Privacy & GDPR Center

1. Controller

CxLEVER, Cottbuser Strasse 13, 16227 Eberswalde (Brandenburg), Germany — Email: [email protected] (“we”).

2. Overview

We process personal data only in accordance with the GDPR and the German BDSG. Data processing takes place on EU-based infrastructure. We practice data minimisation: we collect only what is required for the stated purpose.

3. Data We Process, Purposes, and Legal Bases

a) Website visit (server logs). IP address, date/time, requested resource, user agent — processed to deliver the website securely. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation). Retention: 14 days.

b) Contact and audit application forms. Name, work email, company, role, and the information you provide — processed to respond to your request and prepare a proposal. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures). Retention: for as long as required to process your request, and thereafter only to the extent statutory retention periods apply.

c) Voice messages. If you record an audio message, the recording is used solely to generate a transcript of your request and is deleted immediately after transcription. It is not stored, not used for any other purpose, and not used to train AI systems. Legal basis: Art. 6(1)(b) GDPR.

d) Newsletter. Email address, processed on the basis of your consent (Art. 6(1)(a) GDPR, double opt-in); you may withdraw consent at any time via the unsubscribe link.

Measurement in the newsletter. We measure which links you click in our newsletters. The links are built so that your click first passes through a server operated by our processor HubSpot and is then forwarded to the actual destination. Using the _hsenc and _hsmi parameters in the address, we connect that click with your other visits to cxlever.io, which shows us which content is relevant to you. We do not measure whether or when you open an email; the tracking pixel normally used for that was switched off on 12 August 2026. Legal basis is your consent under Art. 6(1)(a) GDPR, and additionally § 25(1) TDDDG for accessing information stored on your device. You can withdraw it at any time via the unsubscribe link in every email or the preference page reachable from it, with effect for the future; the lawfulness of processing carried out until then is unaffected. Recipient is HubSpot Ireland Ltd. as a processor under Art. 28 GDPR.

e) Cookies and similar technologies. See our Cookie Policy. Technically necessary cookies: Art. 6(1)(f) GDPR / § 25(2) TDDDG. All other cookies only with consent: Art. 6(1)(a) GDPR / § 25(1) TDDDG.

f) Aggregate site analytics. We measure site usage with Cloudflare Web Analytics, a privacy-first measurement service by Cloudflare, Inc. It sets no cookies, stores nothing on your device, and does not identify individual visitors; we receive only aggregate data such as page views, referrers, countries, and performance metrics. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in understanding and improving our website).

g) Appointment booking. Our discovery-call page embeds the scheduling tool Cal.com (Cal.com, Inc., United States). The embed is loaded only after you consent to the corresponding cookie category; before that, no connection to Cal.com is established. When you book a slot, Cal.com processes the name, email address and any information you enter, together with the chosen time and time zone, in order to create the appointment and send the confirmations. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and, for the embed itself, Art. 6(1)(a) GDPR / § 25(1) TDDDG (consent). Transfers to the United States are safeguarded by EU Standard Contractual Clauses. Retention: for as long as required to document the appointment.

4. Recipients and Processors

We use carefully selected service providers bound by data processing agreements under Art. 28 GDPR: hosting by ALL-INKL.COM — Neue Medien Münnich (Germany); forms and CRM by HubSpot (EU data residency); email services by Google Workspace (for the cxlever.io and cxlever.co domains) and Microsoft 365 (for the cxlever.eu domain); appointment scheduling by Cal.com. Data is processed within the EU/EEA wherever possible. Where a transfer to third countries occurs, it is protected by an adequacy decision (including the EU–U.S. Data Privacy Framework) or EU Standard Contractual Clauses.

AI website assistant (chat). Our site offers an AI-powered chat assistant. Messages you send are processed to generate answers on our own EU-hosted automation server (n8n) and, for reply generation and — if you use voice input — speech transcription, may be forwarded to AI providers, in particular Google (Gemini) and OpenAI (with Anthropic as a fallback). These providers are based in the USA; any transfer is safeguarded by the EU–U.S. Data Privacy Framework and/or EU Standard Contractual Clauses. The conversation transcript is stored locally in your browser. If you ask the assistant to email you a copy of the conversation and provide your email address, the transcript and that address are processed on our server (via our EU database provider, Supabase) for the sole purpose of sending you the conversation, and are then retained only for the period stated in section 6. Any name, email, or company you choose to share is transferred to our CRM (HubSpot) only with your explicit in-chat consent (Art. 6(1)(a) GDPR); otherwise the exchange is based on our legitimate interest in answering your enquiry (Art. 6(1)(f) GDPR).

5. Web Fonts

This website uses the typeface “Outfit” (SIL Open Font License). The font files are hosted on our own server; no connection to Google or any other third-party font service takes place when you visit this site, and no data is transmitted to font providers.

6. Storage Periods

Newsletter click data: kept for the duration of your subscription and deleted at the latest 36 months after you unsubscribe, together with the contact record. The record of the unsubscription itself is kept indefinitely – it is what prevents you from being contacted again.

We store personal data only as long as necessary for the respective purpose or as required by statutory retention obligations (e.g., §§ 147 AO, 257 HGB), after which it is deleted.

7. Your Rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21 GDPR). Where processing is based on consent, you may withdraw it at any time with effect for the future. You also have the right to lodge a complaint with a supervisory authority — for us: the Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg (LDA Brandenburg).

8. Obligation to Provide Data

Providing data via our forms is voluntary; without it, we may not be able to process your request.

9. Changes

We adapt this privacy notice when the legal situation or our services change. Version: 16.06.2026.