) (b) GDPR
  • Answering inquiries and carrying out pre-contractual measures at your request: Art. 6 (1) (b) GDPR
  • Compliance with statutory retention periods: Art. 6 (1) (c) GDPR
  • Direct marketing and business development by post, email, LinkedIn and telephone, including the collection of data from the sources mentioned above and data enrichment: Art. 6 (1) (f) GDPR
  • Maintaining a suppression list after an objection: Art. 6 (1) (c) GDPR in conjunction with Art. 21 (3) GDPR
  • Processing based on your consent: Art. 6 (1) (a) GDPR

Categories of Recipients

The above-mentioned data will be passed on to the following recipients for the stated purposes.

Data Transmission for Billing Purposes

We may transfer your data to the following recipients. This is for the purpose of processing payments:

  • Financial institutions
  • Tax office

Data Transmission for the Use of our Software and Data Storage

For the use of our software and for data storage, we transmit data to the following recipients:

  • Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland
  • Microsoft Ireland Operations Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland
  • Brave Software, Inc., 580 Howard St. Unit 402, San Francisco, CA 94105, USA
  • Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
  • HubSpot Ireland Limited, 1 Sir John Rogerson’s Quay, Dublin 2, Ireland
  • Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg, Germany

Data Transmission for Sales and Business Development

For our sales and business development activities, we transmit data to the following recipients:

  • lempire SAS (lemlist), 8 Rue de Cléry, 75002 Paris, France – provision of business contact data (lead database) as well as planning and sending outreach campaigns
  • HubSpot Ireland Limited, 1 Sir John Rogerson’s Quay, Dublin 2, Ireland – CRM system for managing contacts and communication history (processor)
  • LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland – professional network and LinkedIn Sales Navigator (independent controller)

Transfer to Third Countries

Your personal data is generally processed by us in data centers within the European Union.

If you contact us by email or use our software, your personal data will be processed by Google, Google Cloud, and Brave Software. Since these companies may also store data on servers distributed worldwide, data may be transferred to third countries (especially the USA). To ensure an adequate level of protection, the necessary level of data protection for these providers is legally secured through the conclusion of EU Standard Contractual Clauses.

Furthermore, we use HubSpot, provided by HubSpot Ireland Limited, Dublin, Ireland, to manage our customer relationships. As part of this, customer data, in particular communication history, is stored on HubSpot’s servers. To the extent that data is processed by HubSpot, Inc. (USA) or other sub-processors outside the EU/EEA, the necessary level of data protection is secured through the EU-U.S. Data Privacy Framework and EU Standard Contractual Clauses.

For our sales and business development activities, we also use lemlist, in particular to obtain business contact data. lemlist is operated by a company based in the EU; to the extent that data is processed by its sub-processors outside the EU/EEA, the necessary level of data protection is secured through EU Standard Contractual Clauses. When we contact you via LinkedIn, data may also be processed by LinkedIn Corporation in the USA; LinkedIn secures such transfers through EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

Rights of Those Affected

As a data subject, you have the following rights under the GDPR:

  • Information, rectification, erasure (Art. 15, 16, 17)
  • Restriction of processing (Art. 18) and data portability (Art. 20)
  • Right to object to processing (Art. 21)
  • Withdrawal of consent (Art. 7 (3))

Right to object (Art. 21 GDPR)

Insofar as we process your data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation.

You may object to the processing of your personal data for direct marketing purposes at any time and without stating reasons. In this case, we will no longer process your data for these purposes. To do so, simply reply to our email or contact us at privacy@genow.ai.

To exercise any of your rights, please contact privacy@genow.ai.

Right to Lodge a Complaint with a Supervisory Authority

If you believe that the processing of your personal data violates data protection law, you have the right to lodge a complaint with a data protection supervisory authority pursuant to Art. 77 (1) GDPR. This includes the data protection supervisory authority responsible for the controller: Hessian Commissioner for Data Protection and Freedom of Information (HBDI) (+49 (0) 611 14080; poststelle@datenschutz.hessen.de).

Existence of Automated Decision-Making

Automated decision-making pursuant to Art. 22 (1), (4) GDPR – including profiling – does not take place.

Governing Language

In the event of any discrepancies between the German version of this privacy policy for customers and any translation thereof, the German version shall prevail.