Privacy information
Information pursuant to Art. 13 and Art. 14 GDPR on the processing of your personal data by DeepMask GmbH. Here you will find all key information on our data protection practices, your rights and our contact details.
Table of contents
Introduction
Thank you for your interest in our website. Data protection and the protection of your personal data are very important to us. Below you will find information on how we handle the data collected through your use of our website, and on data protection in general. Your data is processed in accordance with the statutory data protection rules.
Your data is always processed in accordance with the applicable data protection provisions, in particular the GDPR, the German Federal Data Protection Act (BDSG) and, where relevant, other applicable statutory provisions.
Contact details of the controller
DeepMask GmbH
Widenmayerstraße 18
80538 Munich, Germany
Managing directors
Hissan Usmani
Ralph J. Huuk
Noor Jafri
Contact
Phone: +49 173 7145653
Email: contact@deepmask.io
Data protection officer
Maxim Ciebiera
DATATINO
Raintalerstr. 23
81539 Munich, Germany
External data protection officer of DeepMask GmbH
Competent supervisory authority
Bavarian State Office for Data Protection Supervision (BayLDA)
Under Art. 77 GDPR you have the right to lodge a complaint with a supervisory authority about the processing of your personal data. The authority named above is competent for DeepMask GmbH; alternatively you may contact the supervisory authority of your habitual residence or place of work.
Registering and using the trial access
Purpose of the processing
Setting up your user account and activating a free trial period or paid access. We process your name, your email address and your company name, together with the IP address of the device used to register and the time of registration. The latter two serve to evidence that the registration was actually initiated by you and to prevent abusive multiple registrations.
Legal basis
The processing is based on Art. 6(1)(b) GDPR – it is necessary in order to take steps at your request prior to entering into a contract and to perform the user agreement. The processing of the IP address and the time of registration is additionally based on Art. 6(1)(f) GDPR; our legitimate interest lies in evidencing the registration and preventing misuse.
Storage period
The data is stored until your account is deleted. Where a trial access remains unused, we delete the account once the trial period has expired. Statutory retention obligations remain unaffected.
Recipients of the data
STACKIT (Schwarz Digits KG), Neckarsulm – operation of the platform. Providers of email delivery services for confirming the registration.
Use of the DeepMask platform
Purpose of the processing
Provision and operation of the DeepMask platform: creating and managing your account, storing your chats, projects and uploaded files, managing teams and permissions, and analysing usage for billing and capacity planning.
Legal basis
The processing is based on Art. 6(1)(b) GDPR — it is necessary for the performance of the usage agreement. Where you use the platform as an employee of a corporate customer, we process the content data as a processor under Art. 28 GDPR on behalf of your employer.
Retention period
Chats, projects and files remain stored until you delete them or the contract ends. After the contract ends, data is deleted unless statutory retention obligations apply. Technical logs are deleted automatically after seven days.
Recipients of the data
STACKIT (Schwarz Digits KG), Neckarsulm — operation of the platform in a sovereign German cloud. The complete list of all subprocessors is available in the Trust Center.
Processing by AI models
Purpose of the processing
Answering your inputs using the AI model you select. Only the content of your request and the associated conversation context are transmitted — no account master data. Your inputs and the generated responses are not used to train AI models; they are not retained at the model providers beyond answering them.
Legal basis
The processing is based on Art. 6(1)(b) GDPR — it is necessary for the performance of the usage agreement, since the model response is the main contractual service.
Retention period
Transmission takes place solely for the duration of the response. The conversation history is stored in the platform and can be deleted at any time.
Recipients of the data
Depending on the model selected: STACKIT and Infercom (Germany/EU), Amazon Web Services EMEA SARL — Amazon Bedrock (EU), Google Cloud EMEA Limited (Ireland), Mistral AI SAS (France) and Microsoft (EU/US, safeguarded by EU standard contractual clauses and the EU-US Data Privacy Framework).
AI-assisted web search
Purpose of the processing
Real-time research with source citations. Web search is an optional feature: it is only active if you explicitly switch it on in the chat. In that case, only the search query is transmitted.
Legal basis
The processing is based on Art. 6(1)(b) GDPR — it is necessary to provide the function you requested.
Retention period
The search query is processed only for the duration of the research.
Recipients of the data
Perplexity AI, Inc., United States — safeguarded via the EU-US Data Privacy Framework.
Taking out and paying for a subscription
Purpose of the processing
Handling the paid subscription you have taken out: recording the order, issuing invoices, collecting payment, posting to the financial accounts and, where necessary, dunning and enforcement of outstanding claims. We process your company name, billing address, contact and business details, VAT identification number, the subscription selected, any voucher codes redeemed and payment details, together with the IP address of the device used to place the order and the time of the order.
Legal basis
The processing is based on Art. 6(1)(b) GDPR – it is necessary in order to perform the contract concluded with you. For the retention of invoices and accounting records, Art. 6(1)(c) GDPR applies in addition; we are required to retain them under § 147 AO and § 257 HGB. Dunning and enforcement proceedings are additionally based on Art. 6(1)(f) GDPR; our legitimate interest lies in enforcing legitimate claims.
Storage period
Invoices and accounting records are retained for ten years, calculated from the end of the calendar year in which the record was created (§ 147(3) AO, § 257(4) HGB). Beyond that, payment details are stored only for as long as they are needed for recurring debits; storage at the payment service providers engaged is governed by their own rules.
Recipients of the data
Payment service providers and credit institutions engaged by us, providers of invoicing and accounting software, tax advisers and, in the event of enforcement, lawyers and debt collection agencies. We disclose data to tax authorities where we are required to do so by law.
Protecting the platform against misuse
Purpose of the processing
Detecting and preventing abusive use of the platform: limiting the request frequency per account, detecting automated bulk access, defending against attacks on our systems and enforcing our Fair Usage Policy. Only technical metadata is evaluated – in particular the account identifier, time, number and size of requests and the IP address. The content of your chats, projects or files is not evaluated in this context.
Legal basis
The processing is based on Art. 6(1)(f) GDPR – our legitimate interest lies in the availability and security of the platform for all users and in preventing damage caused by abusive use. Where measures serve to enforce the user agreement, Art. 6(1)(b) GDPR applies in addition.
Storage period
Technical logs are deleted automatically after seven days. Where a specific case of misuse is identified, we store the associated data until the case has been conclusively resolved and, where claims are at issue, until those claims become time-barred.
Recipients of the data
STACKIT (Schwarz Digits KG), Neckarsulm – operation of the platform. IT service providers in the course of system administration.
Appointment booking and video meetings
Purpose of the processing
Arranging and holding demo and sales appointments. We process name, email address, appointment time and — during the video meeting — video, audio and chat data.
Legal basis
The processing is based on Art. 6(1)(a) GDPR — your consent, given when you book, and on Art. 6(1)(b) GDPR for pre-contractual measures.
Retention period
Appointment data is deleted once the appointment has taken place and the enquiry has been handled, and at the latest once statutory retention periods expire. Video meetings are not recorded.
Recipients of the data
Cal.com, Inc., United States and Google Ireland Limited (Google Meet), Ireland — each safeguarded via EU standard contractual clauses and the EU-US Data Privacy Framework.
Working with us during the contract term
Purpose of the processing
Looking after you for the duration of the contract: setup and onboarding, training and user workshops, review and status meetings, answering commercial and organisational queries, and informing you about changes to the scope of services. Depending on the occasion, communication takes place by email, telephone or video meeting. We process your name, your business contact details, your role within the company and the content of the communication, and in video meetings additionally video, audio and chat data.
Legal basis
The processing is based on Art. 6(1)(b) GDPR – this support forms part of the services owed under the contract. If you are not the contracting party yourself but act for a company that has concluded the contract with us, we base the processing of your business contact details on Art. 6(1)(f) GDPR; our legitimate interest lies in performing the contractual relationship with your employer.
Storage period
The data is stored for the duration of the contractual relationship and thereafter for as long as queries are to be expected or claims arising from the contractual relationship may be asserted. Video meetings are not recorded.
Recipients of the data
Google Ireland Limited (Google Meet), Ireland – safeguarded by EU standard contractual clauses and the EU-US Data Privacy Framework. Providers of email and CRM software.
Visiting our website
Purpose of the processing
Your personal data is processed in order to provide the website, ensure its security and stability, analyse technical problems and improve the user experience.
Legal basis
The processing is based on Art. 6(1)(f) GDPR — our legitimate interest lies in the secure, stable and efficient operation of the website.
Retention period
Your data is stored for the duration of your visit to the website and beyond that for as long as is necessary to achieve the purposes. In some cases data is retained for evidentiary purposes for up to 4 years.
Recipients of the data
Web hosting providers, IT service providers.
Accessing third-party content on our website
Purpose of the processing
On individual pages we embed content provided by third parties – for example videos from YouTube and posts from LinkedIn. If you open a page containing such content and have previously given your consent, your browser establishes a direct connection to the servers of the respective provider. In doing so, your IP address and the information as to which of our pages you have opened are transmitted to the provider. If you are also logged into your user account there, the provider can attribute the access to your account. We have no influence over the extent to which the provider uses this data or what it uses it for.
Legal basis
The processing is based on § 25(1) TDDDG and Art. 6(1)(a) GDPR – your consent, which you give via the consent dialogue. Without your consent the content is not loaded and no connection to the providers is established. You may withdraw your consent at any time with effect for the future. We log your decision in order to be able to demonstrate the consent pursuant to Art. 5(2) GDPR.
Storage period
Your decision made in the consent dialogue is stored for as long as the consent remains valid and beyond that in order to evidence it. How long the providers store the data arising on their side is determined by them independently; we have no influence over this.
Recipients of the data
Google Ireland Limited (YouTube), Ireland and LinkedIn Ireland Unlimited Company, Ireland. Transfer to their respective US parent companies cannot be ruled out; it is safeguarded by EU standard contractual clauses and the EU-US Data Privacy Framework.
Getting in touch
Purpose of the processing
Your personal data is processed in order to answer your enquiries by email or via the contact form. This concerns in particular handling your requests, communicating with you and providing relevant information or support.
Legal basis
The processing is based on Art. 6(1)(b) alt. 2 GDPR — the processing is necessary to answer your enquiries and to carry out pre-contractual measures.
Retention period
The data is stored for the duration of the communication and thereafter, where necessary, archived for up to 10 years within the scope of tax and commercial retention obligations.
Recipients of the data
Form software providers, CRM service providers, email service providers, communication software providers, providers of online appointment booking.
Submitting support requests
Purpose of the processing
Your personal data is processed in order to handle your support requests efficiently and to help you with technical or other matters. We record the information you provide, analyse the request and communicate with you in order to provide solutions. The data may also be used to improve our support service and to better understand common problem cases.
Legal basis
The processing is based on Art. 6(1)(f) GDPR — our legitimate interest lies in providing high-quality support and optimising our services.
Retention period
The data is stored for the duration of processing the request and archived for documentation and analysis of support cases where necessary, and beyond that for follow-up and analysis, within the statutory retention periods for up to 10 years.
Recipients of the data
Support software providers, IT service providers.
Receiving marketing emails as an existing customer
Purpose of the processing
Informing customers who have already obtained services from us about our own offerings that are similar to those services – for example new features, available models or plans – by email. In addition, we check the technical validity of the email addresses on file in order to avoid failed deliveries.
Legal basis
The processing is based on Art. 6(1)(f) GDPR in conjunction with § 7(3) UWG – our legitimate interest lies in advertising our own similar services to existing customers. You may object to the use of your email address for advertising purposes at any time, at no cost other than transmission costs at base rates – via the unsubscribe link in every email or informally to contact@deepmask.io. We point out this right in every message we send.
Storage period
The processing takes place until you object. Following an objection we add your email address to a suppression list in order to ensure that you receive no further advertising; this storage is based on Art. 6(1)(c) GDPR.
Recipients of the data
Providers of email delivery and CRM software.
Taking part in our partner programme
Purpose of the processing
Administering and handling your participation in our partner programme: admission to the programme, attribution of the contracts concluded through you, calculation and settlement of your remuneration and its payout. We process your name, your email address and postal address, your bank details and the referral and settlement data.
Legal basis
The processing is based on Art. 6(1)(b) GDPR – it is necessary in order to perform the partnership agreement concluded with you. For the retention of settlement records, Art. 6(1)(c) GDPR applies in addition (§ 147 AO, § 257 HGB).
Storage period
The data is stored for the duration of the partnership. Settlement records are retained for ten years (§ 147(3) AO, § 257(4) HGB). We delete your bank details after the final payout, unless they form part of records subject to retention obligations.
Recipients of the data
Credit institutions for the payout, providers of accounting software, tax advisers.
Operating social media presences - LinkedIn
Purpose of the processing
Your data is processed in the context of our LinkedIn presence in order to communicate with users and prospective customers, share information about our company and respond to questions. We also use statistical analyses to measure our reach and interactions on the platform.
Legal basis
The processing is based on Art. 6(1)(f) GDPR — our legitimate interest lies in public relations and communication with users.
Retention period
The data is stored in accordance with LinkedIn's provisions.
Recipients of the data
LinkedIn Ireland Unlimited Company.
Submitting job applications
Purpose of the processing
Your data is used to carry out the application procedure. This includes assessing your suitability, managing and evaluating your documents and communicating with you during the procedure. If your application is successful, your data is used to prepare an employment relationship.
Legal basis
The processing is based on Art. 6(1)(b) alt. 2 GDPR in conjunction with Section 26(1) sentence 1 BDSG — the processing is necessary to carry out the application procedure.
Retention period
Your data is stored until the application procedure is completed and, if your application is rejected, for a maximum of 6 months, unless you have given further consent.
Recipients of the data
HR management service providers, email service providers, communication software providers.
Your rights
Your rights in relation to personal data
Below you will find information on the data subject rights that applicable data protection law grants you vis-à-vis the controller with regard to the processing of your personal data:
Right of access
The right to request information pursuant to Art. 15 GDPR about the personal data we process about you. In particular, you may request information about the purposes of the processing, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the envisaged storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the origin of your data where it was not collected by us, and the existence of automated decision-making including profiling and, where applicable, meaningful information about the details thereof.
Right to rectification
The right to request, pursuant to Art. 16 GDPR, the immediate rectification of inaccurate personal data stored by us or the completion of your personal data.
Right to erasure
The right to request, pursuant to Art. 17 GDPR, the erasure of your personal data stored by us, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims.
Right to restriction of processing
The right to request, pursuant to Art. 18 GDPR, the restriction of the processing of your personal data where you contest the accuracy of the data, where the processing is unlawful but you oppose erasure, where we no longer need the data but you require it for the establishment, exercise or defence of legal claims, or where you have objected to the processing pursuant to Art. 21 GDPR.
Right to data portability
The right, pursuant to Art. 20 GDPR, to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, or to request its transmission to another controller.
Right to lodge a complaint
The right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR. As a rule, you can contact the supervisory authority of the federal state of our registered office stated above or, where applicable, that of your habitual residence or place of work.
Right of withdrawal
The right to withdraw consent given pursuant to Art. 7(3) GDPR: you have the right to withdraw consent to the processing of data at any time with effect for the future. In the event of withdrawal we will erase the data concerned without undue delay, unless further processing can be based on a legal ground that does not require consent. Withdrawing consent does not affect the lawfulness of the processing carried out on the basis of the consent up to the point of withdrawal.
Right to object
Where your personal data is processed by us on the basis of legitimate interests pursuant to Art. 6(1) sentence 1(f) GDPR, you have the right under Art. 21 GDPR to object to the processing of your personal data on grounds relating to your particular situation. Where the objection is directed against the processing of personal data for direct marketing purposes, you have a general right to object without having to state a particular situation.
Right of complaint
You have the right to complain to a data protection supervisory authority about our processing of your personal data. The competent supervisory authority is generally that of the federal state in which our company has its registered office, or that of your habitual residence.
How to exercise your rights
If you would like to exercise your rights or lodge a complaint, please use the controller's email address for this purpose.