Controller
Alvantiq UG (haftungsbeschränkt)
Eppsteiner Str. 40
60323 Frankfurt am Main, Germany
Email: contact@alvantiq.com
Hosting and server logs
The published website is delivered through Vercel Inc. Technically necessary log data may be processed when the page is accessed, including IP address, time, requested file, referrer, browser and operating system. Processing serves secure and reliable delivery under Art. 6 (1) (f) GDPR. Where data is processed outside the EU or EEA, the transfer mechanisms identified by the provider apply, in particular the EU-US Data Privacy Framework and Standard Contractual Clauses.
Personalised link and reach measurement
A randomly assigned URL token links this page to a specific institution and to the contact person addressed there. It adapts the displayed institution name and example domain — and we measure whether and how the link is used. We state this explicitly because the measurement is attributable to a named recipient.
Without your consent we record on our servers in Frankfurt: time and requested address including the token, language version, referrer (hostname only), coarse device class as well as browser and operating system family derived from what your browser sends anyway, an IP address truncated to the network segment (IPv4 /24, IPv6 /48), a coarse country-level location taken from our hosting provider's headers, a technical session marker, the scroll depth reached in four steps (25/50/75/100 %), dwell time in four classes, which sub-pages of the platform preview were opened, video progress in quarters, and the click on “Request platform access” including which button triggered it, how many seconds the dialog stayed open, and what happened next (preview opened, link copied, email chosen, or dialog closed without action — in the latter case also whether via ✕, Escape or a click outside). For each event we additionally note technical indicators of its reliability: which collection path it came from, whether the request originated from this website, and a score for the suspicion that it came from an automated scanner rather than a person.
On the general page without a token — that is, /de and /en without a personal link — none of this is recorded. There we only store something if you make a choice in the consent banner, and then only the record of that choice (time, scope, text version, browser family). If you agree here, however, we set the cookie alvantiq-vid described below straight away — on this page too; it takes effect once you later open your personal link.
Nothing is stored on or read from your device in this process, so § 25 TDDDG does not apply. The session marker is created solely on our server as a checksum of the truncated IP address, browser string, token and a random value that rotates daily and is deleted after two days. After that it cannot be reversed even with full access to our systems.
The purpose is to assess interest in our offer and to prioritise sales outreach. The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is to follow up only where interest actually exists and not to contact institutions repeatedly that never opened the link. There is no automated decision-making within the meaning of Art. 22 GDPR; people decide whom to approach.
Only with your consent (Art. 6 (1) (a) GDPR and § 25 (1) TDDDG) do we additionally set a cookie alvantiq-vidcontaining a random identifier and lasting six months. It lets us recognise your device on a later visit and attribute several visits to the same access. Consent is voluntary; the page and the platform preview work fully without it. You may withdraw it at any time with effect for the future via “Cookies” in the footer of every page. The lawfulness of processing before withdrawal is unaffected (Art. 7 (3) sentence 3 GDPR).
Your decision itself — including a refusal — is stored in the cookie alvantiq-messung for one year. Without storing it we could not honour your choice, which makes it permissible without consent under § 25 (2) no. 2 TDDDG. On refusal it contains only the choice, the time and the text version, and no identifier.
Retention. Truncated IP address, coarse location and session marker are deleted after 7 days, the daily random value after 2 days. Events linked to a token are deleted 12 months after the last event. Whether and when platform access was requested is retained for 3 years from the end of the year, because it forms part of pre-contractual dealings (Art. 6 (1) (b) GDPR, limitation periods §§ 195, 199 German Civil Code). Records of consent and objection are kept for 3 years after they cease to have effect (Art. 7 (1), Art. 5 (2) GDPR).
Measurement without a personalised link
We also record a page view when you open this website without a personalised link, that is at alvantiq.com/en or alvantiq.com/de. Recorded are the same technical details listed above, but without a token — there is none, so the visit is not attributable to any institution or person. We evaluate these entries only in aggregate: how often the page was opened, in which language, and when it was last opened.
The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is to know whether the site is found at all, without employing a third-party analytics service for it. The same retention periods apply as above; the entries carry no token and are therefore deleted after 12 months at the latest, and the truncated IP address and session marker after 7 days.
The “Turn off measurement” link in the footer stops the measurement described in the previous section, which is tied to a token. It cannot stop this one, because there is no token to attach an objection to. If you do not wish your visit to be counted here either, write to us at the address under “Controller”; we will then exclude your network segment.
We use no third-party services for reach measurement. This data is not transferred to third parties; it is processed on the infrastructure named under “Hosting”.
Your right to object to direct marketing
You may object to the reach measurement described above at any time. No reason is required and you suffer no disadvantage (Art. 21 (2) GDPR). After your objection we record no further events for your link and delete the interest signals already recorded. Only the record of whether and when platform access was requested is retained, because that step belongs to pre-contractual dealings and does not rest on a legitimate interest.
You can object using the “Turn off measurement” link in the footer of your personalised page and in the access dialog, or informally at contact@alvantiq.com. The objection applies across all devices because it is tied to your link and not to a cookie.
Like any URL, the token may additionally appear in technically necessary server logs kept by the hosting provider.
Contact form
On the general page the access button opens a form. We process only what you enter yourself: your name and email address (required), institution and message (optional). Technically we add the time of submission, the language version and an IP address truncated to the network segment (IPv4 /24, IPv6 /48) — the latter solely to limit abusive bulk submissions; it is deleted after seven days. We do not use a third-party captcha.
The legal basis is Art. 6 (1) (b) GDPR (pre-contractual steps at your request), otherwise Art. 6 (1) (f) GDPR in answering your enquiry. The data is deleted once its purpose no longer applies, at the latest after three years, unless statutory retention duties require otherwise.
Recipients. Your details are stored in a database operated by Neon Inc. in the Frankfurt am Main region and delivered by email to our contacts; delivery is handled by Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, USA, using the sending infrastructure of Amazon Web Services, Inc. in the Ireland region. A data processing agreement under Art. 28 GDPR is in place with both providers. Both are US companies; access by US authorities cannot be entirely ruled out even where the data is held in Frankfurt am Main or in Ireland. Transfers rely on the European Commission's standard contractual clauses; Resend is additionally certified under the EU-US Data Privacy Framework. Resend's sub-processors are established in the United States.
Requesting the preview
On the personalised page the access button asks for your name, your institution and your email address and sends you the preview link. We store these three details, together with the time, the language version, your institution's identifier and an IP address truncated to the network segment. The purpose is to send the link and to follow up on your enquiry afterwards; the legal basis is Art. 6 (1) (b) GDPR. The data is deleted once its purpose no longer applies, at the latest after three years. You may object to that storage at any time and without formality.
Until 5 August 2026 the address was used at this point solely for that single delivery and was not stored. Anyone who requested the link before that date is not affected by the storage.
Contact by email
The access dialog additionally offers an email route; no form data is transmitted there — only your local email application is opened with a prepared message. The click itself is recorded as an event — see “Personalised link and reach measurement”. Only when you send the email do we process its contents to handle your request and follow-up questions. The legal basis is Art. 6 (1) (b) GDPR for pre-contractual steps, otherwise Art. 6 (1) (f) GDPR.
Data is deleted when its purpose no longer applies unless statutory retention duties require otherwise.
Optional external AI services
The “Review with ChatGPT”, “Review with Claude”, “Review with Perplexity” and “Review with Copilot” buttons are optional external links. A connection to the selected provider is made only after your click. A prepared review prompt, including the public address of this page, is passed to the provider as a URL parameter and also copied to your clipboard as a fallback. Depending on the service and session, the review starts immediately or opens prefilled. The prompt contains no content from the personalised URL parameter. Alvantiq does not send it server-side and receives neither your input nor the service's response.
The external provider independently processes connection data generated by the visit, such as IP address, browser and device information, as well as any content you enter or submit there, under its own terms. If you are signed in, the provider may associate the use with your account. Information about retention, international transfers and your rights is available in the privacy notices of OpenAI, Anthropic, Perplexity and Microsoft. Do not add confidential or personal information there.
Newsletter
For the newsletter we process your email address and, if you provide them, your name and institution. The legal basis is your consent under Art. 6 (1) (a) GDPR in conjunction with § 7 (2) no. 3 UWG.
We use the double opt-in procedure. After you sign up we send you an email with a confirmation link; only your click on it completes the subscription. If you do not confirm, the entry is deleted automatically after seven days. As proof of consent we store the exact wording you agreed to, the times of sign-up and confirmation, and an IP address truncated to the network segment.
You may unsubscribe at any time — via the unsubscribe link in every message, via your email client's unsubscribe function, or informally to contact@alvantiq.com. The record remains afterwards as proof of the consent given and withdrawn; without it we could not later demonstrate that you were unsubscribed.
Recipients are the same as for the forms. We do not measure the success of individual messages — whether you opened an email or clicked a link.
Microsoft Clarity
Only with your consent. If you agree to measurement, we load Microsoft Clarity. The service records your visit — mouse movement, clicks, scrolling — and produces heatmaps and replayable sessions from it. Without your consent the script is not loaded, not even in an inactive state.
The provider is Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA. Recordings are processed on Microsoft servers, including outside the European Union. Transfers rely on the European Commission's standard contractual clauses; Microsoft is additionally certified under the EU-US Data Privacy Framework. The legal basis is your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG.
Masking is switched off. By default Clarity obscures input fields and content it recognises as sensitive; for this project we lifted that default on 6 August 2026. What you type into a form is therefore recorded as well — name, institution and email address in the access dialog, likewise in the contact form and the newsletter field. Those entries are legible in the replayed session. If you would rather they were not, please do not consent to measurement — without your consent none of it is loaded.
You may withdraw your consent at any time via “Cookies” in the footer; no script is loaded after that. What Microsoft already received during a running session cannot be recalled from here — that requires a deletion request directly to Microsoft.
Local fonts and cookies
Fonts are served locally. No marketing cookies are used, and without your consent no third-party service is loaded either. The cookies we set are: alvantiq-messung (your privacy decision, one year, permissible without consent under § 25 (2) no. 2 TDDDG), alvantiq-vid (recognition, six months, only with your consent) and alvantiq-admin-session (internal administration area under /admin only, irrelevant to visitors of this page). After consent, Microsoft Clarity additionally sets its own cookies (_clck, _clsk) — see the section above. Details on reach measurement are in “Personalised link and reach measurement”.
Your rights
Within the statutory framework, you have rights to access, rectification, erasure, restriction, portability and objection under Art. 15 to 21 GDPR. Contact contact@alvantiq.com.
Complaint
You may lodge a complaint with a data protection authority. Our competent authority is the Hessian Commissioner for Data Protection and Freedom of Information, datenschutz.hessen.de.
Last updated: August 2026 · version 2026-08-v4 (referenced in the consent record)