Privacy policy

The controller responsible for the processing of personal data on this website, in the platform “Mein goetz_” and in the context of our services is:

goetz UG (haftungsbeschränkt)
Mannheimer Weg 49, 40229 Düsseldorf, Germany
Represented by: Hendrik Goetzendorff
Email: info@goetzcompany.com
Telephone: +49 211 69535250

We have not appointed a data protection officer because the statutory requirements (§ 38 BDSG (German Federal Data Protection Act), Art. 37 GDPR) are not met. For all questions regarding data protection, you can reach us at info@goetzcompany.com.

This Privacy Policy explains which personal data we process, for what purpose, on what legal basis and for how long. It applies to the website at goetzcompany.com, to the platform “Mein goetz_” (customer account, questionnaire, creation of brand and website, ordering and customer area) and to the processing that arises in connection with our services Brand, Web, Host, Grow, App Development and Agentic AI.

Principles that apply to everything that follows:

• The website uses no cookies and no analytics or advertising trackers. Fonts and videos are hosted on our own server.
• The platform, our customers' websites and our backups run on servers in Germany.
• To create brand profiles, logos, texts and website drafts, we use AI services from Anthropic and fal.ai. These process the company and brand details required for this purpose, including in the USA. They never receive payment data. Details are set out in section 8.
• We do not make automated decisions within the meaning of Art. 22 GDPR.

Where we process your data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you have the right to object to the processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where your data is processed for direct marketing, you may object at any time without giving reasons (Art. 21(2) GDPR). Please send your objection to info@goetzcompany.com.

We process personal data only where one of the following legal bases applies:

• Art. 6(1)(b) GDPR: for the performance of a contract with you or in order to take steps at your request prior to entering into a contract.
• Art. 6(1)(c) GDPR: for compliance with legal obligations, for example retention obligations under commercial and tax law.
• Art. 6(1)(f) GDPR: for the purposes of legitimate interests, for example in the secure operation of our systems, the prevention of misuse and the assertion of claims.
• Art. 6(1)(a) GDPR: on the basis of your consent, which you may withdraw at any time with effect for the future.
• § 25 TDDDG (German Telecommunications Digital Services Data Protection Act) for the storage of information on your terminal equipment or access to it.

Where we process personal data on behalf of our customers (section 13), the respective customer is the controller and we are the processor under Art. 28 GDPR.

Hosting and server logs

The website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in data centres in Germany. When you access it, the server automatically processes access data: IP address, date and time, page or file accessed, volume of data transferred, status code, browser type and version, operating system and the previously visited page (referrer). This data is necessary to deliver the website and serves the security and stability of operation (Art. 6(1)(f) GDPR). Server logs are deleted after 14 days unless a security incident requires longer retention. A data processing agreement is in place with the hosting provider.

Language selection in the browser

The website is available in German and English. The home page detects your browser language and redirects you to the appropriate version. The website stores the language you last viewed in your browser's local storage (key “goetz-lang”) so that you see the same language on your next visit. This entry is technically necessary to provide the language you have requested (§ 25(2) no. 2 TDDDG); it contains only the language code, is not transmitted to us and can be deleted at any time in your browser settings.

No cookies, no analytics

The website uses no cookies and does not integrate any analytics, tracking or advertising services. Fonts (Inter, Space Grotesk, Manrope) and videos are hosted on our own server; no connection to third-party servers is established when the page loads. Links to external websites (for example klimaflex24.de) take you to the offerings of other providers, who are responsible for their own data processing.

The website's forms do not send any data to a server. When you submit a form, your browser prepares an email containing your details (name, email address, company, telephone, desired product, message), which you send to us via your own email program. We receive this data only once it is sent.

We process your details in order to answer your enquiry and, if you wish, to prepare a quotation (Art. 6(1)(b) GDPR; for general enquiries, Art. 6(1)(f) GDPR, our interest in responding). The same applies if you contact us directly by email or telephone. We delete enquiries that do not result in a contract no later than twelve months after the last communication; if a contract is concluded, the periods in section 18 apply.

Our email mailboxes are hosted by Heinlein Hosting GmbH (mailbox.org), Schwedter Straße 8/9a, 10119 Berlin, Germany. Emails are encrypted in transit (TLS); please do not send us particularly sensitive data by unencrypted email.

Account and login

To use the platform, you create a customer account with your name and email address. Login takes place without a password via a link that we send to your email address; the link is valid for 15 minutes and is stored by us only as a checksum. A login remains valid for 30 days. For each session, we store the IP address and browser identifier in order to detect misuse, and we limit the number of login requests per period. The legal basis is Art. 6(1)(b) GDPR (contract for the account) and Art. 6(1)(f) GDPR (security).

Questionnaire, projects and orders

In the platform, you enter details about your company and your brand: company name, sector, location, website, services, target customers, competitors, values, design preferences and, for Web, the content of your website (texts, images, contact details, legal notice details, privacy text). We process this data in order to create the brand profile, logo drafts, CI package and website and to make them available to you in the customer area (Art. 6(1)(b) GDPR). We store orders, invoicing details (company, address, VAT identification number) and payment events for the performance of the contract and for accounting purposes (Art. 6(1)(b) and (c) GDPR).

The platform keeps a log of legally relevant declarations (for example your confirmation that you are acting as an entrepreneur, approvals of drafts and websites) with timestamps. This log serves as evidence of the content of the contract (Art. 6(1)(b) and (f) GDPR) and is retained for the duration of the limitation period for contractual claims.

Support and AI assistant

You send us questions and requests via Support in the customer area, each with a topic and a subject. We store the messages with time and sender. An AI assistant ("goetz_AI Assistant"), which is labelled as AI and identifies itself as AI, answers first. For this it receives your message, the previous conversation and the details from your account needed for the answer: projects and their status, package and quota, availability of your website, domains and the list of your invoices. It does not receive payment data. The assistant uses Anthropic's language models (section 8). At your request, or where the assistant cannot answer reliably, an employee takes over; for quality assurance we also read samples of the assistant's answers. The legal basis is Art. 6(1)(b) GDPR (contract), and for the samples Art. 6(1)(f) GDPR (our interest in correct answers).

Deletion of the account

You can delete your account at any time in the customer area or by email. We then delete the account, projects and drafts. We retain order and invoicing data for as long as statutory retention periods run (section 18); current contracts remain unaffected.

To create brand profiles, logo drafts, texts, website drafts and checks, we use generative AI systems. The services receive only the details necessary for the respective task: your company and brand details from the questionnaire, your texts and bullet points, the logo and, for figurative marks, the design specifications. Payment data, login data and third-party data not relevant to the task are not transmitted. The legal basis is Art. 6(1)(b) GDPR; the services act as our processors under Art. 28 GDPR.

Anthropic (language models)

For brand profiles, texts, website drafts, corrections, changes by AI instruction, the answers of the AI assistant in the customer area and automated checks, we use Anthropic's Claude models. Anthropic receives analyses of the operation of your website only in aggregated form, without IP addresses or other data of individual visitors. Our contractual partner is Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, Ireland; processing is carried out by Anthropic, PBC in the USA. Anthropic does not use inputs and outputs to train its models and, according to the provider, deletes them within 30 days; where there are indications of misuse, Anthropic may retain content for up to two years. Anthropic is not certified under the EU-US Data Privacy Framework; the transfer to the USA is based on the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914) and a transfer impact assessment documented by us. Privacy notice: anthropic.com/legal/privacy.

To create the brand profile, the system may retrieve and analyse publicly available information about your company, your existing website, your competitors and your sector from the internet. Only the names and addresses you have provided are used as search terms.

fal.ai (image and vector models)

We generate figurative marks, previews and, for Agentic AI, images and short videos via the fal.ai platform operated by Features & Labels Inc., San Francisco, USA. Design specifications and, for variants, the logo as an image file are transmitted. We have disabled the storage of requests on the platform; we delete generated files there once they have been transferred to our systems. fal.ai is not certified under the EU-US Data Privacy Framework; the transfer is based on the European Commission's standard contractual clauses in the provider's data processing agreement. Privacy notice: fal.ai/privacy.

Labelling and decisions

Where technically available, we mark AI-generated images and logos with machine-readable provenance information (C2PA). In our processes, AI systems do not make decisions that produce legal effects concerning you or similarly significantly affect you; results are selected and approved by you. Where an AI system communicates with you directly, it identifies itself as AI.

You pay for Brand, Web, their digital add-on options and Host via Stripe Managed Payments. In this arrangement, Stripe acts towards you as the Merchant of Record under the brand “Link”: the payment page, payment receipts, invoices, refunds and payment enquiries are handled by Stripe or Link; your bank statement shows “LINK.COM*”. The provider is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, together with Stripe Technology Europe, Limited (payment processing) and Stripe, Inc. and Stripe, LLC in the USA. Stripe processes your payment data (card, Apple Pay, Google Pay or Link), name, email address, billing address, order and amount as an independent controller for payment processing, invoicing, the calculation and remittance of VAT, fraud prevention and compliance with its own legal obligations; details are set out in Stripe's privacy policy at stripe.com/privacy and in the Link notices at link.com. We do not receive full card details, but rather the order, amount, billing address, payment status and a transaction identifier, in order to provide and account for the service (Art. 6(1)(b) and (c) GDPR). If you create a Link account when paying, Link's terms and privacy notices apply to it; you can manage orders, subscriptions and payment methods there and request the deletion of your data held by Stripe. Stripe, LLC is certified under the EU-US Data Privacy Framework; standard contractual clauses apply in addition.

We invoice Grow, projects and services involving personal effort ourselves; your payment by bank transfer is then processed by our bank.

We send login links, confirmations of your order, contract documents, project status updates, confirmations of termination and invoices by email via our mailbox at Heinlein Hosting GmbH (mailbox.org), Schwedter Straße 8/9a, 10119 Berlin, Germany (Art. 6(1)(b) GDPR). We send marketing emails only with your consent or, to existing customers, for our own similar services pursuant to § 7(3) UWG (German Act against Unfair Competition); you can object to further receipt in every such email.

The platform, its database, the uploaded files and the websites of our customers that we operate run on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in data centres in Germany. Hetzner is our processor under Art. 28 GDPR. Backups are created daily, stored in encrypted form and overwritten after 30 days. We process access data for the platform (server logs) as described in section 5.

Our customers' websites operated via Host use visitor statistics without cookies and without a script in the browser: the web server logs requests only with a shortened IP address (IPv4 without the last byte, IPv6 shortened to the first 48 bits) and without cookies. From these logs we count page views, visitors, sources (referrer) and pages viewed. So that a visitor counts only once per day, we derive a one-way key from the date, the shortened address and the browser identifier, which we delete the following day; there is no recognition across days. Only aggregated figures per day are stored permanently; the controller for data processing on these websites is the respective customer as operator.

We register domains in the context of Host via our registrar, INWX GmbH, Prinzessinnenstraße 30, 10969 Berlin, in our own name and in trust for you. As a rule, therefore, only our details are transmitted to the registry (for .de domains, DENIC eG, Kaiserstraße 75–77, 60329 Frankfurt am Main; for other extensions, the respective registry in accordance with ICANN rules). We store your details as the user of the domain (name, company, address, email address, telephone number) in the customer area and pass them on if the registry or a third party with a legitimate interest requests information about the user, if you have the domain transferred to you or if you switch to another provider (Art. 6(1)(b) and (f) GDPR). Registries verify the accuracy of holder data and may display it in lookup services (Whois, RDAP) to the extent their rules so provide; DENIC does not display holder data publicly. Registries outside the EU process data under their own provisions.

For Host, Grow, the operation of software from App Development and Agentic AI, we process personal data entrusted to us by our customers: data of visitors to their websites, enquiries from forms, mailboxes, conversion data from advertising campaigns, receipts, invoice and bank data, customer data, and enquiries from email, chat and social media channels. The controller for this data is the respective customer; we process it as a processor on the basis of an agreement under Art. 28 GDPR (Annex 1 to our GTC) and exclusively in accordance with the customer's instructions. If, as a customer, supplier or visitor of one of our customers, you wish to request access to or deletion of your data, please contact that customer; we support them in responding.

For these services, we use the sub-processors named in the data processing agreement: Hetzner Online GmbH (servers), INWX GmbH (domains), Heinlein Hosting GmbH (mailboxes, mailbox.org), Anthropic Ireland, Limited (language models), Features & Labels Inc. (image and video models), for Grow Google Ireland Limited (Google Ads) and OpenAI Ireland Ltd (ChatGPT Ads), and for social media agents Meta Platforms Ireland Limited (Instagram and Facebook). Advertising accounts with Google and OpenAI and social media accounts are held in the customer's name; the platforms process data there under their own provisions.

AI agents used in our customers' customer support identify themselves to users as AI. They do not make decisions with legal effect concerning the data subjects; such decisions remain reserved to humans at the respective customer.

To bill our services, we process name, company, address, VAT identification number, invoicing and payment data. This data is entered into our own accounting software, which we operate on our servers in Germany, and passed to our bank, our tax advisers and, where required by law, the tax authorities. The legal basis is Art. 6(1)(b) and (c) GDPR (§ 147 AO (German Fiscal Code), § 257 HGB (German Commercial Code), § 14b UStG (German VAT Act)). We retain invoices and accounting records for eight years and books and annual financial statements for ten years, in each case from the end of the calendar year in which they were created.

We accept notices of termination and other declarations concerning your contract by email, in the customer area and, for Host, via your Link account. In doing so, we process name, email address, contract identifier, type and requested effective date of the declaration, and the date and time of receipt, in order to process the declaration and send you a confirmation (Art. 6(1)(b) GDPR). We retain the declarations for the duration of the limitation period for contractual claims.

Where we operate our own pages on Instagram and Facebook (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland) or LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland), we process your messages, comments and reactions there in order to communicate with you and inform you about our services (Art. 6(1)(f) GDPR). The platforms process your data as independent controllers under their own provisions, including in the USA; Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework. For the statistics the platforms provide to us about page visitors (“Insights”), we are joint controllers with the platform (Art. 26 GDPR); the relevant agreements can be found at facebook.com/legal/terms/page_controller_addendum and legal.linkedin.com/pages-joint-controller-addendum. You may exercise your rights against us and against the respective platform.

We process job applications we receive for the purpose of conducting the application procedure (Art. 6(1)(b) GDPR, § 26 BDSG). If no employment relationship is established, we delete the documents six months after the procedure has been completed, unless you consent to longer retention.

We process the contact details of contact persons at suppliers, partners and service providers for the purpose of managing the business relationship (Art. 6(1)(b) and (f) GDPR) and retain them for as long as the relationship exists and statutory periods run.

We store personal data only for as long as is necessary for the respective purpose or as required by statutory periods. In detail:

Some of our service providers are based in the USA or process data there. A transfer takes place only if the requirements of Art. 44 et seq. GDPR are met:

• EU-US Data Privacy Framework: Where the recipient is certified under the Data Privacy Framework (currently Stripe, LLC, Google LLC and Meta Platforms, Inc.), we base the transfer on the European Commission's adequacy decision of 10 July 2023 (Implementing Decision (EU) 2023/1795). We check the certification regularly at dataprivacyframework.gov/list.
• Standard contractual clauses: Where no adequacy decision applies (currently Anthropic, PBC and Features & Labels Inc.) or a certification lapses, we have agreed the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914) with the recipient and assessed the level of protection in the recipient country in a transfer impact assessment. A copy of the clauses is available on request.
• United Kingdom and Switzerland: Transfers are based on the European Commission's adequacy decisions (Decision (EU) 2021/1772, extended until 27 December 2031; Decision 2000/518/EC).

You have the following rights against us with regard to your personal data:

• Access (Art. 15 GDPR): to the data processed, the purposes, recipients, retention period and source, including a copy of the data.
• Rectification (Art. 16 GDPR) of inaccurate or incomplete data.
• Erasure (Art. 17 GDPR), to the extent the processing is no longer necessary and no retention obligation prevents it.
• Restriction of processing (Art. 18 GDPR).
• Data portability (Art. 20 GDPR): receipt of the data you have provided to us in a structured, commonly used, machine-readable format.
• Objection (Art. 21 GDPR), see section 3.
• Withdrawal of consent (Art. 7(3) GDPR) at any time with effect for the future.

To exercise your rights, an email to info@goetzcompany.com is sufficient. We respond without undue delay and in any event within one month.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement. The supervisory authority responsible for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia), Kavalleriestraße 2–4, 40213 Düsseldorf, telephone +49 211 38424-0, email poststelle@ldi.nrw.de, ldi.nrw.de.

You are not required to provide any personal data to visit the website. For a customer account, an order or an enquiry, we need the details marked as mandatory in the respective forms; without them, we cannot conclude the contract or answer the enquiry.

We protect your data through technical and organisational measures under Art. 32 GDPR: encrypted transmission (TLS), encrypted backups, personal and logged access with multi-factor authentication, allocation of rights according to the principle of least privilege, separation of the data of different customers, data centres in Germany and regular review of the measures.

We update this Privacy Policy when our services, the services we use or the legal situation change. The current version is available at goetzcompany.com/en/legal/privacy/. Last updated: October 2026.