Privacy Policy

Last updated: March 2026

1. Data Controller and Contact

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws as well as other data protection provisions is:

Iterion GmbH Musterstraße 1 10115 Berlin

Email: hello@iterion.de
Website: www.iterion.de

2. Data Processing on Our Website

2.1 Accessing the Website / Connection Data

Each time our website is accessed, our hosting provider (Vercel Inc.) automatically collects data and information from the accessing system. The following data is collected:

  • IP address of the requesting computer
  • Date and time of access
  • Name and URL of the retrieved page
  • Website from which access is made (referrer URL)
  • Browser used and, if applicable, the operating system of your computer
  • Name of your access provider

The temporary storage of this data is technically necessary for the provision of the website. The legal basis for data processing is Art. 6(1)(f) GDPR (legitimate interest). Our legitimate interest lies in the proper provision of our website. The data is deleted as soon as it is no longer necessary for the purpose for which it was collected.

2.2 Contact

If you contact us by email or via the contact form, the data you provide (e.g. your name, email address and your message) will be stored by us in order to process your enquiry and in case of follow-up questions.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in processing your enquiry). We delete the data arising in this context after storage is no longer necessary, or restrict processing if statutory retention obligations apply.

2.3 AI Chat Assistant

Our website offers an AI chat assistant powered by the Anthropic API (Anthropic PBC, USA). When you use the chat, your messages are transmitted to the Anthropic API for processing. No chat histories are stored — neither on our servers nor in the browser. No cookies or local storage entries are used for the chat.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in providing a helpful AI assistant for website visitors). As Anthropic PBC is based in the USA, personal data may be transferred to the USA. For more details, see Section 5 (Data Transfer to Third Countries).

2.4 Appointment Booking (Cal.com)

On our website, we offer you the option of booking appointments with us via the service Cal.com (Cal.com, Inc., USA). When you book an appointment, the data you enter (e.g. name, email address, desired appointment) is transmitted to Cal.com and processed there.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in efficient appointment scheduling). As Cal.com, Inc. is based in the USA, personal data may be transferred to the USA. For more details, see Section 5 (Data Transfer to Third Countries).

3. Use of Technologies

3.1 Cookies and Local Storage

Our website only uses technically necessary cookies that are required for the operation of the site (e.g. language selection). These cookies do not contain personal data and are automatically deleted at the end of the browser session. Tracking cookies or cookies for advertising purposes are not used.

The legal basis for the use of technically necessary cookies is § 25(2) No. 2 TDDDG and Art. 6(1)(f) GDPR.

3.2 Google Fonts

Our website uses fonts from Google Fonts. These are downloaded at build time and served from our own server (self-hosting via Next.js). No connection to Google servers is made when visiting our website, and no data is transmitted to Google.

3.3 Legal Basis

Insofar as we obtain consent for the processing of personal data, Art. 6(1)(a) GDPR serves as the legal basis. For processing that is necessary for the performance of a contract or for the implementation of pre-contractual measures, Art. 6(1)(b) GDPR serves as the legal basis. Insofar as the processing is necessary to safeguard a legitimate interest of our company, Art. 6(1)(f) GDPR serves as the legal basis.

4. Disclosure of Data

Your personal data will not be transferred to third parties for purposes other than those listed below. We only share your personal data with third parties if:

  • You have given your express consent (Art. 6(1)(a) GDPR),
  • the disclosure is necessary for the assertion, exercise or defence of legal claims and there is no reason to assume that you have an overriding legitimate interest in not having your data disclosed (Art. 6(1)(f) GDPR),
  • there is a legal obligation for the disclosure (Art. 6(1)(c) GDPR), and
  • this is legally permissible and necessary for the processing of contractual relationships with you (Art. 6(1)(b) GDPR).

5. Data Transfer to Third Countries

Insofar as we process data in a third country (i.e. outside the European Union or the European Economic Area) or this occurs in the context of the use of third-party services, this only takes place if it is for the fulfilment of our (pre-)contractual obligations, on the basis of your consent, on the basis of a legal obligation, or on the basis of our legitimate interests.

We use the service Cal.com (Cal.com, Inc., USA) for appointment booking, the hosting service Vercel (Vercel Inc., USA), and the Anthropic API (Anthropic PBC, USA) for our AI chat assistant. Subject to contractual or legally permitted authorisations, we only process or have data processed in a third country if an adequate level of data protection exists, e.g. on the basis of an adequacy decision by the EU Commission (Art. 45 GDPR), through standard contractual clauses (Art. 46(2)(c) GDPR), or in the presence of binding corporate rules (Art. 46(1) and (2)(b) GDPR).

6. Storage Duration

We store your personal data only for as long as is necessary for the fulfilment of the purposes for which it was collected, or as required by law. After the respective purpose ceases to apply or these periods expire, the corresponding data is routinely blocked or deleted in accordance with statutory provisions.

7. Your Data Protection Rights

7.1 Overview of Your Rights

You have the following rights with regard to your personal data:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object to processing (Art. 21 GDPR)

7.2 Right to Withdrawal and Objection

If your personal data is processed on the basis of consent pursuant to Art. 6(1)(a) GDPR, you have the right to withdraw your consent at any time (Art. 7(3) GDPR). The withdrawal does not affect the lawfulness of the processing carried out on the basis of the consent until the withdrawal.

If we base the processing of your personal data on the balancing of interests pursuant to Art. 6(1)(f) GDPR, you may object to the processing. This is the case if the processing is not necessary in particular for the performance of a contract with you. When exercising such an objection, we ask that you explain the reasons why we should not process your personal data as we have done.

7.3 Right to Lodge a Complaint

You have the right pursuant to Art. 77 GDPR to lodge a complaint with a data protection supervisory authority about our processing of your personal data.

8. Changes to This Privacy Policy

We reserve the right to amend this privacy policy to ensure that it always complies with current legal requirements or to implement changes to our services. The new privacy policy will then apply to your next visit.