Privacy policy.

1. Controller (Art. 4(7) GDPR)

CASA AKTIVA GmbH, Borsigstrasse 15, 65205 Wiesbaden, Germany

Email: infoservice@casa-aktiva.com | Phone: +49 611 94580477

2. Data Protection Contact

For privacy-related requests (e.g., access, deletion, objection, withdrawal of consent), contact: infoservice@casa-aktiva.com.

If a statutory Data Protection Officer (DPO) is appointed, contact details will be published on this page.

3. Scope and Data Subjects

This policy applies to visitors of our website, enquiry contacts, prospects, customers, business partners, applicants/contractors, and communication partners.

This website is intended for business audiences and not directed to children.

4. Categories of Personal Data

• Identity and contact data (name, business email, phone number, company, role).
• Communication data (inquiry content, meeting requests, chat interactions, support history).
• Technical and usage data (IP address, browser information, device metadata, logs).
• Preference and consent data (cookie choice, language selection, consent records).
• Professional profile data provided in partner applications (expertise, availability, portfolio links, message content).

5. Processing Activities and Legal Bases (Art. 6 GDPR)

• Website operation, IT security, and anti-abuse controls, including technical logs (Art. 6(1)(f) GDPR, legitimate interests in secure and reliable service operation).
• Handling contact enquiries, consultation requests, and project discussions (Art. 6(1)(b) GDPR for pre-contractual steps, or Art. 6(1)(f) GDPR for general B2B communication).
• Processing partner-network applications and professional profile details (Art. 6(1)(b) GDPR for pre-contractual handling, or Art. 6(1)(f) GDPR for candidate/partner selection).
• Answering questions through the digital assistant (chat) on this website (Art. 6(1)(f) GDPR for general enquiries, or Art. 6(1)(b) GDPR where an enquiry concerns pre-contractual steps).
• Optional non-essential cookies or similar technologies where consent is required (Art. 6(1)(a) GDPR in conjunction with TTDSG/ePrivacy rules).
• Compliance with legal retention and documentation obligations, including tax/accounting duties (Art. 6(1)(c) GDPR).

6. Cookies and Local Storage

• We use a consent-related storage entry (greyrock-consent) to remember your cookie choice.
• We use session storage for chat continuity (greyrock-chat-session) and the conversation history (greyrock-chat-log) while your session is active.
• Further details, categories, and controls are described in our Cookie Policy.

7. Source of Data

Most personal data is provided directly by you (e.g., when contacting us, using the chat, or submitting a partner application).

Technical data may be generated automatically by your browser/device during website access.

8. Mandatory Provision of Data

Providing personal data is generally voluntary. However, certain fields are required to process enquiries, applications, or contractual steps.

If required information is not provided, we may be unable to process your request.

9. Recipients and Processors (Art. 28 GDPR)

We share data with carefully selected processors for hosting, infrastructure, communication, and workflow automation. On this website, these are:

• Hostinger: server hosting for this website and the workflow automation.
• n8n: self-hosted workflow automation on the same server that forwards chat messages and enquiries.
• OpenAI: generates the digital assistant’s answers based on your chat messages.
• Google (Gmail): delivers enquiry notifications to our team.

Where providers act on our behalf, processing is governed by data processing agreements (DPAs) and confidentiality commitments.

Data may also be disclosed where legally required (e.g., authorities, courts, tax advisors, auditors).

10. International Data Transfers (Chapter V GDPR)

If service providers process data outside the EEA, we apply valid transfer safeguards (e.g., adequacy decisions, EU Standard Contractual Clauses, and supplementary measures where required).

OpenAI and Google may process data in the USA. Transfers are based on the EU-US Data Privacy Framework or EU Standard Contractual Clauses.

You may request additional information about applicable safeguards via infoservice@casa-aktiva.com.

11. Retention Periods

• Server/security logs: typically up to 30 days unless longer retention is required for security incident handling.
• General enquiry and communication data: generally up to 24 months after the last substantive contact unless business/legal reasons require longer retention.
• Partner application data: generally up to 12 months after final processing unless longer retention is justified or consented to.
• Contract and invoice records: retained according to statutory German commercial and tax retention obligations (typically 6 to 10 years).
• Consent and compliance evidence: retained as long as needed for accountability, defense of legal claims, and audit obligations.

12. Security Measures

We implement technical and organizational measures appropriate to risk, including access controls, transport security, role-based restrictions, and process controls.

No internet transmission can be guaranteed fully secure; however, we continuously review and improve safeguards.

13. Your Rights (Art. 15-22 GDPR)

• Right of access (Art. 15 GDPR).
• Right to rectification (Art. 16 GDPR).
• Right to erasure (Art. 17 GDPR).
• Right to restriction of processing (Art. 18 GDPR).
• Right to data portability (Art. 20 GDPR).
• Right to object (Art. 21 GDPR), including objection to processing based on legitimate interests.
• Right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

14. Right to Object to Direct Marketing

Where personal data is processed for direct marketing, you may object at any time. After objection, your data will no longer be processed for that purpose.

15. Automated Decision-Making (Art. 22 GDPR)

We do not perform solely automated decision-making, including profiling, that produces legal effects or similarly significant effects within the meaning of Art. 22 GDPR.

16. Supervisory Authority Complaint Right (Art. 77 GDPR)

You have the right to lodge a complaint with a supervisory authority, in particular in your EU member state of residence, place of work, or place of alleged infringement.

For our registered office in Wiesbaden, the competent authority is generally the Hessian Commissioner for Data Protection and Freedom of Information (HBDI).

17. Third-Party Sites and External Links

Our website may contain external links. Once you leave our website, the privacy policies of those third parties apply.

18. Changes to This Policy

We may update this policy to reflect legal, operational, or technical changes. The current version is published on this page with the revision date.