Cybersecurity Assessment Support Contact Report a security incident!
Request a first meeting DE

Legal · privacy

Privacy policy

Privacy policy pursuant to the GDPR (information obligations under Art. 13 and 14 GDPR). Version of 25 May 2018; revised on 20 January 2020 (cookie consent), 1 August 2020 (change of company name to eyeT GmbH) and in November 2026 (relaunch of the website without cookies, tracking or third-party services). This is a courtesy translation; in case of doubt, the German version prevails.

I. Information on data protection

eyeT attaches particular importance to compliance with data protection regulations. The secure handling of your data and the protection of the secrecy of telecommunications are central concerns for us. Personal data (e.g. title, name, address, email address, telephone number) is collected and processed by eyeT secure only in accordance with the General Data Protection Regulation of the European Union (GDPR) and the German Federal Data Protection Act (BDSG). We would therefore like to inform you here about data protection at eyeT GmbH.

II. Name and address of the controller

The controller within the meaning of the General Data Protection Regulation and other national data protection laws of the member states as well as other data protection regulations is:

eyeT GmbH
Managing director: Juan J. Davila-Castillo
Otto-Hahn-Str. 11
Riemerling
D-85521 Ottobrunn near Munich, Germany
Phone: +49 (0)89 189 085 700
Fax: +49 (0)89 189 085 711
Email: office@eyet.com

III. Name and address of the data protection officer

The data protection officer of the controller is:

eyeT GmbH
Data Protection Officer
Otto-Hahn-Str. 11, Riemerling
D-85521 Ottobrunn near Munich, Germany
Email: datenschutz@eyet.com

IV. General information on data processing

1. Scope of the processing of personal data

We collect and use personal data of our users only insofar as this is necessary to provide a functional website and our content and services. The collection and use of personal data of our users regularly takes place only with the user's consent. An exception applies in cases where prior consent cannot be obtained for practical reasons and the processing of the data is permitted by law.

This website does not set cookies, does not use analytics or tracking services and does not embed any third-party content, fonts or scripts. Transmission is encrypted via TLS (HTTPS).

In the following cases we process your personal data in the context of your use of our website for the purposes stated and on the legal bases named:

a. Registration for, participation in and delivery of training, events or webcasts

To participate in our open and in-house training, events or webcasts, and so that we can deliver them, you must register; for this purpose we process your personal data: surname and first name, business position, address, telephone number and email address. Legal bases: consent pursuant to Art. 6 (1) (a) GDPR; for paid training, events or webcasts, performance of a contract or pre-contractual measures pursuant to Art. 6 (1) (b) GDPR.

b. Registration for, participation in and delivery of on-site events

To participate in our on-site events you must register; for this purpose we process surname and first name, company name, address, telephone number and email address. Legal bases: consent pursuant to Art. 6 (1) (a) GDPR; for paid events Art. 6 (1) (b) GDPR.

c. Sending of information

Following training, events, webcasts or on-site events we process surname and first name, company name, address and email address for the purpose of sending directly related information by post or email. Legal basis: legitimate interest of the controller pursuant to Art. 6 (1) (f) GDPR.

d. Postal and electronic advertising

For the purpose of sending promotional information by post or email we process surname and first name, company name, address and email address. Legal bases: consent pursuant to Art. 6 (1) (a) GDPR and, for all paid events, legitimate interest pursuant to Art. 6 (1) (f) GDPR. You may object to the use of your data for advertising purposes at any time.

e. Transfer of data to recipients in a third country

Your personal data processed via our website is not transferred to a recipient in a third country or to an international organisation. For video conferences see section VI.

2. Legal basis for the processing of personal data

Insofar as we obtain the consent of the data subject for processing operations involving personal data, Art. 6 (1) (a) GDPR serves as the legal basis. For the processing of personal data required for the performance of a contract to which the data subject is party, Art. 6 (1) (b) GDPR serves as the legal basis; this also applies to processing operations required to carry out pre-contractual measures. Insofar as processing is necessary to fulfil a legal obligation, Art. 6 (1) (c) GDPR serves as the legal basis. In the event that vital interests of the data subject or another natural person require processing, Art. 6 (1) (d) GDPR serves as the legal basis. If processing is necessary to safeguard a legitimate interest of our company or a third party and the interests, fundamental rights and freedoms of the data subject do not override the former interest, Art. 6 (1) (f) GDPR serves as the legal basis.

3. Storage period and erasure of personal data

Your personal data is stored only for as long as knowledge of it is required to fulfil the purposes of the respective processing – as a rule, for as long as is necessary to perform a contract with you. Personal data of tax relevance is generally stored for a period of ten years, other personal data under commercial law for a period of six years (§ 147 AO, § 257 HGB). The data is erased or blocked as soon as the purpose of storage ceases to apply and no statutory, contractual or constitutional retention period stands in the way.

V. Hosting, provision of the website and creation of log files

This website is hosted by STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, on servers located in Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with STRATO.

1. Description and scope of data processing

Each time our website is accessed, the hosting provider's system automatically records data and information from the computer system of the accessing device: browser type and version, operating system, internet service provider, IP address, date and time of access, page requested, referrer URL, amount of data transferred and status code. The data is stored in log files; it is not stored together with other personal data of the user.

2. Legal basis and purpose

The legal basis for the temporary storage of the data and the log files is Art. 6 (1) (f) GDPR. Storage takes place to ensure the delivery and functionality of the website, to optimise the website and to ensure the security of our IT systems. No evaluation for marketing purposes takes place. The log files are deleted or anonymised by the hosting provider after a short period.

3. Possibility of objection and removal

The collection of data for the provision of the website and the storage in log files is strictly necessary for the operation of the website. Consequently, the user has no possibility of objection.

VI. Data processing when using Microsoft Teams

We use Microsoft Teams for video conferences. If you take part in a video conference, your first name, surname and email address are collected and processed. During the video conference, meeting metadata (topic, description, participant IP addresses, device and hardware information), meeting content data (audio, video and, where applicable, text data of your contributions) and optionally telephony usage data may also be stored. We do not record video conferences. The processing serves to enable a personal conversation or consultation by video within the contractual relationship. Microsoft Teams is a service of Microsoft Corporation, based in the USA; processing therefore partly takes place in a third country. We have concluded a data processing agreement with Microsoft pursuant to Art. 28 GDPR; the transfer is based on the EU Commission's standard contractual clauses or the adequacy decision on the EU-U.S. Data Privacy Framework. The legal basis is Art. 6 (1) (b) GDPR.

VII. Contact forms, emergency form and email contact

1. Description and scope of data processing

Our website provides contact forms (contact, callback, support request, training and workshop request, project/consulting request, Cybersecurity Assessment) as well as a form for reporting a security incident. The data you enter (name, company, email address, telephone number, type of request or incident status, your message and, where applicable, details on products, number of participants or environment) and the time of submission are transmitted by email to our mailbox and used exclusively to process your request. The forms contain a field invisible to visitors to deter automated submissions; no additional personal data is collected for this purpose. Alternatively, you can contact us via the email addresses provided; in this case the personal data transmitted with the email is stored. Data is not passed on to third parties unless this is necessary to process your request (for example to vendors whose services are the subject of the request).

2. Legal basis

Where consent has been given, the legal basis for processing is Art. 6 (1) (a) GDPR. The legal basis for the processing of data transmitted in the course of a submission is Art. 6 (1) (f) GDPR. If the contact is aimed at concluding a contract, Art. 6 (1) (b) GDPR is an additional legal basis. When a security incident is reported, processing is in the legitimate interest of both the reporting party and the controller in preventing and investigating the incident (Art. 6 (1) (f) GDPR).

3. Purpose and storage period

Processing serves solely to handle the contact. The data is erased as soon as it is no longer required to achieve the purpose of its collection – for form and email data, when the respective conversation with the user has ended and no statutory retention obligations apply.

4. Possibility of objection and removal

The user may at any time withdraw consent to the processing of personal data and object to its storage. In such a case the conversation cannot be continued. Please send an informal email to datenschutz@eyet.com. All personal data stored in the course of the contact will then be erased, insofar as no retention obligations apply.

VIII. Rights of the data subject

If your personal data is processed, you are a data subject within the meaning of the GDPR and have the following rights vis-à-vis the controller:

  • Right of access (Art. 15 GDPR): confirmation as to whether personal data concerning you is processed, and information on purposes, categories, recipients, storage period, origin of the data and the existence of automated decision-making including profiling.
  • Right to rectification (Art. 16 GDPR): rectification and/or completion of inaccurate or incomplete data.
  • Right to restriction of processing (Art. 18 GDPR): under the statutory conditions, for example while the accuracy is being verified or in the event of an objection.
  • Right to erasure (Art. 17 GDPR): if the data is no longer necessary for the purposes, you withdraw your consent, you object or the processing was unlawful – subject to the statutory exceptions, in particular for compliance with legal obligations and for the establishment, exercise or defence of legal claims.
  • Right to be informed (Art. 19 GDPR): about recipients to whom rectification, erasure or restriction has been communicated.
  • Right to data portability (Art. 20 GDPR): receipt of the data provided in a structured, commonly used and machine-readable format, insofar as processing is based on consent or a contract and is carried out by automated means.
  • Right to object (Art. 21 GDPR): to processing based on Art. 6 (1) (e) or (f) GDPR on grounds relating to your particular situation; to direct marketing at any time.
  • Right to withdraw consent: at any time by informal email to datenschutz@eyet.com; the lawfulness of processing carried out until withdrawal remains unaffected.
  • Automated individual decision-making including profiling (Art. 22 GDPR): you have the right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you. No such decision-making takes place on this website.
  • Right to lodge a complaint with a supervisory authority (Art. 77 GDPR): without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement.

The supervisory authority responsible for eyeT GmbH is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, phone +49 981 180093-0, poststelle@lda.bayern.de.

IX. Further information

Exercising your rights to erasure, restriction of processing, withdrawal or objection may mean that you can only use our website or other services to a limited extent or not at all. You may address the rights set out above directly to the contact details provided under "Name and address of the controller".

Secure transmission of personal data, links to other websites

Personal data you transmit via our website is transmitted in encrypted form (TLS). Our website may contain links to other websites, for example to vendors. If you use such links, you will be taken to another website for whose privacy provisions we accept no responsibility.

Cookies and third-party services

This website does not set cookies and does not use statistics or marketing services; Google Analytics and Google Maps, which were used on the previous website, have been removed. A cookie banner is therefore not required.