1. Controller
The controller responsible for the processing of personal data on this website within the meaning of Article 4 (7) GDPR is:
DubeAI, Bad Homburg vor der Höhe, Germany. Email (plain text only — please use the contact form for messages): ai4grc@dube.eu.
Full provider details: see Imprint.
A data protection officer is not designated, as the controller is not required to appoint one under Art. 37 GDPR or §38 BDSG.
2. Overview of processing
We process personal data only where this is necessary to provide a functional website, deliver our content, and respond to enquiries — and only on a documented lawful basis:
- Art. 6 (1) (a) GDPR — consent, for the demo request form (gated by a consent checkbox).
- Art. 6 (1) (b) GDPR — pre-contractual measures, where you contact us to evaluate a contract.
- Art. 6 (1) (f) GDPR — legitimate interests, for the secure and stable operation of the website (server logs).
- Art. 6 (1) (c) GDPR — legal obligation, for handling privacy requests under Arts. 12–22 GDPR, and where retention is required by law (e.g. tax records).
3. Website hosting & server logs
This website is hosted on GitHub Pages, a service of GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA, and delivered through a global content delivery network. Your request is normally answered by an edge location near you, but the provider is established in the United States — see §9.
When you access this website, GitHub automatically processes technical access data: your IP address, date and time of access, requested URL, HTTP status code, referring URL, and user-agent string. This serves the secure and stable operation of the website and rests on our legitimate interests under Art. 6 (1) (f) GDPR.
We have no access to these server logs and no control over how long GitHub keeps them. We therefore cannot state a retention period of our own for this data, and we cannot shorten or anonymise the IP addresses it contains. GitHub’s own privacy statement governs that processing.
4. Fonts
This website loads no web fonts at all. Pages are rendered in fonts already present on your device. Nothing is requested from Google Fonts, Adobe Fonts or any other third-party provider, and no font file is downloaded from this website either.
5. Demo request form
When you submit the demo request form on the home page, the following data is processed: name, work email address, company, your message (a mandatory field, minimum 10 characters), the explicit consent flag, and a timestamp.
The submission is sent from your browser directly to Formspree. This unavoidably also transmits your IP address, user-agent string and referring URL to Formspree in the USA.
The form is operated through Formspree, Inc. (Boston, MA, USA) as our processor. Form submissions are transmitted to Formspree, which then forwards them to our internal mailbox. A data processing agreement under Art. 28 GDPR is in place. The transfer to the USA is safeguarded by EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR).
Lawful basis: your consent under Art. 6 (1) (a) GDPR, and — where the request concerns the evaluation of a contract — Art. 6 (1) (b) GDPR. Retention: request data is retained for up to 12 months after the request is closed, then deleted, unless a contract is initiated. You may withdraw your consent at any time via the privacy request form; withdrawal does not affect the lawfulness of prior processing.
6. Privacy request form
The privacy request form at the end of this page lets you exercise your rights under Arts. 15–22 GDPR. It collects: the request category, your name, your email, your message, an acknowledgement flag, and a timestamp.
Lawful basis: handling your request is a legal obligation under Art. 6 (1) (c) GDPR in conjunction with Arts. 12–22 GDPR. It does not depend on your consent, and we do not make it conditional on one.
The processing path is the same as for the demo form: Formspree, Inc. (USA) as processor, SCCs in place, and the same transmission of IP address, user-agent and referring URL described in §5. Retention is limited to what is necessary to handle the request and to meet our accountability obligations under Art. 5 (2) GDPR. We may ask for proof of identity before acting on your request, per Art. 12 (6) GDPR.
If you prefer not to use the form, send your request by email to ai4grc@dube.eu instead — that route does not involve Formspree.
7. Categories of data, lawful bases, and retention
| Purpose | Data | Basis | Retention |
|---|---|---|---|
| Website operation & security | IP address, user-agent, timestamps, requested URL, referring URL | Art. 6 (1) (f) | Set by GitHub — no access on our side (§3) |
| Demo request handling | Name, work email, company, message, consent flag, plus IP & user-agent of the submission | Art. 6 (1) (a) / (b) | ≤ 12 months after closure |
| Privacy request handling | Subject, name, email, message, plus IP & user-agent of the submission | Art. 6 (1) (c) | 3 years (accountability) |
8. Recipients & processors
We do not sell personal data. We share data only with processors who act on our documented instructions under Art. 28 GDPR:
- GitHub, Inc., San Francisco, CA, USA — hosting and delivery of this website via GitHub Pages, including the server logs described in §3.
- Formspree, Inc., Boston, MA, USA — form submission processing (demo & privacy request forms). SCCs in place.
- EU-based email provider — receipt and storage of submitted enquiries.
9. Third-country transfers
Two processors established in the United States are involved:
- GitHub, Inc. — hosting and delivery of every page of this website. Each page view transmits the access data described in §3, including your full IP address. This applies whether or not you use a form.
- Formspree, Inc. — processing of the demo and privacy request forms, covering the form content and the metadata described in §5.
Transfers are safeguarded under EU Standard Contractual Clauses pursuant to Art. 46 (2) (c) GDPR. We have assessed the legal regime of the recipient country (Schrems II transfer impact assessment) and apply supplementary measures as appropriate (TLS in transit, access controls at the recipient).
When you submit the demo form, you additionally acknowledge this transfer by ticking the consent checkbox. The transfer to our host cannot be avoided that way — it is inherent in retrieving any page of this website.
10. Retention periods
We retain personal data only for as long as necessary for the purposes set out in §7, or for as long as required by law (in particular German commercial and tax retention obligations, generally 6 to 10 years for accounting records). After the retention period expires, data is deleted or — where applicable — restricted from further processing.
11. Cookies & tracking
This website does not set any cookies, does not use browser localStorage or sessionStorage for personal data, and does not run any third-party analytics, advertising, or tracking. There is no consent banner because there is nothing to consent to beyond what is strictly necessary to deliver the page you requested.
12. Your rights
Under the GDPR you have the following rights regarding your personal data:
- Right of access (Art. 15) — confirmation as to whether personal data concerning you is processed, and a copy of that data.
- Right to rectification (Art. 16) — correction of inaccurate or incomplete data.
- Right to erasure (Art. 17) — deletion of your data where one of the grounds in Art. 17 (1) applies.
- Right to restriction of processing (Art. 18).
- Right to data portability (Art. 20) — receive your data in a structured, machine-readable format.
- Right to object (Art. 21) — object to processing based on legitimate interests, on grounds relating to your particular situation.
- Right to withdraw consent (Art. 7 (3)) — at any time, with effect for the future.
- Right to lodge a complaint with a supervisory authority (Art. 77) — see §13.
To exercise any of these rights, use the privacy request form below or simply email ai4grc@dube.eu — both are equally valid, and the email route does not involve any third-country transfer. We respond without undue delay and in any event within one month of receipt (Art. 12 (3) GDPR).
13. Supervisory authority
The competent supervisory authority for the controller is:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Gustav-Stresemann-Ring 1
65189 Wiesbaden, Germany
Phone: +49 611 1408-0
Web: datenschutz.hessen.de
14. Automated decision-making
We do not engage in automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22 GDPR.
15. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our processing or in applicable law. The "Last updated" date at the top of this page indicates the current version. Material changes will be flagged where they affect existing data subjects.
16. Submit a privacy request
Use this form to exercise any of your rights under §12, to withdraw consent, or to ask a privacy-related question. Submissions are routed through Formspree (see §6) and reach our privacy mailbox. If you would rather not use a US processor, email ai4grc@dube.eu directly — we treat that as an equally valid request.