Privacy policy

1. Who is responsible

Denkium Guide is run by the controller within the meaning of the GDPR:

VBI Strategy UG (haftungsbeschränkt)
Kirchfeldstraße 12
82008 Unterhaching
Germany

Managing director: Ilia Zverev. Email: info@vbistrategy.com. More in the Impressum.

2. What we process and why

• Your plan. Your name and email, your company's name, country and website, your answers about goals and interests, the plan we build from them, and your marks such as Visited and Hide. We use them to build and show your plan and to email you its link (Art. 6(1)(b) GDPR, providing the service you ask for). You give your consent to this when you tick the box on the form.
• Contact about Denkium products. With the same box you agree that Denkium may contact you about its products and services (Art. 6(1)(a) GDPR). You can withdraw this at any time with the unsubscribe link in every email or by email to us; this does not affect what happened before.
• Notes and photos. They are encrypted in your browser with a key that comes from your personal link and never reaches us. We store only the encrypted data and cannot read it. Photos are re-encoded in your browser first, which removes location and other metadata. If you lose your link, the notes and photos cannot be recovered.
• Emails you ask for. Your plan's link, reset links and the list of your plan as a spreadsheet (Art. 6(1)(b) GDPR).
• Security. Your IP address is used to limit requests per network and to protect the service against abuse, and it appears in our server logs (Art. 6(1)(f) GDPR; our legitimate interest is a secure and available service). The counters for these limits are deleted after one hour.

Name and email are needed to send you your plan's link; without them we cannot make a plan. Everything else on the form is optional or helps us match exhibitors.

3. Matching with AI models

To find exhibitors that fit, a summary of your answers about your company and interests is processed by AI models: the Jev decision model of TypeSafe AI and Claude by Anthropic. This summary never contains your name or email. Please do not type personal data into the free-text fields. The plan is a recommendation; no decision with legal or similarly significant effect is made about you (Art. 22 GDPR).

4. Recipients

We use these service providers, bound by data processing agreements (Art. 28 GDPR):

• Hetzner Online GmbH, Gunzenhausen, Germany: servers and database, in Germany.
• DigitalOcean, LLC, New York, USA: our mail server, in a data centre in Frankfurt am Main, Germany.
• TypeSafe AI: the Jev decision model, which receives the summary of your answers and exhibitor information.
• Anthropic, PBC, San Francisco, USA: the Claude model, which receives the summary of your answers.
• Slack Technologies: an internal message to our team about each new plan with company, country, website and the summary of your answers, without your name and email.

We do not sell your data and do not pass it to other third parties.

5. Transfers outside the EU

Anthropic, Slack and DigitalOcean are US companies, so data may be accessed from the USA. These transfers rely on the EU-US Data Privacy Framework where the provider is certified (Art. 45 GDPR) and otherwise on the EU standard contractual clauses (Art. 46(2)(c) GDPR).

6. Storage in your browser

We use no cookies for visitors and no tracking or analytics. To work on a phone in the hall, also offline, the app keeps in your browser: your form answers including name and email (so you can continue later), your plan's key for the open tab, changes not yet sent (notes and photos already encrypted) and an offline copy of your plan. This is strictly necessary for the service you ask for (§ 25(2) no. 2 TDDDG). "Delete my data" on the plan page removes it; you can also clear this site's data in your browser.

7. How long we keep data

• Your plan with name, email, answers, marks and the encrypted notes and photos: until you delete it with "Delete my data", and no longer than 31 May 2027.
• Your consent to be contacted: until you withdraw it.
• Reset links and request counters: one hour.
• Database backups: deleted data leaves the backups within 14 days.

8. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw a consent at any time with effect for the future (Art. 7(3)). Write to info@vbistrategy.com.

9. Right to complain

You can complain to a data protection supervisory authority, for example the one responsible for us: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.