Data Protection Provisions (Effective 1 January 2027)

As of: 1 January 2027.

In the event of discrepancies, the German version prevails.

With these privacy notices, we inform you about our handling of your personal data and your rights under the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). isento GmbH is the controller for data processing (referred to below as “we” or “us”).

I. General Information

1. Contact

For questions or suggestions regarding these notices, or to exercise your rights, please contact:

isento GmbH
Ostendstraße 242
90482 Nuremberg, Germany
Phone: +49 (0) 911 – 21 77 38 70
Email: info@isento.de
Website: www.isento.de

2. Storage Period

Unless stated otherwise below, we store data only for as long as necessary to achieve the processing purpose or to fulfil contractual or statutory obligations. We retain data connected with consent that must be demonstrable and with complaint and claim matters for the applicable statutory limitation periods. We delete data stored for marketing purposes if you object to that processing.

3. Categories of Data Recipients

We use processors for hosting, email delivery, IT maintenance and support, customer and order management, billing and accounting, and marketing activities. We may also transmit personal data to delivery services, banks, tax advisers/auditors or tax authorities. Further recipients may arise from the following information.

4. Transfers to Third Countries

Our processing may involve transfers of personal data to third countries, i.e. countries where the GDPR does not apply. Such transfers take place lawfully where the European Commission has determined an adequate level of protection, where suitable safeguards pursuant to Art. 46 GDPR are in place, or where an exception pursuant to Art. 49 GDPR applies.

Unless otherwise stated below, we use EU Standard Contractual Clauses as suitable safeguards for transfers to third countries.

5. Processing When You Exercise Your Rights

When you exercise your rights under Art. 15 to 22 GDPR, we process the data you provide to implement those rights and document our response. We process data stored to provide or prepare information only for that purpose and data-protection controls and otherwise restrict processing in accordance with Art. 18 GDPR.

The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 15 to 22 GDPR and Section 34(2) BDSG.

6. Your Rights

As a data subject, you have the following rights:

• access pursuant to Art. 15 GDPR and Section 34 BDSG;
• rectification pursuant to Art. 16 GDPR;
• erasure pursuant to Art. 17 GDPR and Section 35 BDSG;
• restriction of processing pursuant to Art. 18 GDPR;
• data portability pursuant to Art. 20 GDPR;
• withdrawal of consent at any time pursuant to Art. 7(3) GDPR, without affecting the lawfulness of processing before withdrawal;
• complaint to a supervisory authority pursuant to Art. 77 GDPR.

The competent supervisory authority for isento GmbH is:

Bavarian Data Protection Authority (BayLDA)
Promenade 18
91522 Ansbach, Germany
https://www.lda.bayern.de

7. Right to Object

You may object, on grounds relating to your particular situation, to processing based on Art. 6(1)(e) or (f) GDPR pursuant to Art. 21(1) GDPR. If we process personal data for direct marketing, you may object at any time pursuant to Art. 21(2) and (3) GDPR.

8. Data Protection Officer

You may contact our Data Protection Officer at:

Jörg ter Beek
Cortina Consult GmbH
Hafenweg 24, 48155 Münster, Germany
https://www.cortina-consult.com
Email: dsb.isento@cortina-consult.de

II. Data Processing on Our Website and Platform

When using the website, we collect information you provide and certain information automatically generated by your use. IP addresses are generally personal data.

1. Server Log Files

When the website is used for information only, we automatically store information transmitted by the browser: browser type/version, operating system, page visited, referrer URL, IP address, date and time of request, and HTTP status code.

Processing serves our legitimate interests in technical administration and website security and is based on Art. 6(1)(f) GDPR. The log data are deleted after seven days unless specific indications establish a justified suspicion of unlawful use requiring further examination. We cannot identify you from this information alone; Art. 15 to 22 GDPR therefore do not apply pursuant to Art. 11(2) GDPR unless you provide additional information enabling identification.

2. Contact Options and Enquiries

Our website includes contact forms. Transmission is encrypted. Mandatory data are required to process an enquiry; without them, we cannot process it. Additional data are voluntary. You may alternatively contact us by email.

Support requests submitted through a support form within the TRYB platform are processed as tickets in Jira Service Management on Atlassian Cloud. This includes the contact, account and support information contained in the request and, where applicable, technical information required for error analysis. The legal basis is Art. 6(1)(b) GDPR where the request concerns performance of the contract and otherwise Art. 6(1)(f) GDPR. Our legitimate interest is the efficient handling of support requests and ensuring the functionality and security of TRYB.

Where an enquiry relates to the conclusion or performance of a contract, the legal basis is Art. 6(1)(b) GDPR. Otherwise, the legal basis is Art. 6(1)(f) GDPR based on our legitimate interest in communicating with persons making enquiries.

3. Registration

Registration is required to use the TRYB platform and its functions. The required registration data are shown in the input form. Mandatory data are necessary to complete registration and are processed to provide the service. The legal basis is Art. 6(1)(b) GDPR.

4. Orders

Where you order a product or service through the website, we process the personal data you enter and, where applicable, payment information exclusively to perform the contract and provide the ordered product or service. Mandatory data are required; without them we cannot process the order. The legal basis is Art. 6(1)(b) GDPR.

5. Payment Service Provider

Stripe and Payment Methods Offered Through Stripe

We use Stripe Payments Europe, Ltd. (Ireland, EU) as payment service provider for payment processing. Depending on availability and the customer’s selection, payment methods offered through Stripe may include credit and debit cards, Apple Pay, Google Pay and PayPal.

We transmit the data required for payment processing to Stripe insofar as this is necessary to carry out the payment. Stripe processes payment data under its own data-protection responsibility. When a payment method offered through Stripe is selected, payment data may also be transmitted to, and processed by, the relevant provider of that payment method under its own privacy policy. The legal basis for the transmission and processing required for payment processing is Art. 6(1)(b) GDPR.

In addition, Stripe may be required as a payment institution to process and retain certain personal data for identity verification and fraud and anti-money-laundering prevention. The legal basis is Art. 6(1)(c) GDPR in conjunction with the applicable legal obligations.

Further information about Stripe’s data processing is available at: https://stripe.com/de/privacy

The privacy policy of the selected payment-method provider applies in addition to its processing.

6. Use of the TRYB Platform and AI Model Training

a) Purpose and Scope of Processing

TRYB is a cloud-based platform for creating, configuring and conducting training runs for AI models, in particular in supervised learning and reinforcement learning.

To provide TRYB and conduct training runs, we process in particular:

• master and contact data, including name, email address, user identifier and account data;
• contract, billing and payment data required for paid functions;
• image data, files, annotations and other training data uploaded by, or on behalf of, the user;
• technical training IDs and project, configuration and log data;
• technical operational, security and performance data, including error messages, runtime and resource data and training metrics.

Training data originate from uploads by the user or other persons authorised to use a project. Processing serves account administration, contract performance, provision and security of the platform, AI model training, error analysis, quality assurance and technical development of TRYB.

b) Legal Bases and Data Protection Roles

We process master, contract, payment and account data to perform the user contract under Art. 6(1)(b) GDPR.

Where isento processes personal training data on documented instructions for business customers, processing takes place under a data processing agreement pursuant to Art. 28 GDPR. The relevant business customer remains responsible for lawfully providing and processing the training data.

Where training images or other training data contain third-party personal data, particularly depictions of identifiable persons, the user or responsible customer must ensure a lawful basis under the GDPR and fulfil applicable information duties.

Where technical log, security and performance data are not necessary for contract performance, the legal basis is Art. 6(1)(f) GDPR. Our legitimate interests are security, stability and functionality of TRYB, error analysis, capacity planning and technical development.

c) Infrastructure, Training Regions and Recipients

The TRYB platform application is hosted by Hetzner Online GmbH, Germany. Hetzner provides platform hosting and has no direct access to image and training data stored in Google Cloud.

For AI training and storage of image and training data, we use Google Cloud. Google Cloud EMEA Limited, Ireland, acts as processor. Depending on the selected training region, Google affiliates, particularly Google LLC, USA, may have access possibilities in providing the service.

Image and training data may in particular be processed in the following Google Cloud regions:

• European Union: europe-west4 (Netherlands);
• United Kingdom: europe-west2 (London);
• United States: us-central1, us-east1, us-east4 and us-west1.

Training runs may by default use international computing resources. Users may expressly choose in their profile or at organisation level to restrict processing of their image and training data exclusively to regions within the European Union. Where this EU restriction is enabled, no regions outside the European Union are used for affected training runs. The specific training region is not bindingly displayed for each individual training run. Availability, training duration and technical performance may vary depending on the selected processing option.

For individual training runs, we also use Amazon Web Services EMEA SARL, Luxembourg, as alternative cloud infrastructure. AWS is used exclusively in regions within the European Union. Image and training data are not processed in AWS regions outside the European Union.

d) Transfers to Third Countries

Processing in europe-west2 takes place in the United Kingdom. An adequacy decision pursuant to Art. 45 GDPR exists for the United Kingdom.

Where data are processed in the United States, the transfer takes place under the European Commission adequacy decision for the EU-U.S. Data Privacy Framework pursuant to Art. 45 GDPR. Google LLC is certified under that framework.

Additionally, EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR are provided for in the Google Cloud Data Processing Addendum as an additional safeguard, particularly should the adequacy decision no longer apply.

Where AWS is used, processing occurs exclusively in EU regions. In that case, image and training data are not transferred to third countries.

A copy of the relevant Standard Contractual Clauses may be requested from isento GmbH using the contact details in Section I.1.

e) Security Measures

Only project and training data required for the relevant training run are processed. User master data, in particular names and email addresses, are not transmitted to the training environment.

Data are transmitted and stored in encrypted form. Project-specific temporary computing instances are used for training and are deleted after the relevant training run is completed.

We implement technical and organisational measures that restrict access to training data to authorised persons and systems, including access controls, project-specific permissions, logging and measures protecting confidentiality, integrity and availability.

f) Storage Period and Erasure

We store account, contract and billing data for the duration of the user relationship and beyond where necessary for statutory retention duties or to establish, exercise or defend legal claims.

Paid content and data may remain stored for a 14-day grace period after a subscription ends. Thereafter, they may be deleted according to the product functions. Content assigned to other users or organisations, particularly in shared projects, remains unaffected.

Training data on project-specific training instances are deleted after the relevant training run is completed. After expiry of the billing period in which termination takes effect, models, model weights, checkpoints, training trees, training reports and other training artefacts owned by that user are deleted after the grace period together with the other data assigned to that user. Content and artefacts assigned to other users or organisations, particularly in shared projects, remain unaffected.

Personal data deleted under this privacy policy or the contractual terms may still be contained in technically necessary backup copies. Backup copies are used only for system recovery and protection and are overwritten or deleted within 30 days at the latest under a rolling backup concept.

Individually deleted content is not restored from backup copies. If data become available again through system recovery, they are deleted again in accordance with the applicable deletion concept.

g) Consequences of Not Providing Data

Data required for registration, contract performance and a training run are necessary to use TRYB and the relevant training function. Without those data, a user account may not be created or an AI training run may not be performed.

h) No Automated Decision-Making

No decision based solely on automated processing within the meaning of Art. 22 GDPR takes place in connection with TRYB that produces legal effects concerning data subjects or similarly significantly affects them.

i) Security Checks of Uploaded Content

To secure TRYB and protect users, we automatically check uploaded files and training data for malicious code, malware and other technical security risks. Where necessary for provision and secure use of the platform, processing is based on Art. 6(1)(b) GDPR; otherwise, it is based on Art. 6(1)(f) GDPR. Our legitimate interest is system security, integrity and availability and protection against misuse.

Uploaded content is not automatically and comprehensively assessed for pornographic, violent, extremist or other substantively impermissible content.

Where specific indications of unlawful or non-contractual use exist, we may review the relevant content case by case. This serves to enforce our terms of use, prevent unlawful use and protect users, third parties and our platform. The legal basis is Art. 6(1)(f) GDPR. In the event of a confirmed breach, content may be removed and project or user-account access may be restricted or blocked in accordance with the terms of use. Statutory duties to report or disclose information to competent authorities remain unaffected.

7. Cookies

We use cookies and similar technologies. Cookies are small data sets stored by your browser when you visit a website. You can control and delete cookies in your browser settings and object to their use.

Some cookies are technically necessary to operate the website and may be used without consent. We use non-essential cookies, including possible third-party cookies used for analysis or marketing, only with your consent under Section 25(1) TDDDG and, where applicable, Art. 6(1)(a) GDPR.

III. Data Processing on Social Media Pages

We maintain corporate pages on Instagram and LinkedIn to provide information and facilitate communication. When you visit or interact with such pages, personal data may be processed by the relevant platform provider and by us where applicable.

1. Visiting Social Media Pages

a) Instagram

Meta Platforms Ireland Limited (Ireland, EU) is the controller for processing related to visits to our Instagram page. Meta provides anonymised page-insight statistics. Meta and isento may be joint controllers for that processing. It is based on Art. 6(1)(f) GDPR and our legitimate interest in evaluating interaction and improving our page.

Further information: https://www.facebook.com/privacy/explanation

b) LinkedIn

LinkedIn Ireland Unlimited Company (Ireland, EU) is generally the controller for processing associated with visits to our LinkedIn page. LinkedIn provides aggregated page insights. LinkedIn and isento may be joint controllers for such processing, based on Art. 6(1)(f) GDPR and our legitimate interest in improving our corporate presence.

Further information: https://www.linkedin.com/legal/privacy-policy

c) YouTube

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, is the controller for processing connected with visits to our YouTube page and embedded YouTube videos. YouTube and Google may receive information about the pages you visit, especially if you are logged into YouTube. You can reduce such association by logging out before visiting a page with an embedded video.

Further information: https://policies.google.com/privacy?hl=de&gl=de

2. Comments and Direct Messages

We process information you provide through our social-media pages, such as username, contact details or messages, to communicate with you. The legal basis is Art. 6(1)(f) GDPR. Further processing may occur on the basis of consent under Art. 6(1)(a) GDPR or legal obligations under Art. 6(1)(c) GDPR.

IV. Further Processing Activities

1. Email Contact

If you send us an email, we process the data provided to answer your enquiry. The legal basis is Art. 6(1)(f) GDPR based on our legitimate interest in communicating with enquiring persons.

2. Customer and Prospect Data

When you contact us as a customer or prospect, we process the necessary master, contract, payment, contact and communication data to establish or perform the contractual relationship. The legal basis is Art. 6(1)(b) GDPR.

We may also process customer and prospect data for analysis and marketing purposes on the basis of Art. 6(1)(f) GDPR and our legitimate interest in developing our offer and providing information about it. Further processing may occur with consent under Art. 6(1)(a) GDPR or to comply with legal obligations under Art. 6(1)(c) GDPR.

3. Use of Email Address for Marketing

We may use the email address provided at registration or ordering to inform you about our own similar products and services. The legal basis is Art. 6(1)(f) GDPR in conjunction with Section 7(3) German Unfair Competition Act (UWG). You may object at any time without costs other than transmission costs at basic rates, using the unsubscribe link in the relevant mailing or by email to info@isento.de.