Privacy Policy

1. Data controller

Phone: +49 156 79547981
Email: datenschutz(at)rescova.de

2. Hosting and server logs

We host this website and the associated API with Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany (“Hetzner”). When you access the website, the web server processes connection data required for technical purposes. This may include your IP address, the date and time of access, the address accessed, the referrer URL, browser and operating system information, the amount of data transferred, and the HTTP status.

This processing serves to provide the website securely and reliably, analyse errors, and prevent misuse. It is based on Article 6(1)(f) GDPR. Our legitimate interest is the secure and functional operation of our online services. Hetzner acts as a processor under an agreement pursuant to Article 28 GDPR. Log data is deleted as soon as it is no longer required for these purposes, unless a legal obligation or a specific security incident justifies longer retention.

3. Encrypted transmission

Our website uses TLS encryption. This protects data transmitted between your browser and our servers from being intercepted in transit.

4. Contacting us

If you contact us by email or phone, we process your contact details and the content of your enquiry in order to respond. The legal basis is Article 6(1)(b) GDPR where your enquiry relates to entering into or performing a contract. Otherwise, the legal basis is Article 6(1)(f) GDPR; our legitimate interest is handling business enquiries. The data is deleted once the enquiry has been fully handled and no statutory retention obligations or legitimate interests require further retention.

5. Enquiring about a pilot project

Through the “Discuss a pilot” form, we collect your first and last name, company, and phone number. We use this information to handle your enquiry, call you back as requested, and prepare a possible pilot project. The legal basis is Article 6(1)(b) GDPR. We cannot process your enquiry without the information marked as mandatory.

Technical processing of the form

When you submit the form, your information is transmitted in encrypted form to our API hosted by Hetzner, where it is received and processed to handle your enquiry.

Only people responsible for handling your enquiry have access to this information. We delete it as soon as it is no longer required for handling your enquiry or potentially entering into a contract, unless statutory retention obligations or legitimate interests require otherwise.

6. Voice demo “Experience Evi live”

When you request the phone demo, we process your phone number, IP address, and technical connection and call data, such as the time, status, duration, and randomly generated session identifiers. We need your phone number to establish the call you requested. Your IP address and phone number are also used temporarily to limit abusive or repeated requests.

Browser demo via WebRTC

If you choose the browser demo, your browser requests microphone access only after you press the start button. The microphone signal and response audio are transmitted over an encrypted real-time connection. No phone number is required. You can deny microphone access in your browser, mute it, or end the conversation at any time.

To prevent misuse, your IP address is pseudonymised using a secret server-side key and processed for a limited time to enforce usage limits. Session and connection data, as well as conversation content, are otherwise processed in the same way as in the phone demo. The case used is entirely fictional.

Security checks with Cloudflare Turnstile

Before the browser demo starts, we use Cloudflare Turnstile to detect automated access and misuse. The provider is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare processes browser, device, and connection signals required for technical purposes. Conversation content and form entries are not transmitted to Turnstile. This processing is based on Article 6(1)(f) GDPR; our legitimate interest is protecting the publicly accessible voice feature, which incurs costs. Further information is available in the Turnstile Privacy Addendum.

During the conversation, your voice is processed in real time so that the voice assistant can understand what you say and respond. We do not make an audio recording. However, a limited conversation summary, the demo outcome, and technical event data may be stored in the system. Please do not provide real debt claim details or sensitive personal data in the demo.

In the browser demo, which is operated separately at a technical level, voice data and the resulting conversation content are processed in real time by OpenAI. We configure this demo without persistent application storage. OpenAI does not use data submitted through the API to train its models unless we explicitly agree to this. Content and technical data may be stored temporarily for abuse detection under OpenAI’s terms. Further information is available in the OpenAI API data controls.

The legal basis for the call you request is Article 6(1)(b) GDPR. Abuse prevention and technical safeguards are based on Article 6(1)(f) GDPR. Our legitimate interest is protecting the service and third parties from unwanted calls and ensuring that the demo operates reliably.

Categories of service providers

• A real-time communications provider supplies the technical voice connection and processes voice and connection data during the call.
• A telecommunications provider establishes the connection to the public telephone network and processes the necessary phone number and traffic data.
• A specialist speech-processing provider processes the conversation audio in real time for speech recognition, response generation, and speech output.

Where a service provider processes personal data in a third country, data is transferred only in compliance with Articles 44 et seq. GDPR, in particular on the basis of an adequacy decision or appropriate safeguards, such as the European Commission’s standard contractual clauses.

The demo uses a fictional case. It does not make any decision that produces legal effects concerning you or similarly significantly affects you.

7. Appointment booking through Google Calendar

On our fax funnel, you can book a demo appointment through Google Calendar. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google’s appointment booking feature is loaded only when you press the corresponding button. This establishes a connection to Google. Google processes, in particular, your IP address, technical browser and device data, and the information you provide when booking, such as your name, email address, and selected appointment.

Your booking data is processed to prepare and hold the appointment you requested on the basis of Article 6(1)(b) GDPR. Google may use cookies and similar technologies when you access the booking page and may process data in the USA or other countries. Google cites, in particular, the EU-U.S. Data Privacy Framework and the European Commission’s standard contractual clauses as the bases for these transfers. Further information is available in Google’s privacy policy.

8. Cookies, consent, and Google Analytics

We store your choice regarding optional audience measurement in your browser’s local storage. The entry contains your decision, a version number, and the time of your choice. This storage is necessary so that we can respect your decision on subsequent page visits and avoid repeatedly displaying the consent prompt. It remains stored until you change your choice through “Cookie settings” or clear your browser’s local storage.

Google Analytics 4

We use Google Analytics 4 with measurement ID G-4P5V67CW69 in Advanced Consent Mode. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). This service helps us understand which pages are visited and how our website is used. It may process, in particular, pages visited, referrers, approximate region, the time and duration of the visit, and technical browser, device, and connection data.

After you give consent, Google Analytics sets the first-party cookies_ga and _ga_<Container-ID> to distinguish browsers and sessions. We limit their lifetime to a maximum of 13 months from initial storage. Advertising storage, personalised advertising, and Google Signals remain disabled. The Google tag is loaded with consent denied by default. Before you give consent, no Analytics cookies are stored or read. In this state, Google may receive cookieless measurements and consent signals. These may include the consent status, time, user agent, referrer, information about ad-click parameters in the URL, and a random number.

The legal bases are your consent under section 25(1) TDDDG for storing and accessing information on your device, and Article 6(1)(a) GDPR for subsequent processing. You can withdraw your consent at any time with effect for the future. To do this, open “Cookie settings” at the bottom of any page and select “Reject”. We then reset the consent status to “denied” and delete Analytics cookies accessible from our domain. Afterwards, only the cookieless measurements and consent signals described above may be transmitted. Withdrawal does not affect the lawfulness of processing carried out before it.

Google may also process data in the USA and other countries. For this, Google refers, in particular, to Google LLC’s certification under the EU-U.S. Data Privacy Framework and, additionally, to standard contractual clauses. Further information is available in Google’s privacy information and its information about Google Analytics cookies.

Locally hosted fonts

The web fonts we use are served from our own servers. Loading these fonts does not establish a connection to Google Fonts.

9. Recipients and retention periods

Within Rescova, only people who need the data for the purposes described above have access to it. External recipients are the hosting, communications, and speech-processing providers named in this policy, as well as authorities or other bodies where we are legally required to disclose data or where this is necessary to establish, exercise, or defend legal claims.

We enter into agreements with processors pursuant to Article 28 GDPR. On request, we provide further information about the categories of recipients used, data processing agreements, and safeguards for any transfers to third countries.

Unless a specific period is stated in the individual sections, we retain personal data only for as long as necessary for the relevant purpose. We then delete or anonymise it, unless statutory retention periods or the protection of legal claims require longer retention.

10. Your rights

Subject to the statutory requirements, you have the right to:

• access your personal data (Article 15 GDPR),
• have inaccurate data rectified (Article 16 GDPR),
• have your data erased (Article 17 GDPR),
• restrict processing (Article 18 GDPR),
• data portability (Article 20 GDPR), and
• object to processing based on Article 6(1)(f) GDPR (Article 21 GDPR).

To exercise your rights, simply send a message to datenschutz(at)rescova.de. You also have the right to lodge a complaint with a data protection supervisory authority. For a company based in Berlin, the Berlin Commissioner for Data Protection and Freedom of Information is particularly relevant.

11. Right to object

Where we process your personal data on the basis of Article 6(1)(f) GDPR, you may object to this processing at any time on grounds relating to your particular situation. We will then stop processing the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing serves to establish, exercise, or defend legal claims.

12. Last updated and changes

Last updated: August 2026. We update this privacy policy when our website, the services we use, or legal requirements change.