Privacy

Last updated: November 2026. This English version is a convenience translation. Only the German version is legally binding.

This statement explains which data arise when you visit this website and when you are in contact with us, what they are processed for and what rights you have. It describes only what we actually do.

Who is responsible

Essential Advertising GmbH
Adenauerallee 2, 61440 Oberursel (Taunus), Germany
Represented by Daniel Klantke, Managing Director
Phone: +49 6172 90 84 747
Email: hello@lindenbrook.ai

The lindenbrook brand is used by Essential Advertising GmbH under licence.

We have not appointed a data protection officer because the requirements of Art. 37 GDPR and Section 38 BDSG are not met. The contact for all data protection questions is the managing director at the address above.

What happens when you visit this site

When you open this site, your browser transmits technically necessary information to the server: your IP address, the date and time of the request, the address requested, the amount of data transferred, the message on whether the request succeeded, the referring page as well as browser and operating system. Without this information the site cannot be delivered.

It is stored in the server's log files and serves solely the secure operation of the site, in particular detecting faults and attacks. It is not combined with other data and not evaluated in relation to you.

The legal basis is Art. 6 (1) (f) GDPR, our legitimate interest in the secure and functioning operation of this website. The logs are deleted after 30 days at the latest.

Visitor counts without cookies

This site sets no cookies and stores nothing on your device to recognise you. There is no Google Analytics, no Meta pixel and no recognition across devices. The exceptions are the AI check, which keeps your answers in your browser for the duration of the session (see the section on booking), and the photo gallery and project room, which remember your selection on your device (see the section on the gallery and project room).

We do, however, count which pages are visited. We record: the page visited, its title and language, the type of your device, browser and operating system, the width of the browser window, the country and city of access and the website you came from, and only its address without any additions. If the address you opened contains campaign information (utm parameters), we store that as well. We also count clicks on individual paths such as booking, contact or language switching, together with the label of the link clicked, whether an AI check was started and completed (without your answers), which questions of the AI check were reached (again without your answers), for a completed AI check its result (the AI potential as a percentage, the level, the estimated hours per week and the selected industry, without your individual answers and without any details about you), whether the booking, contact or enquiry form was started (without your entries), whether a booking or enquiry was sent and whether a form reported an error, for example which required field was missing. We also record how far a page was read and how it is used, for example which buttons and links are clicked, which sections are viewed and whether errors occur. We do not record what you type into form fields, nor mouse movements or screen recordings. When a known AI crawler such as GPTBot or ClaudeBot requests a page, we store its name, the page and the time, without an IP address.

Your IP address is not stored. Our host Vercel derives the country and city from it. If the IP address belongs to a company or an institution with its own network, we look up in the public Domain Name System (DNS) under which name the network is registered, and store only the web address of the organisation, for example beispiel.de. For private connections and mobile networks we store nothing of this kind. From it, your device information, the date of the day and a secret known only to us, an identifier is calculated. Only this identifier is stored. It cannot be reversed and changes every night. This lets us group the visits of one day, but not recognise you across several days.

If you write to us via the form or book an appointment, we link your enquiry to the page views of that one day. More on this in the section on the contact form.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in understanding which content is needed and where the site does not work. The data is processed in the European Union, by Supabase in the Frankfurt area. It is deleted after 24 months, not sold and not used for advertising. When a personal proposal page under /fuer/, /vorschlag/ or /vorschau/ or a demo under /demo/ is opened, we receive an email with the page, time, type of device, country and referrer. It is sent via Resend, see the section on the contact form. We also note the visit, with time, device type and country, with the matching case in our customer records. On these pages we also record how long the page was visible, as a number of seconds, and note it with the case as well. For demos, we also see visits and their duration in our internal project overview. There we also see the sequence of each visit.

Some demos only open once you have confirmed that you will use them solely to evaluate working with us. We store this confirmation with the page, the version of the text, the time, the type of device and the country, and note it with the matching case in our customer records. So that the question does not appear on every visit, your browser keeps the confirmation in its local storage. This is permitted without consent under Section 25 (2) no. 2 TDDDG. We also store the confirmation if your browser sends an opt-out signal, because it is not a count but part of our agreement.

The legal basis is Art. 6 (1) (b) GDPR, otherwise our legitimate interest in being able to prove the agreement (Art. 6 (1) (f) GDPR). We delete the confirmation three years after the end of the year in which you confirmed, because claims under the agreement can become time-barred only then.

If your browser sends the “Do Not Track” setting or an objection signal such as Global Privacy Control, we do not count you. You can also object to the counting at any time without giving reasons. A message to hello@lindenbrook.ai is enough.

You will still not see a consent banner. In our assessment, visitor counting does not require consent under Section 25 TDDDG: it stores nothing on your device and reads neither cookies nor any other stored entries from your browser. It only uses information that your browser provides to the page anyway when it loads: the page you came from, the width of the window, how far you scroll, what you click on the page, how long a page is visible and whether your browser sends an opt-out signal. Only on our own devices do we set a cookie (lb_intern) so that our own visits are not counted.

No connections to third-party servers

We deliver fonts, images, videos and program code entirely from our own server. Opening this site establishes no connection to Google Fonts, to a third-party delivery network or to a social network. No maps, no third-party video players and no social media buttons are embedded. Booking also runs on our own server, without an embedded window from a booking service.

Your IP address is therefore passed on to no one other than the provider that delivers this site.

One exception is subscribing to the newsletter in our guides: only when you submit the form does your browser send your email address to bemailed.de, our newsletter service. Merely visiting the page does not do this.

A further exception is the photo gallery we provide to individual clients: your browser loads the photos directly from storage operated by Supabase, Inc. in a data centre in Frankfurt am Main. Supabase thereby learns your IP address. Supabase is our processor under Art. 28 GDPR.

Another exception are our voice demos: as soon as you start a conversation there, your browser connects directly to ElevenLabs or OpenAI. See the section on voice demos.

A further exception is the application form on our careers page: if you upload documents there, your browser sends the files directly to non-public storage of Supabase, Inc. in Frankfurt am Main. In doing so Supabase learns your IP address. See the section on applications.

When you write to us

Through our contact form we process the information you provide there: your name, your email address, your phone number for call-backs, your company, if you wish the topic, and your message. If you enquire about a workshop, the format, the number of participants, whether on site or online and, if you wish, the location and preferred period are added. We use the information to answer your enquiry. The enquiry is delivered as an email and also stored in our customer records.

Our customer records are a database of our own, hosted by Supabase, Inc. in a data centre in Frankfurt am Main, to which only lindenbrook has access. There we record enquiries, bookings and sign-ups for worksheets. If a conversation or a collaboration follows, contact persons, notes and the history of our emails and appointments with you are added. To see how you found us, we link your enquiry to the page views of the same day: the website you came from and the pages you read before. This uses the identifier described in the section on visitor numbers and does not extend beyond that one day.

The legal basis is Art. 6(1)(b) GDPR where the preparation or performance of a contract is concerned, and otherwise Art. 6(1)(f) GDPR. Our legitimate interest is handling enquiries reliably and understanding which paths lead to us. We delete information about you 36 months after the last contact, or, if we work together, 36 months after the last assignment, because claims arising from it can become time-barred only then. Every new contact restarts the period. Records we are required by law to keep, such as business letters for six years and accounting records for eight years, are deleted only after that. Information about the company itself, such as its name, sector and the history of a project, is not personal data and is retained. For sole traders and freelancers we also remove the name, location and website.

We use Resend, a service of Resend Inc., 2261 Market Street, San Francisco, CA 94114, United States, for sending. Resend is our processor under Art. 28 GDPR. Two emails are sent: your enquiry to us and an acknowledgement to you that does not repeat your message. Our mailbox is hosted by Microsoft 365, a service of Microsoft Ireland Operations Limited, in data centres in the European Union. Microsoft is our processor pursuant to Art. 28 GDPR. Where data may reach the United States or Singapore in the process, we base the transfer on the European Commission's standard contractual clauses (Art. 46 (2) (c) GDPR), which form part of the respective data processing agreement, and, for providers certified under the EU-US Data Privacy Framework, additionally on the Commission's adequacy decision (Art. 45 GDPR).

If you contact us directly by email or phone instead, we process your information in the same way: only to answer your enquiry.

To protect against spam and automated requests, when you submit the contact form or a booking we check whether the request comes from our website, how long it took to fill in and whether the text shows typical signs of spam. We also store, for no more than 15 days, a code that is calculated with a secret key from your IP address (for IPv6, from its network range) and from your email address. Neither the IP address nor the email address can be recovered from this code. Its only purpose is to limit the number of requests from the same sender within a short time, and it is kept in the same database as the bookings, see the following section. Requests that are clearly automated are discarded. If a request only looks suspicious, we still deliver it but send no confirmation. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is protecting our forms against misuse.

For your enquiry, the deletion period from the paragraph on our customer records above applies.

A message to us does not sign you up to any mailing list. That would require a separate registration that you would have to make yourself.

When we handle enquiries with AI

To handle emails, enquiries, appointments and entries in our customer records, we use an AI assistant from a specialised provider. It reads the email or entry in question and suggests a reply, a summary or an entry. We check and decide ourselves what is sent to you and what we record. We do not make decisions based solely on automated processing (Art. 22 GDPR).

The provider is our processor pursuant to Art. 28 GDPR and, under our contract, does not use the content to train its models. Processing also takes place in the United States. We base the transfer on the European Commission's standard contractual clauses (Art. 46 (2) (c) GDPR), which form part of the data processing agreement. We will tell you which provider we use on request.

The legal basis is the same as for the enquiry in question, i.e. Art. 6 (1) (b) GDPR where it concerns initiating or performing a contract, otherwise Art. 6 (1) (f) GDPR. Our legitimate interest lies in answering enquiries quickly and carefully.

When we approach you

We approach companies and organisations for which our work may be a good fit: by email, via LinkedIn or after meeting at an event. For this we process business contact details such as name, position, company, business email address and phone number, as well as information about the company such as sector and location. The data come from publicly accessible sources such as company websites, the commercial register, association and industry directories and LinkedIn, or from you, for example from your business card. In addition, there is the history of our messages and brief notes on our conversation. Everything is kept in our customer records, see the section “When you write to us”.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is to make potential clients and partners aware of our work (Recital 47 GDPR). You can object to this at any time; a short reply is enough. We will then no longer approach you and note your address on a block list so that it stays that way. The list only holds a checksum from which the address cannot be recovered. If no conversation follows, we delete the details about you 36 months after the last contact.

When you book an appointment

On the booking page you can choose a time for a free AI conversation. The selection runs on our own server. No booking service is embedded, opening the page establishes no connection to a third-party provider and no cookies are set.

We process the information you provide: the chosen time, whether you want a phone call or a video call, your name, your email address and, if you give them, your company and your phone number as well as an optional note. We use it exclusively to confirm and hold the appointment. The legal basis is Art. 6 (1) (b) GDPR, because the booking serves to initiate a contract.

So that an appointment cannot be given out twice, we store the booking in a database. It is hosted by Supabase, Inc., 970 Toa Payoh North, Singapore, in a data centre in Frankfurt am Main. Supabase is our processor under Art. 28 GDPR. Only lindenbrook has access to the stored information. The website itself cannot read it.

Before an appointment is final, you confirm it via a link we send you by email. Until then we hold the time for you for 30 minutes. If you do not confirm it, we release it again. Your details then remain in our customer records for seven more days so that we can get in touch if the email did not reach you, and are deleted afterwards. This prevents anyone from blocking appointments with someone else's or made-up addresses.

We also add the booking to our customer records. What is stored there and when we delete it is described in the section on the contact form.

In addition, we send two emails: the booking to us and a confirmation to you. For this we use the same service provider as for the contact form, see the previous section. The appointment is then entered in our calendar, which is hosted by Microsoft Ireland Operations Limited in data centres in the European Union. Microsoft is our processor under Art. 28 GDPR. If you chose a video call, we invite you to a Microsoft Teams meeting. Your email address is passed on to Microsoft for this.

If you completed the AI check beforehand, the booking page offers to send along a summary of your result. Until then, this summary is held only in your browser, in session storage, and is deleted as soon as you close the window. It only reaches us if you leave the box ticked and submit the booking. You see the full text on the page beforehand. After that it is treated like the rest of the appointment data.

The AI check stores your answers and, at the end, the summary in your browser's session storage (the entries lb-kicheck-stand and lb-kicheck). This lets you continue the check after changing pages and carry the result over to the booking. Both remain on your device, are not transmitted to us and are deleted as soon as you close the window. If you leave the check unused for two hours, the page discards both the next time it is opened. This storage is permitted without consent under Section 25 (2) no. 2 TDDDG, because it is necessary for the function you requested. As long as you only fill in the check, your answers do not leave your browser.

We delete the booking itself six months after the appointment. For the entry in our customer records, the period from the section on the contact form applies.

You do not have to use online booking. You can reach us just as well via the contact form, by email or by phone.

Below most articles in our guides you can request a worksheet as a PDF. To do so, you subscribe to our newsletter. We process your email address and the article through which you subscribed. Your subscription only takes effect once you click the link in our confirmation email (double opt-in). The link then takes you back to this website, where the PDF is ready for you. To be able to prove your consent, we store the time, IP address and browser identifier of the subscription and of the confirmation.

The legal basis is your consent pursuant to Art. 6 (1) (a) GDPR. You can withdraw it at any time, via the unsubscribe link in every issue or by emailing hello@lindenbrook.ai. After that we will no longer send you the newsletter. We then note your address on a suppression list so that we do not contact you again by mistake.

In the newsletter we evaluate whether an issue is opened and which links in it are clicked, as well as the approximate location derived from the IP address and the email program used. This shows us which topics resonate. This evaluation is part of the consent you give when subscribing and ends when you unsubscribe.

For subscriptions and sending we use bemailed, our own newsletter service. Like lindenbrook, bemailed is operated by Essential Advertising GmbH. The data is stored in a database of Supabase, Inc. in a data centre in Frankfurt am Main, Germany. We send the issues via Amazon Web Services EMEA SARL (Amazon SES, Frankfurt region) and the confirmation email via Resend Inc., 2261 Market Street, San Francisco, United States. The application itself is operated by Vercel Inc. in the Frankfurt region. All four are processors for us pursuant to Art. 28 GDPR. Transfers to the United States are covered by the standard contractual clauses of the EU Commission.

On the home page you can also subscribe to our monthly newsletter Above the Noise. We operate this subscription ourselves, without bemailed. We process your email address and the page on which you subscribed. Your subscription only takes effect once you open the link in our confirmation email and confirm the subscription there (double opt-in). To be able to prove your consent, we store the time, IP address and browser identifier of the subscription and of the confirmation. We delete unconfirmed subscriptions after 30 days. If you unsubscribe, we delete this evidence and note your address on a suppression list. The data is stored in our database at Supabase, Inc. in a data centre in Frankfurt am Main, Germany, and we send the emails via Resend Inc., San Francisco, United States (standard contractual clauses). Both are processors for us pursuant to Art. 28 GDPR. Legal basis and withdrawal as above.

If you sign up for the KI-Update

For the KI-Update, our online round for exchanging views on artificial intelligence, we process the details from the sign-up form: your first and last name, your email address, the dates you choose and, if you provide them, your company and a topic you would like to bring. We use them to allocate the places and to send you the confirmation with the link to the round and a calendar file, a reminder the day before and, where necessary, a message about a place that has become free or a cancellation. We also receive a notification of your sign-up. The legal basis is Art. 6 (1) (b) GDPR, because you are registering for an event. We do not use the details for advertising.

You confirm your place via a link we email you after signing up. Only then do we allocate the place and send the link to the round. If you do not confirm the sign-up within 24 hours, we delete it.

We store the sign-ups in the same database as the bookings, with Supabase, Inc. in a data centre in Frankfurt am Main, see the section on booking an appointment. We send the emails via Resend, see the section on the contact form. The same spam protection applies there. If a sign-up looks suspicious, we review it before sending any email. We delete your sign-up six months after the respective date. You can cancel at any time via the link in your confirmation.

The round takes place in Microsoft Teams, a service of Microsoft Ireland Operations Limited. Microsoft is our processor pursuant to Art. 28 GDPR. When you take part, Microsoft processes the name you join with and your image and sound, if you switch on your camera and microphone. Other participants see your name and, if you switch it on, your image. The round is not recorded.

Gallery and project room

We provide individual clients with a photo gallery or a project room. You open either via a personal link with a key that we send you. Our server checks the key and only then releases the content.

So that you do not have to open the link again every time, your browser keeps the project room key and your ticks in its local storage until you delete the site data in your browser. In the gallery, it keeps your selection and where you left off there. Under Section 25 (2) No. 2 TDDDG this storage is permitted without consent because it is necessary for the function you requested.

If you select photos in the gallery, comment on an edited photo there or send feedback in the project room, we store this in the same database as bookings and receive an email about it. If you download edited photos in the gallery, we only note which photo or how many photos and when, without any further details about you or your device. The legal basis is Art. 6 (1) (b) GDPR, because it concerns the performance of our assignment. We delete the information two years after the project is completed, so that follow-up questions and warranty are covered, and later only where retention obligations require it.

In the project room you can also upload files and submit login details. The files are kept in non-public storage at Supabase in Frankfurt am Main. We encrypt login details before they are stored. They can be viewed exactly once on our side and are deleted afterwards, at the latest after 14 days. When a project room is opened, we receive an email with the time, type of device (phone, tablet or computer), operating system, browser, screen size and the approximate location (city, region and country), at most once every three hours. Our host Vercel derives the location from the IP address. We store neither the location nor the IP address. So that we can see when a project room was last used, we store each opening with the time and type of device and delete this information after twelve months. With each opening we also store the duration of the visit, the sections viewed and whether the website or a demonstration was opened. When the project room is closed again, a second email follows with the length of the visit, the sections viewed and whether the website or a demo was opened. Both emails are sent via Resend, see the section on the contact form. The legal basis here is also Art. 6 (1) (b) GDPR.

In the project room you can switch on notifications. For this we store the email address you enter, together with the time of entry and of confirmation. Only after you have confirmed the link in our email do we send you short notes about new items in the project room, and only when we trigger a note individually. We send these emails via Resend, see the section on the contact form. You can switch notifications off at any time in the project room or via the link in every email. We do not use unconfirmed addresses, and we delete the address when the project room is closed. The legal basis is your consent under Art. 6 (1) (a) GDPR, which you can withdraw at any time with effect for the future.

Photo galleries and face search

We provide photo galleries for our clients, for example of events, photo shoots or projects. Our clients can share such a gallery with others, for example with guests, employees or participants. It can only be reached via a link that we or our clients pass on, and it is not indexed by search engines. Your browser loads the photos from storage at Supabase in Frankfurt am Main, as described in the section “No connections to third-party servers”.

Some galleries offer a search for photos in which you appear. It only begins once you expressly agree and then choose or take a photo of yourself. Your browser then calculates facial features from your photo and from the photos in the gallery and compares them. This happens entirely on your device: your photo and the facial features are neither transmitted to us nor to third parties and are not stored anywhere. When you close or reload the page, they are discarded. Your browser loads the program files and recognition models from lindenbrook.ai, not from third-party servers. We do not create a database of faces.

Facial features are biometric data. The legal basis for the search is therefore your explicit consent under Art. 6 (1) (a) and Art. 9 (2) (a) GDPR. You can withdraw it at any time by cancelling the search or closing the page. Without consent you can view and download all photos as usual.

Depending on the gallery, you can download photos individually, by section, as your own selection or all together. Before the first download you confirm the terms of use. The page only keeps this confirmation while it is open and does not store it.

We count visits to these galleries as described in the section on visitor counts. In addition we count individual steps: whether photos were downloaded or saved to the device and by which route (all, one section, your own selection, search results or a single photo) together with the number of photos, whether a face search was started and finished together with the number of matches, and whether the language was switched. If you download a single photo, we record which photo it was, so that we can see which photos are in demand. We do not record which photos a search found, your photo or facial features. When a gallery is opened, we receive an email with the gallery, time, type of device, language, country and referrer, at most once a day per visitor. It is sent via Resend, see the section on the contact form. The legal basis, deletion period and right to object are the same as for visitor counting.

Voice demos

We show selected prospective clients applications as a demo, for example a spoken learning dialogue at lindenbrook.ai/demo/lerndialog. A demo can only be reached via a link with an access code and is not indexed by search engines. Before you speak, your browser asks for access to the microphone. Without it you can type instead of speaking.

During the conversation your browser transmits your speech directly to ElevenLabs. ElevenLabs recognises what is said and speaks the reply with a synthetic voice. The reply is worded by a language model from Anthropic: for this, ElevenLabs sends the conversation as text to our server, which passes it on to Anthropic. If this route fails, a language model provided by ElevenLabs words the reply. In doing so ElevenLabs learns your IP address. So that your conversation partner can address you properly, our server sends your name and your answers from the introduction to ElevenLabs at the start. No audio recording is stored; ElevenLabs deletes the written transcript after 30 days. If you type instead of speaking, ElevenLabs is not involved: your answers are then sent as text via our server to Anthropic. On request a demo can also run entirely via OpenAI. Your browser then transmits your speech directly to OpenAI.

So that a learning summary can be created at the end, our server sends your answers to the theses as text to Anthropic, where a language model assesses them. If you upload your own material, your browser reads the files itself. The text is sent via our server to Anthropic to create theses and, where it helps, simple illustrations from it and to check the explanations against the material. For photos and scanned pages, the image of the page is also sent to Anthropic so that the text on it can be recognised. If a demo is set up without Anthropic, OpenAI takes over both tasks.

So that a course works on any device via its link, we store courses created from uploaded material in a non-public storage at Vercel in Frankfurt: the course name, theses, approvals, the extracted text and the page images of the material. Students only see the approved theses and the matching passages. Only the browser that created a course can change or delete it. On request we also delete a course ourselves. Otherwise it remains stored until it is deleted.

We do not store any conversation content ourselves. Your name, your answers and the learning summary stay only in your browser and are discarded as soon as you close or reload the page. So that the next round brings different theses, your browser remembers which theses have already been discussed until you close the tab. Anyone who opens the same link later sees none of it. ElevenLabs, OpenAI and Anthropic are our processors pursuant to Art. 28 GDPR. All three also process data in the United States. As described in the section on who delivers this site, we base the transfer on the EU Commission's standard contractual clauses and, where the provider is certified, on the EU-US Data Privacy Framework.

Using the feedback button you can voluntarily send us a text and, if you would like a reply, your email address. Only the view, the device and the time are sent along, nothing from the conversation. We store the feedback in the same storage at Vercel and receive it by email via Resend.

After a conversation you can voluntarily answer four short questions about how you experienced the demo and add a text. We store the answers without your name and without details of your device in the same storage at Vercel, together with a few details of the conversation, such as its topic and result, and evaluate them in aggregate. If the conversation belongs to a course, the lecturer may receive this evaluation. Please do not write anything in the text field that could identify you.

The legal basis is Art. 6 (1) (b) GDPR where we show the demo to prepare a collaboration, otherwise our legitimate interest in demonstrating our applications (Art. 6 (1) (f) GDPR). Please do not mention any personal data in the conversation. We count visits to and individual steps of a demo, for example whether a conversation was started, how many theses were discussed and whether the learning summary was shown, as described in the section on visitor counts, without any content. When a demo is opened, we receive an email with the page, time, type of device, country and referrer. It is sent via Resend, see the section on the contact form.

If you apply to us

Using the form on our careers page you can apply for an internship, a working student position, a final thesis or for our network, or send a speculative application. We process the details you provide: your name, your email address, your phone number if you wish, depending on the position your university, degree programme, period, hours, degree, topic idea, website or portfolio, as well as your CV, your cover letter and further documents you upload. We use them solely to review your application and to get in touch with you.

Your browser sends your documents via an address that is valid only for that one file directly to non-public storage at Supabase, Inc. in a data centre in Frankfurt am Main. We store your details in our database at the same location. We receive an email with your details; the documents are not attached. They can only be opened in our protected administration area, via addresses that are valid for five minutes. Every access is logged there. You receive a confirmation of receipt by email. Both emails are sent via Resend, see the section on the contact form. Supabase and Resend are our processors pursuant to Art. 28 GDPR.

The legal basis is Art. 6 (1) (b) GDPR, as your application serves to initiate an employment or contractor relationship. To prevent misuse, we limit the number of applications per connection and email address as described for the contact form, without storing your IP address. The legal basis for this is our legitimate interest in a secure form (Art. 6 (1) (f) GDPR).

After a rejection or an offer, we delete your application including all documents six months after the process ends. This allows us to defend ourselves against possible claims, for example under the German General Equal Treatment Act. If we start working together, we transfer the necessary documents to the records of that collaboration. If a process has not been concluded after twelve months, we also delete the application. Files that were uploaded but not sent are deleted after 24 hours.

If you consent in the form, we keep your application for twelve months after the process ends and may contact you about a later suitable position (talent pool, Art. 6 (1) (a) GDPR). This consent is voluntary. You can withdraw it at any time with effect for the future; an email to hello@lindenbrook.ai is sufficient. The six-month period then applies.

lindenbrook has a profile on Instagram and a company page on LinkedIn. Instagram is a service of Meta Platforms Ireland Limited, LinkedIn a service of LinkedIn Ireland Unlimited Company. When you visit these profiles, Meta and LinkedIn process your data in accordance with their own privacy policies, including in the United States.

For the statistics the networks show us about our profiles, such as reach and rough information on the origin and industry of visitors, we are jointly responsible with Meta and LinkedIn respectively (Art. 26 GDPR). We only see these statistics in aggregated form, not for individual persons. The agreements are available from Meta and from LinkedIn. Under them, the networks handle access requests and your other rights. You can, however, also contact us and we will pass on your request.

If you write to us via one of the networks, we process your message like an email, see the section “When you write to us”. The legal basis for our profiles is Art. 6 (1) (f) GDPR. Our legitimate interest is to inform about our work and to be reachable.

Who delivers this site

This site runs on the infrastructure of Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, United States. It is delivered from data centres in the European Union, located in Frankfurt am Main. Vercel is our processor; a data processing agreement under Art. 28 GDPR is in place. Where data may reach the United States or Singapore in the process, we base the transfer on the European Commission's standard contractual clauses (Art. 46 (2) (c) GDPR), which form part of the respective data processing agreement, and, for providers certified under the EU-US Data Privacy Framework, additionally on the Commission's adequacy decision (Art. 45 GDPR). The same applies to Supabase, see the section on booking an appointment.

Your rights

At any time you have the right to:

access the data stored about you (Art. 15 GDPR)
have incorrect data corrected (Art. 16 GDPR)
have data erased (Art. 17 GDPR)
restrict processing (Art. 18 GDPR)
receive your data in a portable format (Art. 20 GDPR)
object to processing based on legitimate interests (Art. 21 GDPR)
withdraw consent with effect for the future (Art. 7 (3) GDPR)

Right to object: Where we process data on the basis of our legitimate interest (Art. 6 (1) (f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds. You may object to visitor counting without giving reasons.

An informal message to hello@lindenbrook.ai is enough. We reply within one month.

You can also lodge a complaint with a supervisory authority. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.

Security

Transmission is always encrypted via HTTPS. Access to data is limited to what is necessary.

Changes

We update this statement as soon as our data processing or the legal situation changes. The current version is always available here.