Privacy

Controller

Legal basis and general processing principles

We process personal data only where this is necessary for communication, pre-contractual steps, contract performance, system security, or compliance with legal obligations.

Processing based on consent is carried out under Art. 6(1)(a) GDPR. Processing for contract performance or pre-contractual steps is carried out under Art. 6(1)(b) GDPR. Processing for legal obligations is carried out under Art. 6(1)(c) GDPR. Where we pursue legitimate interests, the legal basis is Art. 6(1)(f) GDPR.

Access to information stored on terminal equipment is additionally governed by Section 25 TDDDG. Non-essential cookies and comparable technologies are used only after consent.

Your rights

Data subjects have the following rights under the GDPR:

• access to personal data processed under Art. 15 GDPR,
• rectification of inaccurate or incomplete data under Art. 16 GDPR,
• erasure of personal data under Art. 17 GDPR,
• restriction of processing under Art. 18 GDPR,
• data portability under Art. 20 GDPR,
• objection to processing under Art. 21 GDPR,
• withdrawal of consent with effect for the future under Art. 7(3) GDPR.

You also have the right to lodge a complaint with a competent supervisory authority.

Hosting and server log files

This website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Further information is available in Hetzner's privacy policy:https://www.hetzner.com/legal/privacy-policy/

Server log files may include IP address, access time, requested URL, referrer URL, browser type, operating system, hostname, transferred data volume, HTTP status code, and comparable technical data. Log data is stored only as long as required for delivery, security, error analysis, or abuse prevention.

Contact form and direct contact

If you contact us through the contact form, we process the data entered there. This usually includes name, email address, company, message, and technical metadata of the submission.

The contact form is operated without an external form provider. The website sends the entered data to a same-origin endpoint at /api/contact, hosted on the Duracy/Hetzner server. From there, the message is delivered by email through the Duracy Zoho EU mailbox or Zoho SMTP service.

Form data and message content are not stored in a form database or written to server logs. For abuse prevention, the contact API stores only a secret-keyed HMAC-SHA-256 hash of the rate-limit identifier and a timestamp. It does not store raw IP addresses, email addresses, names, companies, or message content for this purpose. An hourly cleanup removes rate-limit events older than 24 hours, so technical deletion may take up to approximately 25 hours.

To protect the contact form against automated abuse, we use Cloudflare Turnstile. The provider is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Turnstile loads a security script from challenges.cloudflare.com, checks technical browser and interaction signals, and generates a verification token that our server validates with Cloudflare. This processing protects the security, spam resilience, and availability of the form and is based on our legitimate interest under Art. 6(1)(f) GDPR. Further information is available in Cloudflare'sTurnstile privacy noticeandprivacy policy.

Consent management, cookies, and comparable technologies

This website uses Cookiebot by Usercentrics to collect, manage, and document consent choices. The provider is Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark.

You can change or withdraw your consent at any time through the cookie settings below:

This includes the consent choice, time, consent ID, browser information, and technically necessary evidence data. Storing the choice is necessary to manage and demonstrate consent and is based on Art. 6(1)(c) and (f) GDPR and Section 25(2) TDDDG. The choice is requested again regularly after 12 months.

Technically necessary cookies or comparable storage may be used for consent management, security, and website operation. Non-essential cookies, local storage, tracking pixels, or comparable technologies are activated only after consent.

Analytics

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics is loaded only after your consent.

Depending on your use, Google may process IP and device information, browser data, page views, referrers, approximate location information, consent status, and the interaction events described in this notice. We do not send names, email addresses, phone numbers, companies, or message content as analytics events.

The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Without statistics consent, Google Analytics is not loaded and no analytics requests are sent to Google. You may withdraw consent at any time through the cookie settings with effect for the future.

Event and user data retention in Google Analytics is set to 14 months. Advertising storage, ads personalization, Google Signals, User-ID, and user-provided data collection are not enabled for this website.

Contact via WhatsApp

The website offers an optional link for contacting us through WhatsApp. Only when you follow that link do you leave our website and WhatsApp's privacy terms apply. The provider for users in the European Economic Area is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

If you contact us, we process your phone number, profile and communication data, and message content to respond. The legal basis is Art. 6(1)(b) GDPR for pre-contractual steps or a contract, otherwise Art. 6(1)(f) GDPR. WhatsApp acts under its own responsibility and may also process data outside the European Economic Area. Please do not send confidential documents or special categories of personal data through WhatsApp.

External resources, fonts, maps, and media

Fonts are embedded locally via Fontsource. External scripts from Cookiebot by Usercentrics or Google Analytics may be loaded for consent management and statistics. Cloudflare Turnstile is loaded for technical contact-form protection.

LinkedIn company page

This website links to Duracy's LinkedIn company page. It is a standard external link. Merely visiting this website does not transfer data to LinkedIn through that link. Neither the LinkedIn Insight Tag nor a LinkedIn plugin is integrated into this website.

If you visit or follow our LinkedIn page, interact with it, or send us a message there, LinkedIn processes personal data under its own responsibility. Under LinkedIn's terms, Duracy and LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland, are joint controllers within the meaning of Article 26 GDPR for the creation of aggregated Page Insights. For this purpose, LinkedIn processes profile data and information about how members interact with our page. Duracy only receives aggregated statistics that do not allow us to identify individual members.

Under the joint controller arrangement, LinkedIn is responsible in particular for informing data subjects and handling their rights in relation to the processing for Page Insights. You may also exercise your rights with Duracy. We forward requests concerning Page Insights to LinkedIn in accordance with the arrangement. Further details are available in thePage Insights Joint Controller Addendumand theLinkedIn Privacy Policy.

International data transfers

For individual services, processing outside the European Economic Area cannot be completely excluded. This concerns Google, Cloudflare, OpenAI, WhatsApp, and LinkedIn in particular. Where no European Commission adequacy decision applies, providers state that they rely in particular on the European Commission's Standard Contractual Clauses and supplementary safeguards. Different governmental access rights may nevertheless apply in third countries.

Customer inquiries and project processing

If an inquiry becomes a contractual relationship, we also process customer, contact, project, billing, and communication data where necessary for proposal preparation, project implementation, documentation, handover, invoicing, and support.

Duracy Assistant and website chat

This website may provide an AI-supported Duracy Assistant. The assistant answers questions about Duracy, services, industries, process, privacy, and contact based on approved website and knowledge content. Use of the assistant is voluntary.

When you use the assistant, we process the entered message, the current chat context, the generated answer, sources used, technical metadata such as timestamp, page context and request ID, and security-relevant server log data. We do not create long-term user profiles. The session is processed only in pseudonymized or hashed form.

For answer generation, inputs, conversation context, and relevant excerpts from approved sources may be transmitted to AI API service providers. This may currently include the API of OpenAI Ireland Ltd. or affiliated OpenAI companies. According to OpenAI's API terms, API inputs and outputs are not used to train models unless this is explicitly enabled. OpenAI may process API data for a limited period for service provision, security, and abuse prevention.

The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in user-friendly answers to website questions, quality assurance, security, and abuse prevention. If a request concerns pre-contractual steps, Art. 6(1)(b) GDPR may also apply.

Chat logs are stored locally on our server for operation, error analysis, quality assurance, and abuse prevention and are deleted automatically after 30 days. Please do not enter confidential information, special categories of personal data under Art. 9 GDPR, or credentials into the chat. The assistant does not make automated decisions within the meaning of Art. 22 GDPR and does not replace legal, tax, or medical advice.

AI-supported automation systems

Duracy develops AI-supported automation and assistance systems for clients. No AI-supported analysis of website visitors takes place on this website.

Which providers, models, infrastructure components, or automation services are used in a customer project is agreed and documented project by project.

Processors and service providers

We may use service providers for hosting, form processing, email, project management, accounting, development, and security. Where required, we conclude data processing agreements with these service providers.

• Hosting: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany.
• Contact form: same-origin endpoint on the Duracy/Hetzner server, email delivery through Zoho Mail/SMTP.
• Form security: Cloudflare Turnstile by Cloudflare, Inc.; technical bot-protection check for the contact form.
• Website chat and AI API: OpenAI Ireland Ltd. or affiliated OpenAI companies, where the Duracy Assistant or customer projects use OpenAI API services.
• Consent management: Cookiebot by Usercentrics, Usercentrics A/S, Copenhagen.
• Analytics: Google Analytics 4 by Google Ireland Limited; only after consent.

Technical and organizational measures

We take technical and organizational measures to protect personal data against loss, destruction, alteration, unauthorized access, and unauthorized disclosure. Depending on the processing, these include TLS encryption, access restrictions, role-based permissions, secure transfer of credentials, backups, logging, and documentation.