Privacy Policy

Last updated: 23 September 2026

Last updated: September 2026

Table of Contents

  1. Controller
  2. Processing Overview
  3. Legal Basis
  4. Security Measures
  5. Your Rights
  6. Hosting and Server Log Files
  7. Contact Form and Customer Management
  8. Direct Marketing to Existing Customers
  9. AI-Assisted Handling of Enquiries and Customer Data
  10. Cookieless Reach Measurement
  11. The Sketch (AI feature)
  12. Google reCAPTCHA Enterprise
  13. Cookies and Storage on Your Device
  14. YouTube API Services

Controller

Data Controller

Droidtech e.K. Michael Rauen Auf der Eichelsbach 19 54533 Hasborn, Germany

Email: mail@droidtech.de Phone: +49 6574 227 0937

Registration Details

Commercial Register: Amtsgericht Wittlich Register Number: HRA 41160 VAT ID: DE306856290

Processing Overview

Types of Data Processed

  • Contact data (name, email address, company if given)
  • Customer and contract data (details of companies and contact persons, projects, quotes, contracts, meeting notes, recorded working hours)
  • Invoice and payment data (billing address, invoice items, amounts, payment status)
  • Content data (messages from the contact form, sentences entered and the sketches generated from them)
  • Usage data (pages viewed, referring source)
  • Meta and communication data (IP address, timestamp, browser and device information)

Purposes of Processing

  • Provision and operation of the website
  • Handling contact enquiries and communication
  • Looking after customers and prospects, preparing and performing contracts
  • Invoicing, bookkeeping and compliance with statutory retention obligations
  • Direct marketing by email for our own similar services to existing customers
  • AI-assisted pre-sorting of incoming enquiries and drafting when handling enquiries and customer data
  • Generating and displaying the AI sketch at the visitor’s request and, if wished, sharing it via a link
  • Security measures, abuse and spam prevention
  • Statistical reach measurement without personal reference

GDPR (General Data Protection Regulation)

  • Art. 6 para. 1 lit. b: Performance of a contract and pre-contractual measures
  • Art. 6 para. 1 lit. c: Compliance with legal obligations (statutory retention obligations)
  • Art. 6 para. 1 lit. f: Legitimate interests

TDDDG (German Telecommunications-Digital-Services-Data-Protection Act)

§ 25: Consent for the use of terminal equipment. For storing information on your device we use only what is technically necessary or what you explicitly request through an action of your own (§ 25 para. 2 no. 2 TDDDG). We therefore do not ask for consent. A short notice on the website points to the services we use and to this privacy policy; it is not a consent request.

Security Measures

  • SSL/TLS encryption
  • Access controls
  • Regular updates

We implement technical and organizational measures according to the state of the art to ensure the security of data processing and to protect your data from loss, destruction, manipulation and unauthorized access.

Your Rights under GDPR

You can exercise these rights at any time by contacting mail@droidtech.de:

  • Right of Access (Art. 15): right to information about processed data
  • Right to Rectification (Art. 16): right to correction of inaccurate data
  • Right to Erasure (Art. 17): right to deletion of data
  • Right to Restriction (Art. 18): right to restriction of processing
  • Data Portability (Art. 20): right to transfer of data
  • Right to Object (Art. 21): right to object to processing based on Art. 6 para. 1 lit. f GDPR and, at any time, to processing for direct marketing purposes (see “Direct Marketing to Existing Customers”)

Complaint to a supervisory authority: you have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your residence, your place of work or the place of the alleged infringement. The authority responsible for us is the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz.

Hosting and Server Log Files

This website runs on a rented server that we administer ourselves, provided by Host Europe GmbH, Hansestraße 111, 51149 Cologne, Germany. Host Europe provides the server infrastructure in data centres within the European Union and acts as our processor under a contract pursuant to Art. 28 GDPR. Microsoft Internet Information Services (IIS) is used as the web server.

On every request, the web server writes log files containing:

  • the IP address of the requesting device
  • the date and time of access
  • the address requested and the amount of data transferred
  • the status code of the response
  • the referring page, where transmitted
  • the browser and operating system identifier (user agent)

This data is technically required to deliver the site, to keep it running reliably and to detect and investigate attacks. The legal basis is Art. 6 para. 1 lit. f GDPR; our legitimate interest lies in the secure and trouble-free operation of the website. Log files are deleted as soon as they are no longer needed for these purposes. They are not combined with other data sets.

Contact Form and Customer Management

When you write to us through the contact form, we process the details you enter there in order to answer your enquiry.

Data processed

  • Name and email address
  • Message content
  • Company (optional)
  • IP address and timestamp of submission
  • Where applicable, a sketch you attached, together with the description you entered for it

Processing details

  • Purpose: handling and answering your enquiry, preventing abusive submissions
  • Legal basis: Art. 6 para. 1 lit. b GDPR where the enquiry concerns entering into or performing a contract, otherwise Art. 6 para. 1 lit. f GDPR
  • Retention: 3 years, unless we transfer the enquiry to our customer management (see below)
  • Disclosure: none. For sending emails we use IONOS as a processor (see below), for AI-assisted handling Google Cloud; see the section “AI-Assisted Handling of Enquiries and Customer Data”.

The message is additionally delivered by email to our mailbox. Our server sends emails via the mail server of IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany, which acts as our processor; a data processing agreement under Art. 28 GDPR is in place. This also applies to the emails sent from our customer management (see below).

Every enquiry is automatically pre-sorted with AI assistance after it arrives; see the section “AI-Assisted Handling of Enquiries and Customer Data”.

The contact form is protected by Google reCAPTCHA Enterprise; see the separate section below.

Transfer to our customer management

If your enquiry leads to further conversations, a quote or an order, we transfer it to our customer management system (CRM). It is part of our password-protected admin area and runs on our own server (see “Hosting and Server Log Files”); no external CRM provider is involved. In doing so, we create your company as a prospect or customer, you as a contact person and, where needed, a project. The original enquiry and any sketch attached to it remain linked to these records.

In our customer management we process:

  • company details (company name, industry, address, VAT ID, website) and, where applicable, a note of an objection to marketing (see “Direct Marketing to Existing Customers”)
  • details of contact persons (name, role, email address, phone number, preferred form of address: formal “Sie” or informal “du”)
  • enquiries, projects, quotes and contracts
  • notes on calls, meetings and emails, and follow-up reminders
  • appointments and proposed appointments (time, place or video call link, invited contact persons)
  • the emails we send from our customer management (recipients, subject, text, list of attachments, delivery status)
  • working hours recorded for projects and contracts, with a description of the work

We receive details of contact persons from you or from the company you work for.

  • Purpose: preparing and performing contracts, documenting services rendered, looking after our customers and prospects, tracking quotes and deadlines
  • Legal basis: Art. 6 para. 1 lit. b GDPR for pre-contractual measures and performance of the contract; Art. 6 para. 1 lit. f GDPR for customer care and for contact persons who are not themselves our contractual partner. Our legitimate interest lies in looking after our customers and prospects in an orderly and reliable way. For retention after the business relationship has ended: Art. 6 para. 1 lit. c GDPR.
  • Retention: for as long as the business relationship exists. After that we delete the data unless statutory retention obligations apply. Documents we must keep under commercial or tax law (such as quotes, contracts and business correspondence, Section 257 German Commercial Code (HGB), Section 147 German Fiscal Code (AO)) are kept until these periods expire and are used only for that purpose during this time. If no contract is concluded, we delete the data as soon as it is no longer needed for preparing one, at the latest three years after the last contact, subject to such retention obligations.
  • Disclosure: none, apart from sending emails via IONOS, invoicing via Lexware Office and AI-assisted handling by Google Cloud, all as processors (see above, “Invoicing and bookkeeping with Lexware Office” below and the following section)

Emails, calendar invitations and links to quotes and appointments

We send quotes, order confirmations, proposed appointments and other messages by email from our customer management, via the mail server of IONOS SE (see above), and store every email sent there as described above. An email may be copied (Cc) to further contact persons of the company; the recipients then also see their addresses. We attach a calendar file (ICS) to an appointment invitation. It contains the time, the place or video call link, us as the organiser, and the names and email addresses of all contact persons invited to the appointment; whoever receives the invitation therefore also sees the other invitees.

Our emails may contain a personal link to a page at droidtech.de/angebot, droidtech.de/avv or droidtech.de/termin. There, without logging in, you can view a quote, download it as a PDF, accept it online or ask a question, view, download and conclude a data processing agreement (DPA, Art. 28 GDPR) online, and confirm a proposed appointment or suggest a different one. The link is valid for a limited time only. The appointment page does not set any cookies; for the quote and DPA pages, see the next paragraph.

If a postal code is stored for your company, the link to a quote or a DPA is additionally protected: before the page shows the content, it asks for the postal code of your company’s address. Only then can you view it, download it as a PDF, accept or conclude it, or ask a question. Our server compares your entry with the stored postal code; we do not store the entry itself, neither in our customer management nor in our log. If it matches, our server (api.droidtech.de) sets the cookie dt_pl_… for exactly this link (see “Cookies and Storage on Your Device”), so that you do not have to enter the postal code again at every step. The cookie contains a proof signed by us that the postal code was entered correctly for this link; after twelve hours our server no longer accepts this proof, and the page asks for the postal code again.

To prevent postal codes from being guessed, we count incorrect entries. For each link we store in our database the number of failed attempts and the time of the first of them. After five incorrect entries within 15 minutes we block the link for 15 minutes and record the end of the block for the link; a correct entry resets the count. In addition, we count incorrect entries across all links per check value of the IP address (formed as described below), only in the server’s working memory and not in the database. After ten incorrect entries within 15 minutes the server accepts no further entries from this check value for 15 minutes. This count is lost at the latest when the server restarts.

We record for the link in our customer management when a link to a quote or DPA was first opened (for protected links: after the correct postal code) and display this to ourselves there. We also note the first opening in the customer’s history, for a quote together with the name of the contact person the link was sent to. The purpose is to follow up on a quote or proposal appropriately, for example with a reminder. Beyond that, apart from the server log files and the log described below, we do not record that you merely viewed these pages.

  • If you accept a quote online, we store as proof of the order the name you enter, your confirmation that you are authorised to place the order, the number and amounts of the quote, the time, your browser identifier (user agent) and a check value (hash) of your IP address, formed from the address, a secret additional value and the date. We do not store the IP address itself. We then send you an order confirmation by email. We keep the proof together with the quote; the retention period for quotes and contracts stated above applies.
  • If you conclude a DPA online, we store as proof of conclusion the name you enter, your confirmation that you are authorised to represent the company, the time, your browser identifier (user agent), a check value of your IP address formed in the same way and a check value (hash) of the concluded contract text. We then send you a confirmation with the agreement as a PDF by email. We keep the proof for at least three years after the DPA ends.
  • If you confirm an appointment, suggest a different one or ask a question, we store your confirmation or your text with the time in our customer management. We do not store your browser identifier or IP address there.
  • For each of these actions, and also when a quote is opened for the first time, when a link is blocked after incorrect postal code entries and when you object via the link on the quote page, our server writes an entry to our log: the time, the type of action, the quote, DPA or appointment concerned and a check value of your IP address formed in the same way, without the content of your message. We delete these entries after two years.
  • We may have ourselves notified of acceptances, confirmations, suggested appointments and questions by email to our own mailbox.

The legal basis is Art. 6 para. 1 lit. b GDPR for acceptance, order confirmation and arranging appointments. For concluding a DPA and its proof, the legal basis is Art. 6 para. 1 lit. b and c GDPR, because we conclude the agreement under Art. 28 GDPR and must be able to demonstrate compliance with it. For the proof of accepting a quote and the log we rely on Art. 6 para. 1 lit. f GDPR; our legitimate interest lies in being able to prove an order placed online and to detect misuse of the links. We rely on the same legal basis for the postal code protection and for recording the first opening; our legitimate interest lies in protecting quotes against access by unauthorised persons and in following up on quotes we have sent in a targeted way.

Invoicing and bookkeeping with Lexware Office

We create and book our invoices with the online accounting service Lexware Office (formerly lexoffice) of Haufe-Lexware GmbH & Co. KG, Munzinger Straße 9, 79111 Freiburg, Germany. Under the data processing agreement pursuant to Art. 28 GDPR that we have concluded with the provider, the processor is Haufe Service Center GmbH, Munzinger Straße 9, 79111 Freiburg, Germany.

Our customer management is connected to Lexware Office. For invoicing we transmit:

  • company details (company name, billing address, for German companies the VAT ID)
  • name, email address and phone number of the main contact person
  • invoice data (invoice date, service period, items with description, quantity and price, amounts, payment term); for time-and-materials services also the date and description of the recorded activities

Lexware Office assigns the invoice number. We take the invoice number, status, payment status and the invoice PDF back into our customer management. We synchronise contact details between the two systems; in doing so, we may take over customers created in Lexware Office into our customer management.

According to the data processing agreement, the core functions of Lexware Office, including invoice creation, are hosted in Germany. For supplementary functions, such as sending emails from Lexware Office or support, the provider uses further sub-processors, some of them based outside the EU, including in the USA. Such transfers are based on an adequacy decision of the European Commission or on its standard contractual clauses.

  • Purpose: invoicing, monitoring payments, bookkeeping, compliance with statutory retention obligations
  • Legal basis: Art. 6 para. 1 lit. b GDPR for invoicing and payment handling; Art. 6 para. 1 lit. c GDPR in conjunction with Section 147 AO, Section 257 HGB and Section 14b of the German VAT Act (UStG) for retention; Art. 6 para. 1 lit. f GDPR for contact persons who are not themselves our contractual partner; our legitimate interest lies in orderly billing.
  • Retention: we keep invoices and other accounting vouchers for eight years, books and records for ten years, in each case from the end of the calendar year in which they were created (Section 147 AO, Section 257 HGB). This applies in Lexware Office and to the copy of the invoice in our customer management. After that we delete the data unless it is still needed for another reason, for example because the tax assessment period has not yet expired.

The Lexware Office privacy notice (in German) applies in addition.

Direct Marketing to Existing Customers

We may send contact persons of our customers proposals by email for our own services that are similar to those already ordered from us, for example operation, maintenance or further development of software we developed for your company. If we receive no response, a reminder may follow. You can view the proposal itself via a link on a page at droidtech.de/angebot (see “Emails, calendar invitations and links to quotes and appointments”).

Data processed

  • name, email address and preferred form of address of the contact person
  • details of your company and of previous projects, quotes, contracts and services, to the extent we need them to select a suitable proposal
  • the proposal, the emails sent about it and the time at which you first opened the quote
  • where applicable, your objection with date and source (see below)

Processing details

  • Purpose: direct marketing of our own similar services to existing customers and following up on a proposal we have sent
  • Legal basis: Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in offering our customers our own services that fit what they have already ordered from us; under Recital 47 GDPR, processing for direct marketing purposes may be regarded as such an interest.
  • We send marketing emails without your consent only under the conditions of Section 7 (3) of the German Act against Unfair Competition (UWG): we obtained your email address in connection with an order, we only advertise our own similar services, and you have not objected to this use. Every such email points out that you can object to this use at any time without incurring any costs other than the transmission costs at the basic rates.
  • Retention: proposals and emails are part of our customer management; its retention period applies (see “Contact Form and Customer Management”).
  • Disclosure: none, apart from sending emails via IONOS as a processor (see above). The following section describes how we produce drafts for these emails.

Your right to object

You can object to the use of your data for direct marketing at any time without giving reasons (Art. 21 para. 2 GDPR, Section 7 (3) no. 3 UWG). It is sufficient to

  • reply to one of our emails, for example with “keine Vorschläge” (“no proposals”), or write to mail@droidtech.de, or
  • choose the link “Keine weiteren Vorschläge per E-Mail” (“no further proposals by email”) on the quote page. No postal code is needed for this, and the link also works when the quote is no longer valid.

After an objection, we no longer process your data for direct marketing purposes (Art. 21 para. 3 GDPR). We note the objection in our customer management for your company, with the date and source (link on the quote page, reply by email or entered by us, for example after a conversation). After that, we no longer send proposals or reminders of this kind to any contact person of your company. We record the change in the history of our customer management and in our log. You will continue to receive emails relating to the performance of existing contracts, such as invoices, order confirmations or arranging appointments.

We keep the note for as long as we store data about your company in our customer management, so that we can observe the objection permanently. The legal basis for this is Art. 6 para. 1 lit. f GDPR; our legitimate interest lies in complying with your objection and being able to prove that we do.

AI-Assisted Handling of Enquiries and Customer Data

When handling enquiries and looking after our customers, we use AI assistance. It works solely for our own work, in two ways.

Automatic assessment of new enquiries

Every enquiry you send us through the contact form, including one sent together with a sketch, is automatically assessed by the AI in the background after it arrives. This produces a short summary, an assessment of how well the enquiry fits what we offer, an assessment of urgency, the type of request and the industry, and a suggestion for the next step and for the scope of a first work phase. The purpose is to pre-sort incoming enquiries so that we can handle them promptly and in a sensible order. We store the assessment together with the enquiry in our admin area and include it in the notification about the new enquiry sent to our own mailbox. The AI does not draft a reply to you in this step.

Drafts on request

Within our customer management, the AI also produces drafts for our own work:

  • assessing an enquiry and drafting a reply
  • structuring meeting notes
  • preparing for a meeting (briefing)
  • drafting a quote
  • drafting emails, including proposal and reminder emails to existing customers

These functions are only available in the password-protected admin area. Each one is started individually by us.

No automated decision-making

The automatic assessment is a pre-sorting for our own use. It is not communicated to you, does not trigger a reply or a rejection, and has no legal or similarly significant effect on you. Every draft is reviewed by a human before it is used. The AI does not send anything to you and does not schedule appointments. Whether and how we reply to an enquiry and whether we make an offer is decided by us. No automated decision-making within the meaning of Art. 22 GDPR takes place.

Transfer to Google Cloud Vertex AI

For the assessment and the drafts, our server sends the content required in each case to the Vertex AI service (Gemini model) of Google Cloud. The provider is Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland, which acts as our processor; a data processing agreement is in place (Cloud Data Processing Addendum).

For this we exclusively use the europe-west3 region in Frankfurt am Main. According to Google’s documentation, processing by the model we use takes place in Germany in this region. We do not use the global endpoint that we use for the sketch here. Where Google engages sub-processors outside the European Union for operation, maintenance or support, the Standard Contractual Clauses of the European Commission apply, which form part of the Cloud Data Processing Addendum.

What data is transferred

For the automatic assessment, this is the content of the enquiry, the company given, any attached sketch and the path chosen below the sketch. For the drafts, depending on the function, it is the content of an enquiry and any sketch attached to it, the company name, industry and town, the roles of contact persons, meeting notes, the history so far including our emails and your questions, open follow-up reminders, and project, quote and running contract details.

We do not transfer direct contact details. We remove email addresses, phone numbers and web addresses before sending, including from free text; street, postcode, VAT ID and IP addresses are not sent. We replace the name of the person making the enquiry and the names of contact persons known to us with placeholders before sending and only insert them again on our server. Names we do not recognise as such, for example of other people mentioned in a meeting note, may remain in the text.

No training, storage at Google

Under the Google Cloud terms (Service Specific Terms, section “Training Restriction”), Google does not use the transferred data to train or fine-tune AI models. According to Google’s documentation, inputs and outputs are cached in memory for up to 24 hours to speed up responses, isolated per project and within the selected region. If Google’s automated filters detect suspected abuse, Google may log the inputs for review for up to 90 days in the selected region.

Storage on our side

We store the automatic assessment of an enquiry for as long as we store the enquiry and delete it together with the enquiry (see “Contact Form and Customer Management”). We do not store the text sent to Google for it.

We do not store the drafts themselves, neither the texts sent to Google nor the responses, and we do not use a cache for them. If we adopt a draft, unchanged or edited, we store the result in our customer management, and its retention period applies. For each call we record, without any content, when which function was used for which record, and the size and cost of the call. We delete these log entries after two years; after that, only the size and cost of the calls remain, without any reference to a record or a person.

Legal basis

Art. 6 para. 1 lit. b GDPR where the processing serves to answer your enquiry, to take pre-contractual measures or to perform a contract; otherwise, in particular for contact persons who are not themselves our contractual partner, Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in handling enquiries promptly and carefully, including pre-sorting them, and in looking after our customers.

You can object to this processing under Art. 21 GDPR by writing to mail@droidtech.de. We will record your objection in our customer management and then handle your enquiries and documents without AI. However, a new enquiry sent through the contact form is assessed before we can assign it to your company; the automatic assessment of such an enquiry may therefore still take place after an objection.

The Google Cloud privacy notice also applies.

Cookieless Reach Measurement

To learn which content is being read, we count page views with our own solution running on our own server. No third-party web analytics service is used. We do not use Google Analytics, and we use no advertising or remarketing technology.

Per page view we store:

  • the path requested on this website
  • the domain of the referring page, where transmitted
  • the language reported by the browser
  • a hash derived from the IP address, the browser identifier, a secret additional value (salt) and the current date

The hash exists solely so that repeated views within one day are not counted more than once. The IP address and the browser identifier themselves are not stored. Because the date is part of the hash, the same address and the same browser produce different hashes on different days; views from different days therefore cannot be linked to one another on the basis of the stored values. No cookies are set, nothing is stored in your browser, and no device characteristics are combined into a recognition feature (no fingerprinting).

The legal basis is Art. 6 para. 1 lit. f GDPR; our legitimate interest lies in a simple, data-minimising analysis of how our website is used. § 25 TDDDG does not apply, because no information is stored on your device or read from it.

The Sketch (AI feature)

On this website you can describe a work process or a product idea in a single sentence. An AI generates a product concept from that input, which we render on the page (“the sketch”). The feature only runs when you start it explicitly by submitting your input.

The feature is voluntary. All content on this website can be used in full without it. As long as you do not submit any input, your text does not go to Google Cloud Vertex AI (for reCAPTCHA, see the separate section).

Transfer to Google Cloud Vertex AI

To generate the sketch, the sentence you enter is transmitted to and processed by Vertex AI (models of the Gemini family) on Google Cloud. When you refine a sketch, your refinement request and parts of the previous sketch are added. The request to Google is made by our server; your IP address and information about your device are not passed on to Google. The provider is Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland, acting as our processor under a data processing agreement.

We use the service’s global endpoint rather than a region limited to the European Union. Google may therefore process the request in data centres worldwide, including in the USA and other third countries. The transfer is based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework, under which Google LLC is certified, and otherwise on the European Commission’s standard contractual clauses, which form part of Google’s Cloud Data Processing Addendum.

Under the Vertex AI service terms, your inputs and the generated results are not used to train Google’s models.

Please do not enter any personal data. The input field is meant for describing a work process or a product idea. Names, addresses, health data, employee or customer data do not belong in it, because the input may also be processed outside the European Union. Before transmitting, we remove recognisable contact details such as email addresses, phone numbers and web addresses from your text.

Storage

We store your input and the sketch generated from it on our server for 30 days. This serves to prevent abuse, to check the quality of the feature, and to show you the sketch again and attach it to an enquiry you send us about it. After 30 days, the input and the sketch are deleted. If you send us the sketch with an enquiry, the retention period of the contact form applies to that enquiry, and after a transfer to our customer management the retention period stated there.

Sharing a sketch via link

If you share a sketch via “Share link”, we create a random link for it. Anyone who knows the link can view the sketch, but not the text you entered. Sharing ends at the latest when the sketch is deleted after 30 days; you can revoke it at any time before that.

For sharing we store only the random key of the link, its assignment to the sketch and the time it was shared. Before display, we additionally remove recognisable names and addresses from your input from the shared sketch. Whoever opens the link receives no cookie, and reCAPTCHA is not loaded; we keep no records of our own about the access, only the sections on server log files and reach measurement apply. If the sketch is attached to an enquiry, it is kept longer (see above); the link still ends after 30 days.

Session cookie dt_sid

The first time you submit a sketch, we set the cookie dt_sid. It contains a random identifier with no reference to your name, is protected against being read by scripts (HttpOnly) and has a lifetime of 30 days. It is required in order to enforce the usage limits of the AI feature and to match a sketch you send us to your own enquiry, and to allow only you to share your sketch via a link and to revoke the sharing. It is not set when you merely visit the website.

Legal bases

  • Generating and displaying the sketch: Art. 6 para. 1 lit. b GDPR, as you request the feature yourself, otherwise Art. 6 para. 1 lit. f GDPR
  • Storage for abuse prevention and quality assurance: Art. 6 para. 1 lit. f GDPR
  • Sharing via link: Art. 6 para. 1 lit. b GDPR, as you request the sharing yourself, otherwise Art. 6 para. 1 lit. f GDPR
  • Cookie dt_sid: § 25 para. 2 no. 2 TDDDG (technically necessary for the service you explicitly requested), accompanied by Art. 6 para. 1 lit. f GDPR

The Google Cloud privacy notice applies in addition.

Google reCAPTCHA Enterprise

To protect against automated requests and abuse, we use Google reCAPTCHA Enterprise. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The service is not loaded when you open the website. The reCAPTCHA script is loaded only when you actually use the AI input, the contact form or the login to the admin area. For the AI input and the contact form, this happens as soon as you click into the input field or form or reach it with the keyboard; from that moment there is a connection to Google, even if you then submit nothing. For the admin login, the script is loaded only on submission. Anyone who merely reads our pages establishes no connection to Google.

During the check, your IP address, information about your browser and device, the referring page, date and time, and your interactions on the page (such as mouse, keyboard and scroll movements) are transmitted to Google and evaluated there. Google derives a risk score from this, which our server retrieves. Only if that score indicates an elevated risk does a visible challenge appear for you to solve.

For the check, Google may store or read information in your browser, such as a cookie on the domain google.com. We have no influence on this; all we receive from Google is the risk score.

The legal basis is Art. 6 para. 1 lit. f GDPR; our legitimate interest lies in protecting our services from spam, automated input and abusive use of paid services. Where information is stored on or read from your device in the process, we rely on § 25 para. 2 no. 2 TDDDG: without this protection we cannot safely offer the AI input and the contact form that you explicitly want to use. A transfer to Google LLC in the USA cannot be ruled out; Google bases it on the European Commission’s adequacy decision for the EU-US Data Privacy Framework, under which Google LLC is certified.

You may object to this processing under Art. 21 GDPR. If you prefer not to use reCAPTCHA, simply email us at mail@droidtech.de; that route does not involve Google.

Google’s Privacy Policy and Terms of Service apply.

Cookies and Storage on Your Device

This website does not ask for consent, because we use only technically necessary cookies and services: no analytics cookies, no marketing cookies, no tag manager, no third-party embeds and no external fonts. Fonts are served from our own server. A short notice at the bottom of the page names the services we use and links to this privacy policy; it can be closed with “Got it”.

Only what is required for a feature you have requested is stored on your device:

  • dt_sid (cookie, HttpOnly, 30 days): set only when you submit a sketch for the first time; see the section “The Sketch”.
  • Acknowledgement of the notice (browser local storage, no expiry date): stored only when you close the notice with “Got it”, so that it is not shown again on every page view. Only the fact of the acknowledgement is stored, no identifier. It stays in your browser, is not transmitted to us and remains until you delete it in your browser.
  • Display settings and sketches you chose to keep (browser local storage): stored only when you switch a display option or explicitly keep a sketch. This information stays in your browser and is not transmitted to us.
  • dt_pl_… (cookie, HttpOnly, session cookie; the proof it contains is valid for twelve hours): set only for the quote and DPA pages, and only after you have entered the correct postal code for a protected link. It applies to this one link only, is set by api.droidtech.de and is sent back only to that address. It contains a signed proof of the correct entry with an expiry time, not the postal code. Your browser usually deletes it when you close it; regardless of that, our server no longer accepts the proof after twelve hours. See “Emails, calendar invitations and links to quotes and appointments”.
  • .dt.admin (cookie, HttpOnly, valid for the duration of the login): concerns administrators only. It is set by api.droidtech.de after logging in to the admin area at droidtech.de/admin and keeps the login active. It is never set for visitors to the website.
  • Google reCAPTCHA storage (cookie or similar storage on the domain google.com): only when reCAPTCHA is loaded; see the section “Google reCAPTCHA Enterprise”.

The legal basis for these storage operations is § 25 para. 2 no. 2 TDDDG, because they are strictly necessary for the feature you explicitly requested; where personal data is processed, additionally Art. 6 para. 1 lit. f GDPR.

You can delete or block cookies and local storage at any time in your browser settings. The website remains readable either way; the AI feature is not available without dt_sid, a protected quote cannot be viewed without dt_pl_…, and the notice reappears after deletion.

YouTube API Services

Our internal application “YT Manager” uses YouTube API Services to manage YouTube channels owned by Droidtech e.K. (video uploads, channel data, statistics). This use is subject to the YouTube Terms of Service and the Google Privacy Policy.

The application stores OAuth access tokens in encrypted form on company-owned systems and retrieves statistics for the connected channels. This data is stored locally solely for our own analysis and is neither sold nor shared with third parties. No data of other users or third-party channels is processed.

The application’s access to the Google account can be revoked at any time via the Google security settings. When a channel is disconnected in the application, the stored tokens are deleted.

This privacy policy complies with GDPR, TDDDG and DDG (2025).