Privacy Policy

Introduction

Protecting your personal data is a top priority for us at Coala AI. We process your data solely in accordance with applicable legal regulations, particularly the General Data Protection Regulation (GDPR). This privacy policy informs you about the type, scope and purpose of personal data processing, and about your rights as the data subject.

Scope

This privacy policy applies to visitors of our website, individuals contacting us through electronic means, and users of our chat assistant.

Data controller

The responsible party for data processing under the GDPR is:
Coala AI GmbH
c/o BIBA – Bremer Institut für Produktion und Logistik GmbH
Hochschulring 20
28359 Bremen
Germany
contact@coala-ai.de

Data, purpose and legal basis

The following table summarizes which data we collect, why we process it, and the legal grounds for processing it.

Data	Purpose	Legal basis
Contact details	Marketing	Your consent, Art. 6(1)(a) GDPR
Inquiries submitted through our website or by email	Responding to inquiries and providing support	Legitimate interest, Art. 6(1)(f) GDPR
Usage data via cookies and analytics tools	Efficient operation, optimization and user experience improvement of our website	Consent (Art. 6(1)(a) GDPR) for non-essential cookies; legitimate interest (Art. 6(1)(f) GDPR) for technically necessary cookies
Conversation data from the chat assistant	Providing the chat service; analyzing conversations to improve services, support sales and optimize the website	Legitimate interest, Art. 6(1)(f) GDPR

Contact form

When you send us a message through the contact form, we store your name, email address, company (if given), the subject and your message on our web server so that a failed email delivery does not lose your inquiry, and we send the same content to our mailbox by email. Stored inquiries are deleted automatically after 90 days. Our email is processed by Zoho Corporation (Zoho Mail) on servers in the European Union under a data processing agreement. The legal basis is our legitimate interest in answering your inquiry, Art. 6(1)(f) GDPR, and, where you tick the consent box, your consent, Art. 6(1)(a) GDPR.

Cookies and tracking technologies

We use cookies and similar technologies on our website. Cookies are small text files stored on your device to ensure functionality, security, personalization and analysis.

• Essential cookies: necessary for the technical operation of the site and cannot be disabled.
• Functional cookies: help improve usability and personalization.
• Analytics cookies: allow us to analyze website usage and optimize performance.
• Marketing cookies: used to deliver relevant advertising and understand effectiveness.

Recipients of personal data

Your data will only be shared with third parties if:

• it is necessary to fulfill a contract,
• you have given explicit consent,
• we are legally obligated to do so,
• we use third-party service providers (e.g. hosting, analytics, communication tools) bound by data processing agreements.

Data processing by third parties

This website is hosted on Amazon Web Services EMEA (AWS) within the European Economic Area (EEA). For details, see the AWS Data Processing Addendum.

We use Zoho Corporation for email (Zoho Mail). Zoho's data processing agreement and its EU data centers apply; see the Zoho Data Processing Addendum.

If data should ever be transferred to countries outside the EEA, this will occur only on the basis of EU adequacy decisions or standard contractual clauses approved by the European Commission.

Chat assistant on the website

We have integrated our own product, Coala WebAssist, into this website as a WordPress plugin. WebAssist processes the messages you type into the chat window with a large language model to answer your questions, and analyzes conversations to generate suggestions for improvement, e.g. for the sales team and website administrators. Conversations are stored for a limited time and are not used to identify you.

Particularly sensitive personal data is not required to use WebAssist. Visitors should not provide such data during conversations. The chat assistant is not intended for personal, i.e. non-business, use. WebAssist's data processing agreement contains the details, including the involved data controllers and processors.

Data retention

We retain personal data only as long as necessary to fulfill the purposes set out in this policy or as required by statutory retention obligations. Contact form inquiries are deleted after 90 days. Once a retention period expires, your data is permanently deleted or anonymized.

Your rights as data subject

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure, the "right to be forgotten" (Art. 17 GDPR)
• Right to restrict processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw consent at any time, without affecting prior lawful processing
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR), particularly in your country of residence

Data security

We implement appropriate technical and organizational measures to protect your personal data against loss, misuse or unauthorized access, such as encryption, access control, regular backups and monitoring of security incidents.