Privacy Policy

Who we are

otonit is operated by İlhan Berk Duran (Einzelunternehmen), Maxstraße 24a, 67133 Maxdorf, Germany — the controller for personal data processed through this website. Full provider details are on our Impressum page. For any privacy request, email info@otonit.com.

No data protection officer has been appointed, as neither Art. 37 GDPR nor § 38 BDSG (as a rule, at least 20 persons permanently engaged in the automated processing of personal data) requires one. Please direct privacy requests to info@otonit.com.

What we collect

Contact form: the name, work email, company and message you submit, so we can answer your enquiry. In addition, we store with your enquiry the origin tag of the link that brought you to us (if any, see “Cookies and local storage”) and — for enquiries made through the AI chat — the chat transcript, so we know the context of your enquiry.

Playbook download: the name and work email you submit to unlock our free playbook PDF. We use them to provide the download and may reply once about it — based on your consent (Art. 6(1)(a) GDPR). No newsletter, no recurring emails.

Server logs: when your browser loads the site, our hosting provider processes technical data such as your IP address, the page requested, referrer, browser and device type and a timestamp. This is standard for operating and securing a website.

Direct outreach to businesses (cold outreach)

We contact businesses in the DACH region by email to introduce our AI-automation services. For this we process business contact data (company name, industry, city, business email address and, where applicable, a contact person's name) that we collect from publicly available sources such as the imprint or the company website. Sending is done from the domain getotonit.com.

The legal basis for the processing is our legitimate interest in acquiring business customers (Art. 6(1)(f) GDPR); sending advertising email is additionally governed by § 7 of the German UWG.

You may object to the processing of your data for advertising purposes at any time (Art. 21 GDPR) — for example by replying with “Abmelden” (unsubscribe) or a message to info@otonit.com. We will then remove your data promptly and add your address to a permanent suppression list.

Contact data from direct outreach is stored for at most 12 months from the last contact unless a business relationship arises; a declared objection is retained permanently. We use the processors listed below to carry this out (including AI-assisted drafting and delivery).

Cookies and local storage

This site sets one technically necessary cookie, “NEXT_LOCALE”, which remembers your chosen language when you switch it manually. It holds only the language code, is a session cookie (deleted when you close your browser) and is permitted without consent under § 25 (2) no. 2 TDDDG.

In addition, we store in your browser's session storage (sessionStorage) a few technical entries that are necessary for the functions you request (§ 25 (2) no. 2 TDDDG): “otonit-lead-context” (pre-filling the contact form with the task you picked in the problem solver), “otonit-exit-shown”, “otonit-sticky-dismissed” and “otonit-desktopcta-dismissed” (hints already dismissed) and “otonit-src” (the origin tag of a link carrying the “src” parameter, for example from an email we sent you; it is processed only if you submit an enquiry and is then stored as part of that enquiry). These entries are deleted when the browser tab is closed and are not transmitted to third parties.

We do not use advertising, analytics or tracking cookies. If we add any in future (see “Tools we may add”), we will ask for your consent first through a cookie banner.

Web analytics (Vercel Web Analytics)

We use Vercel Web Analytics to understand how the site is used in aggregate — for example page views, referrers, approximate country and device type. It is privacy-friendly by design and cookieless: it sets no cookies, stores no persistent identifier on your device, and does not track you across other websites. The data is aggregated and is not used to identify you.

This rests on our legitimate interest in understanding and improving how the site performs (Art. 6(1)(f) GDPR). Because no cookies or device fingerprinting are used, § 25 TDDDG does not apply, as no information is stored on or accessed in your device; a consent banner is therefore not required. Vercel Inc. (USA) processes this data on our behalf; any transfer to the USA is safeguarded as described under “International data transfers”.

Why we process your data, and the legal basis

Contact enquiries are processed to respond to you and take steps toward a possible contract (Art. 6(1)(b) GDPR). Operating and securing the site, and answering general messages, rest on our legitimate interest (Art. 6(1)(f) GDPR). Where we ask for your consent — for example optional cookies — the basis is Art. 6(1)(a) GDPR.

Service providers (processors)

A small number of providers process data on our behalf under data-processing agreements (Art. 28 GDPR), receiving only what is necessary. We distinguish by purpose:

Website and contact enquiries — Hosting and delivery: Vercel Inc., USA (hosts the site, processes server logs). Lead storage: Airtable Inc., USA (stores and manages incoming enquiries). Internal sales database: a copy of your enquiry is kept on our own server hosted by Hetzner Online GmbH, Germany (processed solely by us; Hetzner provides the infrastructure only). Enquiry notification: your enquiry is delivered to us by email through Google (Gmail; Google Ireland Ltd / Google LLC, USA); an optional email backup channel (Resend, Inc., USA) may be used. AI chat: Anthropic PBC, USA (processes your input in the optional chat assistant, see “AI chat assistant”).

Direct outreach to businesses (see above) — Research: Google (Google Ireland Ltd / Google LLC, USA) via the Google Places interface to identify publicly listed business data. Text generation: Anthropic PBC, USA (AI-assisted drafting of the outreach emails; the salutation is processed as a placeholder — the contact person's name is not transmitted to the AI provider). Sending: Google Workspace (Gmail) via the domain getotonit.com. Management and block list: Airtable Inc., USA. Execution: Modal Labs Inc., USA (serverless processing solely for these processes; it does not concern contact-form enquiries).

Not a processor — internal instant notification: Telegram FZ-LLC (Dubai, UAE) receives merely a hint that an enquiry has arrived, without any personal data; a data processing agreement is therefore not required. The same applies to internal alerts from our direct outreach.

We choose providers carefully, keep this list current, and add no recipient beyond what is needed to answer you.

International data transfers

Some providers above are located in or process data in the USA. Where personal data is transferred to the USA, we rely on the European Commission’s adequacy decision for the EU–US Data Privacy Framework (Art. 45 GDPR) where the respective provider is certified under it; otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) with supplementary measures. No personal data is transferred to Telegram FZ-LLC (UAE). You can request detail on these safeguards at info@otonit.com.

How long we keep your data

Contact enquiries: kept while we handle your request and any follow-up, and for up to 6 months afterwards — unless a business relationship or a legal retention obligation requires longer.

Server logs: retained by our hosting provider for a limited period for security and operation, then deleted or anonymised.

No automated decision-making

We do not use your personal data for automated decision-making or profiling within the meaning of Art. 22 GDPR.

Tools we may add

As the business grows we may add tools such as a scheduling service (e.g. Calendly), a CRM or newsletter, or additional AI providers used to process enquiries. Before any such tool processes your data we will update this policy with the provider, purpose and legal basis and — where required — obtain your consent first.

Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection regarding your personal data, and to withdraw any consent at any time with future effect. You also have the right to lodge a complaint with a data-protection supervisory authority — for us, the competent authority in Rhineland-Palatinate, Germany.

AI chat assistant

Our website offers an optional AI chat assistant. If you use it, the messages you type are sent to our AI provider, Anthropic (Anthropic PBC, USA), to generate a reply, and are processed on our legitimate interest in answering your questions (Art. 6(1)(f) GDPR). Please do not enter sensitive personal data in the chat. If you additionally submit your name and email through the chat, they are handled like a contact-form enquiry. Because Anthropic is based in the USA, this involves a transfer to a third country, safeguarded as described under “International data transfers” (adequacy decision for the EU–US Data Privacy Framework where the provider is certified, otherwise EU Standard Contractual Clauses).

Contact

To exercise any right or ask about this policy, email info@otonit.com.