Privacy Policy

This is a courtesy translation of our German “Datenschutzerklärung”. In case of any discrepancy, the German version prevails.

1. Controller

The controller responsible for data processing on these pages within the meaning of the General Data Protection Regulation (GDPR) is:

E-mail: info@morgenthaler-de.com · Phone: +49 7248 927853

A data protection officer is not required by law; for any privacy questions, please contact the address above.

2. Your rights

With respect to your personal data, you have the following rights against us:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw a given consent with effect for the future (Art. 7 (3) GDPR)

You also have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data (Art. 77 GDPR).

3. Hosting and provision of the website

We host our services with Amazon Web Services (AWS) in the Frankfurt region (eu-central-1). When you access the website, the server automatically processes information transmitted by your browser (server log files): IP address, date and time of the request, page/file requested, amount of data transferred, status code, and browser type and operating system. This data is technically necessary for the secure and stable provision of the website.

To deliver the public pages (resilic.ai) and operate DNS, we additionally use Cloudflare, which processes your IP address. The legal basis is our legitimate interest in secure and efficient provision (Art. 6 (1)(f) GDPR). Where personal data is transferred to a third country, this is done on the basis of EU standard contractual clauses or an adequacy decision (EU-US Data Privacy Framework).

4. Web analytics with PostHog (consent-based)

On our public pages we use PostHog, a product-analytics tool hosted in the EU (Frankfurt). We use PostHog deliberately cookieless: no cookies are set and no data is stored persistently in your browser (in-memory only, for the duration of the page view).

We record page views (with the URL requested, referrer and any campaign parameters) and individual interaction events (e.g. starting a registration or a scope check). Your IP address is transmitted to PostHog in the process. There is no session recording, no cross-device profiling, and the data is not shared with third parties for advertising. Event data contains no plain-text search terms or other free-text personal data.

The legal basis is your consent pursuant to Art. 6 (1)(a) GDPR in conjunction with § 25 (1) TTDSG, which you give via our consent banner. Without your consent, PostHog is not loaded. You can withdraw your consent at any time with effect for the future via the “Privacy settings” link in the footer. We have concluded a data processing agreement (Art. 28 GDPR) with PostHog.

If your browser sends the “Global Privacy Control” or “Do Not Track” signal, we treat it as a decline: PostHog is not loaded and the consent dialog is not shown. An explicit decision made via “Privacy settings” in the footer takes precedence over the signal.

5. Newsletter / CRA update notifications

If you sign up for our CRA update notifications, we process the e-mail address you provide, along with your chosen language, the origin of the sign-up and the time of the sign-up. We use this data solely to send you occasional information about the Cyber Resilience Act.

We use the double opt-in procedure: we first send you a confirmation e-mail, and only add you to the mailing list once you have confirmed.

The legal basis is your consent pursuant to Art. 6 (1)(a) GDPR. You can unsubscribe at any time, for example via the unsubscribe link in every e-mail or by message to info@morgenthaler-de.com; this also withdraws your consent. Delivery is via Amazon Simple Email Service (Amazon SES) in the Frankfurt region (eu-central-1).

6. Registration and user account

To use the application (app.resilic.ai) you can create an account. We process the master and contact data required for provision (in particular name and e-mail address) to perform the pre-contractual or contractual relationship pursuant to Art. 6 (1)(b) GDPR. Sign-in is managed via our self-operated identity service (Keycloak) within the EU. Payment data for paid plans is processed only upon conclusion of a contract via our payment service provider.

7. Contacting us

If you contact us by e-mail, we process your details in order to handle the request. The legal basis is Art. 6 (1)(b) GDPR where your request serves to perform a contract or pre-contractual measures, and otherwise our legitimate interest in responding to the request (Art. 6 (1)(f) GDPR).

8. Cookies and local storage

We do not use tracking cookies. We store technically necessary information in your browser’s local storage and in a single strictly necessary cookie (“aegis_consent”, valid for twelve months, for resilic.ai and its subdomains) so that the website functions and your choices are respected — in particular your privacy consent and your language setting. This storage is strictly necessary for the service you have expressly requested (§ 25 (2) no. 2 TTDSG) and is not used for analytics.

9. Retention period

We process personal data only for as long as necessary for the stated purposes or as required by statutory retention periods. Server log files are deleted or anonymised after a short time. Newsletter data is stored until you unsubscribe; analytics data according to the PostHog configuration.

10. SSL/TLS encryption

For security reasons, this site uses SSL/TLS encryption. You can recognise an encrypted connection by the “https://” in your browser’s address bar.

11. Competent supervisory authority