Privacy Policy

This is a courtesy translation of our German “Datenschutzerklärung”. In case of any discrepancy, the German version prevails.

1. Controller

The controller responsible for data processing on these pages within the meaning of the General Data Protection Regulation (GDPR) is:

E-mail: info@resilic.ai · Phone: +49 7248 927853

A data protection officer is not required by law; for any privacy questions, please contact the address above.

2. Your rights

With respect to your personal data, you have the following rights against us:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw a given consent with effect for the future (Art. 7 (3) GDPR)

You also have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data (Art. 77 GDPR).

3. Hosting and provision of the website

We host our services with Amazon Web Services (AWS) in the Frankfurt region (eu-central-1). When you access the website, the server automatically processes information transmitted by your browser (server log files): IP address, date and time of the request, page/file requested, amount of data transferred, status code, and browser type and operating system. This data is technically necessary for the secure and stable provision of the website.

To deliver the public pages (resilic.ai) and operate DNS, we additionally use Cloudflare, which processes your IP address. The legal basis is our legitimate interest in secure and efficient provision (Art. 6 (1)(f) GDPR). Where personal data is transferred to a third country, this is done on the basis of EU standard contractual clauses or an adequacy decision (EU-US Data Privacy Framework).

4. Web analytics with PostHog (consent-based)

On our public pages we use PostHog, a product-analytics tool hosted in the EU (Frankfurt). We use PostHog deliberately cookieless: no cookies are set and no data is stored persistently in your browser (in-memory only, for the duration of the page view).

We record page views (with the URL requested, referrer and any campaign parameters) and individual interaction events (e.g. starting a registration or a scope check). Your IP address is transmitted to PostHog in the process. There is no session recording, no cross-device profiling, and the data is not shared with third parties for advertising. Event data contains no plain-text search terms or other free-text personal data.

The legal basis is your consent pursuant to Art. 6 (1)(a) GDPR in conjunction with § 25 (1) TTDSG, which you give via our consent banner. Without your consent, PostHog is not loaded. You can withdraw your consent at any time with effect for the future via the “Privacy settings” link in the footer. We have concluded a data processing agreement (Art. 28 GDPR) with PostHog.

If your browser sends the “Global Privacy Control” or “Do Not Track” signal, we treat it as a decline: PostHog is not loaded and the consent dialog is not shown. An explicit decision made via “Privacy settings” in the footer takes precedence over the signal.

5. Newsletter / CRA update notifications

If you sign up for our CRA update notifications (on this website, under a blog article, when registering an organisation, or in the notification settings of the application), we process the e-mail address you provide, your chosen language, the origin of the sign-up, and the time of the sign-up and of the confirmation. We use this data solely to send you occasional information about the Cyber Resilience Act. The legal basis is your consent (Art. 6(1)(a) GDPR).

We use the double opt-in procedure: we first send you a confirmation e-mail, and only add you to the mailing list once you have confirmed. Every issue contains an unsubscribe link and a link to your preferences (language, measurement, unsubscribe). Unsubscribing takes effect immediately.

Sending and delivery information

Issues are sent through Amazon Simple Email Service (Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg) from the eu-central-1 region (Frankfurt am Main). A data processing agreement (Art. 28 GDPR) is in place with AWS. The service reports back whether an issue could be delivered, whether it bounced, or whether the recipient reported it as spam. We automatically remove bouncing and complaining addresses from the list; this is necessary to operate the list (Art. 6(1)(f) GDPR, legitimate interest in working delivery and in protecting people from unwanted e-mail).

Measurement of opens and clicks – only with your consent

Only if you additionally and separately consent (Art. 6(1)(a) GDPR) does your issue contain a single invisible image (tracking pixel) and links that are redirected through our server. This tells us whether you opened the issue and which links you clicked, each with a timestamp. We use this to improve the newsletter’s content. Without this consent your issue contains neither a pixel nor redirect links; the newsletter itself does not depend on the consent.

We store no IP addresses and no device or browser information, and we build no profiles beyond the newsletter. You give the consent through the corresponding box at sign-up, in the application’s notification settings, or via the “Preferences” link in every issue, where you can revoke it at any time with effect for the future. We keep the time of consent and of revocation as a record.

Retention

We keep the sign-up data until you unsubscribe; a confirmation request that is not confirmed within seven days expires and is deleted. To fend off automated sign-ups we check an invisible field and the fill time when the form is submitted; no additional data is stored for this. Personal delivery, open and click data per issue is deleted 90 days after the send; after that only totals per issue without personal reference remain (for example the number of deliveries, opens and clicks). An address suppressed after a bounce or a spam report stays stored with the reason so that we do not write to it again until you sign up anew.

6. Registration and user account

To use the application (app.resilic.ai) you can create an account. We process the master and contact data required for provision (in particular name and e-mail address) to perform the pre-contractual or contractual relationship pursuant to Art. 6 (1)(b) GDPR. Sign-in is managed via our self-operated identity service (Keycloak) within the EU. Payment data for paid plans is processed only upon conclusion of a contract via our payment service provider.

7. Contacting us

If you contact us by e-mail, we process your details in order to handle the request. The legal basis is Art. 6 (1)(b) GDPR where your request serves to perform a contract or pre-contractual measures, and otherwise our legitimate interest in responding to the request (Art. 6 (1)(f) GDPR).

8. Cookies and local storage

We do not use tracking cookies. We store technically necessary information in your browser’s local storage and in a single strictly necessary cookie (“aegis_consent”, valid for twelve months, for resilic.ai and its subdomains) so that the website functions and your choices are respected — in particular your privacy consent and your language setting. This storage is strictly necessary for the service you have expressly requested (§ 25 (2) no. 2 TTDSG) and is not used for analytics.

9. Retention period

We process personal data only for as long as necessary for the stated purposes or as required by statutory retention periods. Server log files are deleted or anonymised after a short time. Newsletter data is stored until you unsubscribe, personal delivery and measurement data per issue for 90 days (see section 5); analytics data according to the PostHog configuration.

10. SSL/TLS encryption

For security reasons, this site uses SSL/TLS encryption. You can recognise an encrypted connection by the “https://” in your browser’s address bar.

11. Competent supervisory authority