The protection of your data is a matter of course for us.

1. Data protection at a glance

General notes

The following notes provide a simple overview of what happens to your personal data when you visit our website. Personal data is any data that can be used to identify you personally. Detailed information can be found in the privacy policy below.

Data collection on our website

Who is responsible for data collection on this website?

The controller is arboro GmbH as the operator of this website. Contact details can be found under “Note on the responsible party” in section 2 and in the legal notice.

If you use our AI chat, your messages are transmitted to an AI provider to generate answers. Details can be found in section 6 under “AI chat arboro.PULSE Assistant”.

How do we collect your data?

Some data is collected when you provide it to us, for example in a contact form, when booking an appointment or in the chat. Other data is collected automatically by our IT systems when you visit the website, mainly technical data such as browser, operating system or time of access.

What do we use your data for?

Some data is collected to provide the website without errors. Other data is used to analyse user behaviour and for advertising, but only if you have consented in the cookie banner.

What rights do you have regarding your data?

You have the right to access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent at any time. You can also lodge a complaint with a data protection supervisory authority. Details can be found in section 2.

Analysis tools and third-party tools

We only use analytics and advertising services if you have consented in the cookie banner. You can withdraw your consent at any time via the cookie banner. Details can be found in sections 3 and 4.

2. General information and mandatory disclosures

Data protection

We treat your personal data confidentially and in accordance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), the German Telecommunications Digital Services Data Protection Act (TDDDG) and this privacy policy.

Data transmission over the internet, for example by email, may have security gaps. Complete protection of data against access by third parties is not possible.

Note on the responsible party

The controller responsible for data processing on this website is:

arboro GmbH
Heilbronner Str. 34
74193 Schwaigern
Germany

Phone: +49 (0) 7138 30693 0
E-Mail: info@arboro.de

The controller is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data.

Contact for data protection

If you have any questions about data protection, the processing of your data or the exercise of your rights, please contact:

arboro GmbH
Heilbronner Str. 34
74193 Schwaigern
Germany

Phone: +49 7138 306 930
E-Mail: datenschutz@arboro.de

Legal bases

We process personal data on the following legal bases; the applicable one is stated for each processing activity:

• Consent (Art. 6(1)(a) GDPR), for example for analytics and advertising cookies or the newsletter. Storing and accessing information on your device is additionally governed by Section 25(1) TDDDG.

• Contract or pre-contractual measures (Art. 6(1)(b) GDPR), for example for enquiries, appointment bookings and offers.

• Legal obligation (Art. 6(1)(c) GDPR), for example commercial and tax retention obligations.

• Legitimate interest (Art. 6(1)(f) GDPR), for example in the secure and technically error-free operation of the website. Strictly necessary storage on your device is based on Section 25(2) No. 2 TDDDG.

Recipients and processors

We use service providers that process personal data on our behalf, for example for hosting, tracking, CRM and the AI chat. We have concluded data processing agreements with these providers pursuant to Art. 28 GDPR. The individual providers are named in the following sections.

Transfers to third countries

Some service providers are based in the USA or process data there. Transfers to the USA are made to companies certified under the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission) or on the basis of the European Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Storage period

We store personal data only for as long as necessary for the respective purpose, unless you withdraw your consent or statutory retention periods apply, for example up to ten years under Section 147 AO and Section 257 HGB. The data is then deleted.

Withdrawal of your consent

You can withdraw any consent you have given at any time with effect for the future, for example via the cookie banner or by informal email to us. The lawfulness of processing carried out until the withdrawal remains unaffected.

Right to object (Art. 21 GDPR)

Where processing is based on Art. 6(1)(e) or (f) GDPR, you may object at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You may object to processing for direct marketing at any time without giving reasons.

Your further rights

• Access to the data we store about you (Art. 15 GDPR).

• Rectification of inaccurate data (Art. 16 GDPR).

• Erasure of your data, unless legal obligations prevent it (Art. 17 GDPR).

• Restriction of processing, for example while the accuracy of your data is being verified (Art. 18 GDPR).

• Data portability for data we process automatically on the basis of your consent or a contract (Art. 20 GDPR).

To exercise your rights, a message to the contact address above is sufficient.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your residence, place of work or place of the alleged infringement. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany, https://www.baden-wuerttemberg.datenschutz.de

SSL or TLS encryption

This site uses SSL or TLS encryption. You can recognise an encrypted connection by the address bar of your browser starting with “https” and a padlock symbol. When encryption is active, the data you transmit to us cannot be read by third parties.

Objection to advertising emails

We hereby object to the use of the contact details published in the legal notice for sending unsolicited advertising and information material. We expressly reserve the right to take legal action in the event of unsolicited advertising, for example by spam emails.

3. Data collection on our website

Hosting

Our website is hosted by Vercel Inc., San Francisco, USA, and delivered via servers in Frankfurt am Main. When you visit the website, Vercel processes the data listed under “Server log files”, in particular your IP address, in order to provide the website. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in providing our website securely, quickly and reliably. We have concluded a data processing agreement with Vercel. Transfers to the USA are based on the EU-U.S. Data Privacy Framework or the European Commission’s Standard Contractual Clauses. More information: https://vercel.com/legal/privacy-policy

Storyblok content management system

We manage the content of this website with the Storyblok content management system provided by Storyblok GmbH, Linz, Austria. Images and other media are loaded from Storyblok servers when you visit the website; your IP address is transmitted to Storyblok. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in managing and delivering our content efficiently and quickly. We have concluded a data processing agreement with Storyblok. More information: https://www.storyblok.com/legal/privacy-policy

Cookies and consent

Our website uses cookies and similar technologies. Cookies are small text files that your browser stores on your device.

We set technically necessary cookies, for example to store your cookie settings, on the basis of Section 25(2) No. 2 TDDDG and Art. 6(1)(f) GDPR. All other cookies, in particular for analytics and advertising, are only set with your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR. We obtain your consent via our cookie banner, where you can change or withdraw it at any time.

You can also set your browser to allow cookies only in individual cases, reject them in general or delete them automatically when closing the browser. In this case, the functionality of this website may be limited.

Record of your cookie settings: So that we can demonstrate which consent you have given or withdrawn (Art. 7(1) GDPR), we store a log entry each time you make a choice in the cookie banner. It contains a random identifier (cookie “consent_id”), the time, the domain, the language, the banner version and your choice per category and service. We do not store your IP address, browser data or any other information about you. The entries are kept in a database operated by Neon (Neon, Inc., USA) with servers located in Frankfurt am Main, Germany, and are deleted after three years. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR. You can see your consent ID in the cookie settings; please quote it if you would like information about your settings.

If you withdraw consent, we delete the cookies and stored identifiers of the services concerned from your browser as far as technically possible and reload the page so that services already loaded are stopped immediately.

Server log files

When you visit the website, information that your browser transmits is automatically recorded in server log files:

• browser type and version

• operating system used

• referrer URL

• host name of the accessing computer

• time of the server request

• IP address

This data is not merged with other data sources. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the technically error-free, secure provision and optimisation of the website.

Contact form

If you send us an enquiry via a contact form, we process your details including your contact data in order to answer the enquiry and any follow-up questions. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract or its initiation, otherwise Art. 6(1)(f) GDPR. The data remains with us until the purpose no longer applies or you request erasure; statutory retention periods remain unaffected.

Our enquiry form is delivered entirely by our own server. No third-party content is loaded when you open the page. Only when you submit the form does our server transmit your details to our CRM system HubSpot (data centre in the EU) so that we can handle your enquiry. Your IP address is not passed on to HubSpot. To protect against spam, we use an invisible check field, a minimum completion time and a limit on the number of requests per period; for this purpose your connection is briefly processed by the Upstash service (see “Upstash”).

Enquiries by email or telephone

If you contact us by email or telephone, we process your enquiry and the resulting personal data (e.g. name, request) in order to handle your request. Legal basis and storage period as for the contact form.

4. Analysis tools and advertising

We only use the following services if you have consented in the cookie banner. The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time via the cookie banner. For transfers to the USA, see “Transfers to third countries” in section 2.

Google Analytics 4

This website uses Google Analytics 4 provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics uses cookies to analyse the use of the website. The information is usually transmitted to Google servers; data may be transferred to Google LLC in the USA. IP addresses are not stored in Google Analytics 4. The data is deleted after 2 months.

We have concluded a data processing agreement with Google. Google LLC is certified under the EU-U.S. Data Privacy Framework. More information: https://policies.google.com/privacy?hl=en and https://policies.google.com/technologies/partner-sites

Google Ads, remarketing and conversion tracking

We use Google Ads provided by Google Ireland Limited with conversion tracking and remarketing. If you click on a Google ad, a cookie is set that allows Google and us to recognise that you reached our website via the ad and performed certain actions. We only receive aggregated statistics. Remarketing allows us to show you ads on other websites based on your visit to our site; with your corresponding consent to Google, this may also be cross-device via your Google account.

You can also deactivate personalised advertising in your Google settings: https://adssettings.google.com. More information: https://policies.google.com/technologies/ads?hl=en

Meta Pixel (Facebook, Instagram)

We use the Meta Pixel provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”), to measure the success of ads on Facebook and Instagram and to build audiences for advertising. Meta may link the data to your user account and use it for its own advertising purposes; data may be transferred to Meta Platforms, Inc. in the USA.

We are jointly responsible with Meta for collecting and transmitting the data to Meta (Art. 26 GDPR); the agreement is available at https://www.facebook.com/legal/controller_addendum. Meta is solely responsible for any further processing. More information: https://www.facebook.com/privacy/policy. Ad preferences: https://www.facebook.com/adpreferences

Microsoft Clarity and Microsoft Advertising

We use Microsoft Clarity and Microsoft Advertising provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. With Clarity we record how visitors use our website through behavioural metrics, heatmaps and session recordings in order to improve it; we use Microsoft Advertising to measure the success of ads. Data may be transferred to Microsoft Corporation in the USA. More information: https://privacy.microsoft.com/en-gb/privacystatement

LinkedIn Insight Tag

We use the LinkedIn Insight Tag provided by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. It allows us to measure the success of our LinkedIn ads, receive anonymous statistics about our website visitors (e.g. industry, job title) and show ads on LinkedIn to visitors of our website. Data may be transferred to LinkedIn Corporation in the USA. More information: https://www.linkedin.com/legal/privacy-policy. Ad settings: https://www.linkedin.com/psettings/advertising

OpenAI (ads in ChatGPT)

We run ads in ChatGPT and use OpenAI’s conversion measurement for this purpose (OpenAI Ireland Limited, Dublin, Ireland). If you reach our website via an ad in ChatGPT, it is recorded whether you perform certain actions, such as sending an enquiry. This allows us to measure the success of the ads. Data may be transferred to OpenAI, L.L.C. in the USA. More information: https://openai.com/policies/privacy-policy

Taboola

We run ads via the Taboola network and use the Taboola Pixel provided by Taboola, Inc., 16 Madison Square West, New York, NY 10010, USA, for this purpose. The pixel records which pages of our website you visit and whether you send an enquiry. This allows us to measure the success of our ads and to show you relevant ads from us on news and partner sites in the Taboola network (remarketing). For this purpose, Taboola sets cookies and processes a pseudonymous identifier, your IP address and information about your browser and device.

Taboola works with the identity service LiveIntent (LiveIntent, Inc., USA) for this purpose. LiveIntent sets the cookie “lidid” (stored for up to 400 days) and receives a pseudonymous identifier, your IP address and information about your browser and device. This allows Taboola to recognise your browser within its network and at partners. LiveIntent is also only active with your consent to Taboola. More information: https://www.liveintent.com/privacy-policy/

Data may be transferred to the USA; see “Transfers to third countries” in section 2. More information: https://www.taboola.com/policies/privacy-policy

Google Tag Manager

We use Google Tag Manager provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Tag Manager is a tool we use to integrate and control tracking and advertising services on our website. It does not analyse usage data itself. The services integrated via Tag Manager are only activated in line with your choices in the cookie banner. More information: https://business.safety.google/privacy/

Server-side tracking with TAGGRS

For Google Analytics, Google Ads and other advertising services we use server-side tracking via TAGGRS (TAGGRS B.V., Netherlands). Measurement data is not sent directly from your browser to the analytics and advertising providers but first to a server container operated on our behalf, where data can be shortened or removed before it is passed on. Server-side tracking only takes place if you have consented in the cookie banner. The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG; you can withdraw it at any time via the cookie banner. We have concluded a data processing agreement with TAGGRS.

If you have consented to advertising cookies and send us an enquiry or book an appointment, we transmit the identifier of your ad click via this server container and – where the platform supports it – your email address in encrypted (hashed) form to Google Ads, Meta, LinkedIn, Microsoft Advertising and Taboola. We store the click identifier together with your enquiry in our CRM system HubSpot. If your enquiry leads to an offer or an order, we also report this status back to the respective platform, without the content of your enquiry. This lets us measure which ads actually lead to customer relationships. The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG; you can withdraw it at any time via the cookie banner.

HubSpot

We use HubSpot provided by HubSpot, Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141, USA, for customer relationship management, for appointment booking (HubSpot Meetings) and, if you have consented in the cookie banner, to analyse website usage with the HubSpot tracking code and cookies.

If you book an appointment via the embedded calendar, your details (e.g. name, email address, company, preferred time) are transmitted to and stored by HubSpot in order to organise the appointment and handle your enquiry. The legal basis is Art. 6(1)(b) GDPR. For the tracking code, the legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

The booking calendar is only loaded when you click “Load calendar” or have consented to the analytics category in the cookie banner. Before that, no data is transmitted to HubSpot. By clicking, you explicitly request the booking function; from then on HubSpot receives technically necessary data such as your IP address. Without your consent to analytics, the calendar is loaded without a HubSpot visitor identifier and HubSpot receives a “do not track” signal. We log the click as a record (see “Cookies and consent”). The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR.

We have concluded a data processing agreement with HubSpot. Transfers to the USA are based on the EU-U.S. Data Privacy Framework or the European Commission’s Standard Contractual Clauses. More information: https://legal.hubspot.com/privacy-policy

If you have consented, HubSpot also records entries in forms on our website (“Collected Forms” feature), such as name and email address in an enquiry, and assigns them to a contact in our CRM.

5. Newsletter

Newsletter data

If you would like to receive our newsletter, we need your email address. We use a double opt-in procedure to verify that you own the address and agree to receive the newsletter. Further details are voluntary. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the unsubscribe link in the newsletter. After unsubscribing we delete your data; data stored for other purposes remains unaffected.

Newsletter and reports: Make and KlickTipp

If you subscribe to our newsletter or request a report (e.g. a practical report), we process your email address and your first and last name in order to send you the newsletter or the report. Your details are transmitted via the automation service Make, provided by Celonis, Inc., New York, USA (processing in data centres in the EU), to our email marketing service KlickTipp, provided by KLICK-TIPP LIMITED, 15 Cambridge Court, 210 Shepherd’s Bush Road, London W6 7NJ, United Kingdom, and stored there. An adequacy decision of the European Commission exists for the United Kingdom; Celonis, Inc. is certified under the EU-U.S. Data Privacy Framework. We have concluded data processing agreements with both providers. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the unsubscribe link. To protect against misuse, we use Google reCAPTCHA for this form (see “Google reCAPTCHA”).

6. Plugins and tools

Google Maps

Where maps from Google Maps provided by Google Ireland Limited are embedded on individual pages, they are only loaded after your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). When loading, your IP address is transmitted to Google; data may be transferred to the USA. More information: https://policies.google.com/privacy?hl=en

Google reCAPTCHA

To protect our forms against spam and automated access we use, if you have consented in the cookie banner, Google reCAPTCHA provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. reCAPTCHA analyses characteristics of your browser and your behaviour on the page, including your IP address. The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. More information: https://policies.google.com/privacy?hl=en

AI chat “arboro.PULSE Assistant”

This website offers a chat in which an AI system answers your questions about our services, prices and processes. The answers are generated automatically and may contain errors. They are non-binding; binding offers are provided exclusively by our staff.

Data processed: your messages and the chat’s replies (conversation history), a randomly generated session ID, the page visited, date and time, and your IP address. We store the IP address only in encrypted (hashed) form to limit misuse.

Purpose: answering your enquiry and preparing a possible collaboration; protecting the chat against misuse and excessive use.

Legal basis: Art. 6(1)(b) GDPR where your enquiry relates to entering into a contract, otherwise Art. 6(1)(f) GDPR. Our legitimate interest lies in answering enquiries quickly and efficiently and in protecting our systems. The session ID is stored in your browser’s session storage; this is strictly necessary for the chat to work (Section 25(2) No. 2 TDDDG).

AI provider: To generate answers we use the Claude AI model of Anthropic, PBC, San Francisco, USA. Your messages and the conversation history are transmitted to and processed by Anthropic, including outside the EU. We have concluded a data processing agreement with Anthropic; transfers to the USA are based on the European Commission’s Standard Contractual Clauses. According to Anthropic, data submitted via the API is not used to train its AI models. More information: https://www.anthropic.com/legal/privacy

Retention: We store conversation histories for a maximum of 30 days and then delete them automatically. Anthropic stores the transmitted data only for as long as necessary to provide the service and to detect misuse.

Please note: Do not enter sensitive data in the chat, such as passwords, login credentials, health or banking information. No automated decision-making within the meaning of Art. 22 GDPR takes place.

Cloudflare Turnstile

To protect the chat against automated access (bots) we use Cloudflare Turnstile provided by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. When the chat starts, Turnstile uses technical characteristics of your browser and your IP address to check whether the request comes from a human. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in protecting our website against misuse. Data may be transferred to the USA on the basis of the EU-U.S. Data Privacy Framework or the European Commission’s Standard Contractual Clauses. More information: https://www.cloudflare.com/privacypolicy/

Upstash

For the conversation history, session management and usage limits we use the database service of Upstash, Inc., USA. Upstash processes the data on our behalf under a data processing agreement. Where data is transferred to the USA, this is based on the European Commission’s Standard Contractual Clauses. The legal basis is Art. 6(1)(b) and (f) GDPR, as for the AI chat.