Privacy Policy

We built this site to need as little of your data as possible. There is no advertising, no third-party analytics running by default, and no tracking across other websites. The only data we collect is what you choose to give us through our contact form, plus a small number of technical connections your browser makes automatically (described below) to run the site and, where you opt in, play an embedded video.

"Personal data" means any information that can identify you, directly or indirectly — for example your name, email address, or IP address.

The controller responsible for data processing on this website is:

Legal bases we rely on

Depending on the situation, we process your data on one of these bases:

• Consent (Art. 6(1)(a) GDPR) — e.g. if you opt in to cookie-based analytics or explicitly submit a message via our contact form.
• Pre-contractual measures / contract (Art. 6(1)(b) GDPR) — e.g. responding to a business inquiry that could lead to a partnership or supply agreement.
• Legitimate interest (Art. 6(1)(f) GDPR) — e.g. keeping the site secure, preventing spam, and understanding at a basic level how the site is used.
• Legal obligation (Art. 6(1)(c) GDPR) — e.g. statutory retention periods under German commercial or tax law.

This website is hosted by Vercel Inc., 340 Pine Street, Suite 900, San Francisco, CA 94104, USA ("Vercel"). Hosting is necessary to make the site available at all, and is based on our legitimate interest in a reliable, fast, secure website (Art. 6(1)(f) GDPR). We have entered into a data processing agreement (DPA) with Vercel that requires it to process data only on our instructions and in line with the GDPR. See Vercel's privacy policy for details.

Every visit automatically generates server log data — IP address, browser type and version, operating system, referring page, date and time of the request — which Vercel processes on our behalf to operate and secure the infrastructure. This data is not merged with any other data set we hold about you.

We use a small number of strictly necessary cookies and one local-storage entry; we do not use advertising or cross-site tracking cookies. The full breakdown — what each one is called, what it does, and how long it lasts — is in our Cookie Policy. In short:

• A local-storage entry called icodos-cookie-consent remembers your cookie choice on this device. It is set automatically only if a cookie-based analytics tool is active (see below) and never contains personal data.
• Cloudflare Turnstile, our contact-form spam filter, may store technical data needed to verify you're not a bot (necessary; see Contact form).

If you submit an inquiry through our contact form, we process the information you enter (name, email, and optionally phone, company, topic, and message) to answer your inquiry and, if relevant, follow up with you. We do not share this information other than with the service providers described here.

Processing is based on Art. 6(1)(b) GDPR where your inquiry relates to a potential contract (e.g. a partnership, supply, or licensing conversation), and otherwise on our legitimate interest in responding efficiently to inquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR) where the form asks for it; consent can be withdrawn at any time.

Spam protection — Cloudflare Turnstile

To keep the form free of automated spam, we use Cloudflare Turnstile, provided by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Turnstile runs a non-intrusive challenge in your browser and may process technical signals (such as browser characteristics) to confirm you're a human; it does not display puzzles or track you across other websites. This is based on our legitimate interest in preventing abuse of the form (Art. 6(1)(f) GDPR). See Cloudflare's privacy policy.

Email delivery — Resend

Submitted form data is transmitted to our inbox using Resend (operated by Plus Five Five, Inc., USA), an email-sending service. Resend acts as our processor under a data processing agreement and is certified under the EU-U.S. Data Privacy Framework, which provides an approved legal basis for transferring the data to the US. See Resend's privacy policy. We do not log the content of your message on our own servers.

Your submitted information is kept until you ask us to delete it, withdraw consent for its storage, or the purpose for which it was collected no longer applies — whichever comes first, subject to any statutory retention obligations.

Today, no analytics tool is switched on for this website. The site is built to optionally support the following, and this notice will be updated and, where required, a consent banner will appear before any is switched on:

• Plausible Analytics — a cookie-free analytics tool that does not collect personal data or set any cookie or local-storage entry. If enabled, it would run under our legitimate interest (Art. 6(1)(f) GDPR) without requiring consent.
• Google Analytics / Google Tag Manager — cookie-based tools that would only ever load after you actively opt in via a cookie banner (Art. 6(1)(a) GDPR). You would be able to withdraw consent at any time via a "Cookie settings" link in the footer, which only appears once such a tool is active.

YouTube videos

Some pages (e.g. Careers and the Mannheim 001 project page) show a video preview instead of an embedded player. Loading the page only fetches a static preview image from YouTube's image servers (i.ytimg.com, operated by Google), which exposes your IP address to Google but sets no cookie and starts no video. The actual player — and any related data processing by Google — only loads if you click play. It is then served from youtube-nocookie.com, YouTube's privacy-enhanced domain, which does not set advertising cookies, though playing the video may still store some technical identifiers in your browser. For EEA/UK/Swiss users, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) is the responsible controller; data may be processed further by Google LLC in the US. See Google's YouTube data notice. Loading the preview image is based on our legitimate interest in showcasing our work (Art. 6(1)(f) GDPR); clicking play is your own action and, in effect, your consent to that connection (Art. 6(1)(a) GDPR).

Location map

The map on our About page (and, where shown, on plant-design pages) is drawn from publicly available country-border data loaded at runtime from jsDelivr, a CDN operated by Volentio JSD Limited (UK). This data contains no personal information, but loading it does expose your IP address to jsDelivr as an ordinary consequence of the HTTP request. This is based on our legitimate interest in showing where we operate (Art. 6(1)(f) GDPR). The map itself is not interactive and sets no cookies.

The footer address links out to Google Maps in a new tab; that is a normal outbound link — no map is embedded and no data is exchanged with Google until you click it.

Under the GDPR, you have the right to:

• Access (Art. 15) — ask what personal data we hold about you and why.
• Rectification (Art. 16) — ask us to correct inaccurate data.
• Erasure (Art. 17) — ask us to delete your data, subject to any legal retention duties.
• Restriction of processing (Art. 18) — ask us to limit how we use your data in certain circumstances.
• Data portability (Art. 20) — receive data you provided us, or have it transferred, in a structured, machine-readable format.
• Object (Art. 21) — object at any time to processing based on legitimate interest, for reasons arising from your particular situation.
• Withdraw consent (Art. 7(3)) — with effect for the future, wherever processing is based on consent.
• Lodge a complaint (Art. 77) — with a supervisory authority; see Supervisory authority below.

To exercise any of these rights, contact us at david.strittmatter@icodos.com.

Some of the service providers described above (Vercel, Resend, Google, Cloudflare) are based in, or transfer data to, the United States. Where we rely on a US-based provider, we ensure an appropriate safeguard is in place — either the provider's certification under the EU-U.S. Data Privacy Framework, or the European Commission's Standard Contractual Clauses — so the data receives a level of protection essentially equivalent to that guaranteed within the EEA.

Unless a more specific period is stated above, we keep personal data only for as long as the purpose for which it was collected requires, or until you exercise a valid erasure request — whichever is earlier — except where we are legally required to retain it for longer (for example, German commercial and tax law can require retention of business correspondence for up to ten years).

This site is served exclusively over an encrypted HTTPS (TLS) connection. You can confirm this by checking that the address bar shows "https://" and a lock icon. Internally, we limit access to personal data to the people and processors who need it to operate the site or respond to your inquiry.

We may update this policy as the site, the law, or the tools we use change. The date at the top of this page always reflects the latest revision; material changes will be reflected here as they happen.

If you believe your data protection rights have been violated, you may lodge a complaint with a supervisory authority — in particular in the member state of your habitual residence, place of work, or the place of the alleged infringement. The authority responsible for ICODOS GmbH is: