Privacy Policy

Last updated: 2026-07-30

We process personal data only where necessary and only for defined purposes. This notice explains what data we process when you use our website, on what legal basis, for how long, and what rights you have.

Controller and contact

The party responsible for this website (the "controller") for purposes of data protection law is:

iComplai UG (Haftungsbeschränkt)
Kleiberweg 9
85635 Höhenkirchen-Siegertsbrunn
Germany

Represented by the managing directors: Asli Solmaz-Kaiser, Janosch Peters
Commercial register: HRB 257550 Amtsgericht München

Telephone: +49 160 3366374
Email: privacy@icomplai.com

We have not appointed a data protection officer, as we are not required to do so under Art. 37 GDPR / Sec. 38 BDSG.

Legal bases

  • Art. 6(1)(a) GDPR - consent, for all non-essential cookies and similar technologies, for the newsletter, and for any transfer that depends on consent. Storing or reading information on your device additionally requires consent under Sec. 25(1) TDDDG unless it is strictly necessary to provide the service you requested (Sec. 25(2) TDDDG).

  • Art. 6(1)(b) GDPR - contract, where processing is needed to perform a contract with you or to take steps at your request before entering into one.

  • Art. 6(1)(c) GDPR - legal obligation, e.g. statutory retention duties.

  • Art. 6(1)(f) GDPR - legitimate interests, e.g. secure and stable operation of the website, defence against attacks, and handling business correspondence.

Where we rely on legitimate interests, we have balanced those interests against your rights and describe the interest in the relevant section below.

Your rights

You have the right:

  • to obtain confirmation whether we process data about you, and to access that data (Art. 15 GDPR);

  • to have inaccurate or incomplete data corrected or completed (Art. 16 GDPR);

  • to erasure (Art. 17 GDPR);

  • to restriction of processing (Art. 18 GDPR);

  • to data portability (Art. 20 GDPR);

  • to object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR). Where we process your data for direct marketing, you may object at any time with no need to give reasons, and we will stop;

  • to withdraw any consent you have given, at any time and with effect for the future (Art. 7(3) GDPR). Withdrawal does not affect the lawfulness of processing carried out before withdrawal. For cookies, you can withdraw via the cookie settings link in the footer of this website. For the newsletter, use the unsubscribe link in any newsletter or contact us;

  • to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority competent for us is:

Bayerisches Landesamt fuer Datenschutzaufsicht (BayLDA) Promenade 18, 91522 Ansbach, Germany

To exercise any of these rights, contact us using the details in section Controller and contact.

Hosting

This website is hosted by Squarespace Ireland Limited, Dublin, Ireland, acting as our processor under Art. 28 GDPR.

When you visit the site, Squarespace processes on our behalf:

  • information about your browser, network and device

  • the web page you visited before coming here

  • your IP address

  • usage details such as clicks, internal links, pages visited, scrolling, searches and timestamps

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is providing a functional, secure and reliably available website. Squarespace also uses aggregated, de-personalised data to protect and improve its own platform. Retention is governed by Squarespace's own retention periods.

Squarespace's privacy notice: https://www.squarespace.com/privacy

Transfers to the USA may occur. See section Transfer to third countries.

Server log files

Access to this website is logged by our hosting provider. Log data typically comprises IP address, date and time of the request, the page requested, HTTP status, transferred data volume, referrer and user agent.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is detecting and remedying faults, and identifying and defending against attacks. Log data is not merged with other data sources and is not used to identify you personally.

Cookies and consent

Cookies are small files stored on your device by your browser. We also use comparable technologies such as local storage, which are treated identically here.

  1. Strictly necessary — no consent required (§ 25(2)(2) TDDDG). These are needed to deliver the website you requested: session handling, protection against cross-site request forgery, protection of our forms against automated abuse, and storing your own cookie preferences. The associated processing rests on Art. 6(1)(f) GDPR.

  2. Statistics — consent required. Analytics cookies are set only after you consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). Until you consent, no analytics cookies are set and no analytics scripts are loaded.

  3. Your choice. Our cookie banner lets you accept or decline non-essential cookies, with an equally prominent decline option. You can change or withdraw your choice at any time via the cookie settings in the footer. You can also delete cookies and block future ones in your browser settings; blocking strictly necessary cookies may impair site functionality.

Your decision is stored in a cookie on your device for 30 days, after which you will be asked again.

Squarespace Analytics

Our hosting platform provides aggregated statistics on site traffic and activity (page views, referrers, device categories, search terms). Analytics and performance cookies for this purpose are set only after you consent to the statistics category.

Legal basis: Art. 6(1)(a) GDPR and Sec. 25(1) TDDDG.

Overview of the cookies Squarespace uses: https://support.squarespace.com/hc/articles/360001264507

Google Analytics

We use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics processes a pseudonymous identifier, your truncated IP address, the pages you view, interaction events, approximate location derived from your IP address, and device and browser characteristics. We use this to understand how our website is used and to improve it.

Legal basis: Art. 6(1)(a) GDPR and Sec. 25(1) TDDDG - consent. Google Analytics is loaded only after you consent to statistics; declining means it is not loaded at all. You may withdraw consent at any time via the cookie settings in the footer.

IP anonymisation is active by default in Google Analytics 4: your IP address is truncated and is not stored.

Google Signals is deactivated. We therefore do not use cross-device tracking, do not link analytics data to Google accounts, and do not use analytics data for advertising purposes. We do not operate advertising campaigns with Google.

Retention of analytics data in our property: 14 months

Data may be transferred to Google LLC in the USA - see section Transfer to third countries.

Google privacy policy: https://policies.google.com/privacy
How Google uses data from sites using its services: https://policies.google.com/technologies/partner-sites
Browser opt-out add-on: https://tools.google.com/dlpage/gaoptout

Fonts

The fonts used on this website are served from our hosting infrastructure. No font files are requested from Google or Adobe servers, and no data is transmitted to them for this purpose.

Contact us

If you contact us by email, telephone or through a form on this website, we process the data you provide - typically name, email address, company, and the content of your message - in order to handle your enquiry.

Legal basis: Art. 6(1)(b) GDPR where the enquiry concerns a contract or pre-contractual steps; otherwise Art. 6(1)(f) GDPR, our legitimate interest being to respond to business enquiries.

Providing this data is not a statutory requirement, but without it we cannot answer your enquiry.

Retention: we delete enquiries once fully dealt with and no retention obligation applies. Business correspondence is subject to statutory retention periods of six years (Sec. 257 HGB) or ten years (Sec. 147 AO) where it qualifies as commercial or tax-relevant.

Forms on this website are provided by HubSpot - see section the next section.

Forms and HubSpot CRM

We use HubSpot for the forms on this website and for managing our business contacts. Provider: HubSpot Ireland Limited, Ground Floor, Two Dockland Central, Guild Street, Dublin 1, Ireland, with HubSpot, Inc., Cambridge, MA, USA as a sub-processor. HubSpot acts as our processor under Art. 28 GDPR. Our HubSpot instance uses EU data residency.

Loading the form

Forms are embedded from HubSpot's servers. Loading a page that contains a form transmits your IP address and the referring URL to HubSpot, and sets the bot-protection cookie described under "Cookies and consent" above. No tracking or visitor-recognition script is loaded, and no HubSpot analytics cookies are set.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is providing working forms that are protected against automated abuse.

Customer relationship management

We store business contact data - name, business email address, company, role, our correspondence with you, and any interests you have told us about - in HubSpot in order to manage our customer and prospect relationships.

Legal basis: Art. 6(1)(b) GDPR where a contractual relationship exists or is being prepared, otherwise Art. 6(1)(f) GDPR, our legitimate interest being the management of our business relationships.

Retention: we delete contact records when the business relationship has ended and no retention obligation applies. Business correspondence is subject to statutory retention periods of six years (Sec. 257 HGB) or ten years (Sec. 147 AO) where it qualifies as commercial or tax-relevant.

Transfers to the USA may occur - see "Transfers to third countries" below.

HubSpot privacy policy: https://legal.hubspot.com/privacy-policy

Newsletter

Our newsletter is sent through HubSpot. Details of the provider and of our processing arrangement are set out under "Forms and HubSpot CRM" above.

Subscription and confirmation

When you subscribe we process your email address and any further details you provide, such as your name, company and areas of interest. We also record the IP address and the date and time of your subscription and of your confirmation.

We use a double opt-in procedure: after you submit the form we send you an email asking you to confirm your subscription. If you do not confirm, the entry is deleted.

Legal basis: Art. 6(1)(a) GDPR. We keep the record of your consent in order to demonstrate that it was given (Art. 7(1) GDPR).

Success measurement

Our newsletters contain a small image file, known as a tracking pixel, which is retrieved from HubSpot's servers when you open the email. Links in the newsletter are routed through HubSpot's servers before forwarding you to the destination page.

This allows us to record:

  • whether, when and how often you opened a newsletter

  • which links you clicked and when

  • the email client and device type you used

  • your IP address and the approximate location derived from it

This information is linked to your individual subscriber record. It is therefore not anonymous: we can follow how a single subscriber engages with our newsletters over time, which amounts to a profile of your reading behaviour. We use it to measure how our newsletter performs and to make its content more relevant.

Legal basis: Art. 6(1)(a) GDPR. Your consent to this measurement is obtained together with your subscription; the subscription form states that success measurement is included.

Independently of any withdrawal, you can prevent open measurement yourself by setting your email program not to load external images automatically. This does not prevent click measurement, which relies on the link itself.

Withdrawal

You may withdraw your consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out beforehand.

To end the newsletter entirely, use the unsubscribe link in every newsletter or contact us using the details under "Controller and contact" above. We then remove your data from the mailing list, and the success measurement described above ends with it.

We keep the record of your consent and of its withdrawal for three years afterwards in order to defend against potential claims, then delete it.

Transfer to third countries

Some of the providers named above are affiliated with companies in the United States, so personal data may be transferred there.

For each such transfer we rely on one of the following:

  • an adequacy decision under Art. 45 GDPR. The European Commission adopted an adequacy decision for the EU-US Data Privacy Framework on 10 July 2023. Where a US recipient is certified under that framework, transfers to it are permitted on that basis. Certification status can be checked at https://www.dataprivacyframework.gov

  • standard contractual clauses under Art. 46(2)(c) GDPR, where the recipient is not certified, supplemented by a transfer impact assessment;

  • your explicit consent under Art. 49(1)(a) GDPR, where applicable.

Automated decision making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR in relation to visitors to this website.

Data security

This website uses TLS encryption for data in transit. You can recognise this by the https:// prefix and the padlock in your browser. We maintain appropriate technical and organisational measures under Art. 32 GDPR to protect your data against unauthorised access, loss and alteration.

Changes to the privacy policy

We update this policy when our processing changes or when the legal framework requires it. The version in force is the one published here. Last updated: see the top of this page.