Privacy Policy

We take the protection of your personal data seriously and process it in accordance with the GDPR, the German Federal Data Protection Act (BDSG) and the TDDDG. Below we inform you comprehensively about the processing of your personal data when using this website.

1. Controller

The controller within the meaning of the GDPR is:

Circle GmbH
Am Weinberg 20
85092 Kösching
Germany

Phone: +49 (0) 841 / 938 946 46
Email: info@circle.gmbh

2. General information

We process our users' personal data only to the extent necessary to provide a functional website and our content and services, generally based on consent or where permitted by law.

Technical and organisational measures: We apply appropriate technical and organisational measures (Art. 32 GDPR). Our devices are centrally managed via mobile device management (Microsoft Intune and Apple Business Manager with managed Apple IDs), including encryption and remote wipe.

3. Provision of the website & server log files

Each time the website is accessed, our hosting system automatically collects data and information from the accessing device (browser type and version, operating system, referrer URL, host name, time of the request and IP address). The legal basis is Art. 6 (1) f GDPR (legitimate interest in a technically error-free presentation and security). Log files are deleted after a short period unless required as evidence in security-relevant incidents.

4. Hosting

This website is operated by a service provider (host) in Germany or the EU, which processes data on our behalf (Art. 28 GDPR) under a data processing agreement.

5. Contact & contact form

If you contact us via the contact form or email, the details you provide are stored to process your request. The legal basis is Art. 6 (1) b and f GDPR. We obtain consent via an explicit opt-in checkbox and log the time of consent. Data is deleted once no longer required and where no statutory retention obligations apply.

Brand Friday giveaway

If you take part in the “Brand Friday” giveaway, we process the details from the entry form (first and last name, company name, email address and phone number) and the channel you tap on our page after confirming in order to follow Circle and technical details of the entry (time, a pseudonymised check value of your IP address and the channel through which you reached the page, derived from campaign parameters in the link, the referring host and the identifier of in-app browsers).

Running the giveaway: checking eligibility and multiple entries, the draw, notifying the winner and checking the follow. The legal basis is Art. 6(1)(b) GDPR (carrying out the giveaway under the terms of participation). So that you only need to provide a few details in the form, we automatically research publicly available information on the company you name (website, registered office, number of employees) using the AI service described in the section on research for enquiries. The result is a provisional assessment; eligibility is only decided after checking the winner.

Information about our services by email and phone on marketing, design, websites and software: the legal bases are the consideration for entry agreed in the terms of participation (Art. 6(1)(b) GDPR) and your consent (Art. 6(1)(a) GDPR, Section 7(2) UWG). You confirm your consent via a link sent by email (double opt-in). As proof, we store the time, wording and version of the consent, the time of confirmation and the pseudonymised IP check value (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).

Campaign evaluation: we evaluate the channel through which you arrived in order to measure the success of our campaign per channel (Art. 6(1)(f) GDPR; our legitimate interest is managing our advertising). Without your consent to cookies, this information is only kept in your browser’s memory until you leave or reload the page.

Recipients: your data is processed on our behalf by the service providers for hosting, email delivery and customer management named in this privacy policy. Publication only concerns the winner and only with their consent, which we obtain after the draw.

Storage period: we store entry data until you withdraw your consent. We keep proof of consent beyond that for as long as it is needed to defend against claims. The winner’s data is additionally kept for the duration of statutory retention obligations.

Withdrawal: you can withdraw your consent at any time with effect for the future (Art. 7(3) GDPR), via the unsubscribe link in every email or by email to info@circle.gmbh. The lawfulness of processing carried out before withdrawal remains unaffected.

The details in the form are required to take part; without them, entry is not possible. Your further rights are set out in the section on your rights in this privacy policy.

6. Audit and website funnel

Via our funnels (free GEO audit, website request) we collect the details required to process your request. We process this to create the requested audit/proposal and to contact you (Art. 6 (1) b and a GDPR). Partial entries may be stored so we can contact you if the process is abandoned.

7. Technical request data for lead assessment

Within the funnels we additionally collect technical data about your request (IP address, date and time, device type and operating system, browser, language setting and, where applicable, the referrer) to handle, attribute and assess it. Legal basis: your consent (Art. 6 (1) a GDPR) and our legitimate interest (Art. 6 (1) f GDPR).

8. Automated research and preliminary assessment via AI

To create your personal audit or website proposal and to assess your request, we research publicly available information about your company based on the domain or profile you provide, using the AI service of Anthropic (Claude). The information required is transmitted to and processed by Anthropic on our behalf under a data processing agreement; your data is not used to train the AI models within API usage. This produces an automated preliminary assessment (profile and suitability/priority score) for internal preparation only. This does not constitute a solely automated decision producing legal effects within the meaning of Art. 22 GDPR — the final decision is always made manually by a human. You may object at any time at info@circle.gmbh.

Research on enquiries via the contact form

For enquiries via our contact form, we also automatically research publicly available information about the company on whose behalf you are enquiring, in order to prepare your enquiry properly. The starting point is the information you provide in the form (in particular company name, the domain of your email address, phone number and message). This is supplemented by publicly available company information such as company name, industry, locations, management and company size. Sources are in particular the company's website and legal notice, public registers (e.g. the commercial register) and generally accessible company directories (Art. 14(2)(f) GDPR). No research is carried out on you as a private individual.

The above applies accordingly: we use Anthropic's AI service as a processor (for third-country transfers see section 17), the results are used exclusively for internal preparation, and no automated individual decision is made. The legal basis is our legitimate interest in properly preparing and handling your enquiry (Art. 6(1)(f) GDPR). We store the results together with your enquiry and delete them in accordance with the periods under section 18. You may object to this processing at any time (Art. 21 GDPR); an informal message to info@circle.gmbh is sufficient.

9. Email, communication and online meetings (Microsoft 365)

We send emails to process your request (e.g. confirmation, audit result) and use Microsoft 365 (Microsoft Ireland Operations Ltd.) as a processor for email and business communication — including Outlook, Word/Excel/PowerPoint and Microsoft Teams for online meetings (name, email address and, where applicable, audio/video during the meeting). Third-country transfers are safeguarded by the EU-U.S. Data Privacy Framework and standard contractual clauses. Legal bases: Art. 6 (1) b and f GDPR.

10. AI assistant "Karl" (chat)

Our website provides an AI chat assistant. Your chat input (messages and any contact details you provide) is processed to answer your enquiry and transmitted for this purpose to the AI service of Anthropic (Claude), which processes it on our behalf (Art. 28 GDPR); data is not used to train AI models within the API. If, after sending, you give us preferred times for a call on Microsoft Teams, we add them to your enquiry. Legal bases: Art. 6 (1) b and f GDPR. Please do not enter special categories of personal data (Art. 9 GDPR).

So that a conversation you have started is kept when you change pages or reload, your browser stores the conversation including your details in its session storage — only once you actively use Karl. It is deleted when you close the browser tab, after two hours at the latest or when you choose “Start from the beginning”, and this storage does not transmit it to us. Storing it on your device is strictly necessary for the chat you requested (Sec. 25 (2) no. 2 TDDDG).

11. Meta Pixel (conversion measurement)

Only with your consent via our consent banner (Sec. 25 (1) TDDDG, Art. 6 (1) a GDPR) we use the Meta Pixel of Meta Platforms Ireland Limited to measure the effectiveness of our ads (e.g. submitting an enquiry as a conversion event). Event and device data and truncated/hashed identifiers may be transferred to Meta, including to the USA; Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework, supplemented by standard contractual clauses. For the collection and transmission of event data we are partly jointly responsible with Meta (Art. 26 GDPR). You can withdraw your consent at any time via the cookie settings.

12. CRM and enquiry management (HubSpot)

We use the CRM system of HubSpot, Inc. / HubSpot Ireland Ltd. as a processor (Art. 28 GDPR) to manage enquiries and leads (contact and company data, enquiry content, communication history). Transfers to the USA are safeguarded by the EU-U.S. Data Privacy Framework and standard contractual clauses. Legal bases: Art. 6 (1) b and f GDPR.

Telephony (Aircall): For inbound and outbound calls we use Aircall (Aircall SAS, Paris) including AI-assisted features (e.g. call notes/transcription). Phone number, connection data and — where AI features are used — call content are processed on our behalf (Art. 28 GDPR). Legal bases: Art. 6 (1) b and f GDPR.

13. Credit assessment, trade credit insurance and credit agencies

In B2B business we insure orders via trade credit insurance (currently R+V Versicherung) and transmit the necessary client details to the insurer, which may perform a credit assessment involving credit agencies (Art. 6 (1) b and f GDPR). In addition, we may report due, undisputed outstanding claims to credit agencies (in particular Creditreform, SCHUFA, CRIF, Creditsafe, Dun & Bradstreet) after an unsuccessful dunning procedure; prior notice is given in the dunning letter (Art. 6 (1) f GDPR). You may object under Art. 21 GDPR.

14. Social media presences

We maintain presences on social networks: LinkedIn, Instagram and Facebook. The respective platform operator processes data under its own responsibility; for "insights" statistics there may be joint responsibility (Art. 26 GDPR). The providers' privacy notices apply in addition.

15. Cookies and consent

This website uses technically necessary cookies that are required to operate the site (legal basis: § 25 (2) TDDDG in conjunction with Art. 6 (1) f GDPR). Services requiring consent — currently in particular the Meta Pixel (section 11) — are only loaded after your active consent via the consent banner (§ 25 (1) TDDDG, Art. 6 (1) a GDPR). You can withdraw or adjust your consent at any time with effect for the future via the cookie settings.

Map service (CARTO)

On our contact page you can display a map of our location. The map tiles are provided by CartoDB Inc. (“CARTO”), 307 Fifth Avenue, Floor 9, New York, NY 10016, USA; the map data comes from OpenStreetMap. The map is only loaded once you allow it via the “Show map” button or in the cookie settings (category “Maps”). Without your consent no connection to CARTO is established; we then only show our address with links to map services that you can open yourself.

When the map is loaded, your browser retrieves the map tiles directly from CARTO. CARTO processes technical request data, in particular your IP address, the referring page (referer), your browser identifier (user agent) and the time and volume of requests. According to CARTO, the IP address is truncated on receipt (for IPv4 addresses by the last octet); the truncated logs are stored in the USA for 30 days and then deleted. CARTO processes this data as a processor on our behalf, solely to provide, secure and prevent misuse of the map service. The transfer to the USA is based on EU standard contractual clauses (Art. 46 (2) c GDPR).

The legal basis is your consent (Art. 6 (1) a GDPR). You can withdraw it at any time with effect for the future in the cookie settings; the map will then no longer be loaded.

16. Fonts

Fonts are served locally from our own server; no connection to third-party servers is established to load fonts.

17. Recipients and third-country transfers

Your data is only passed on within the scope of the processing described above — in particular to processors (hosting, AI services [Anthropic], CRM [HubSpot], email/communication [Microsoft], telephony [Aircall], conversion measurement [Meta], map service [CARTO, only with consent]) and to the trade credit insurer and credit agencies under section 13 — or where we are legally obliged.

For enquiry and contract handling we use further service providers: project and knowledge management (Atlassian Jira and Confluence, including the AI search Atlassian Rovo), source code management and CI/CD (GitHub, including automated code and security checks), file storage and exchange (Dropbox), remote maintenance (TeamViewer), video messages (Loom), invoicing and dunning (sevdesk), accounting and tax (DATEV and our tax advisor — legal basis also Art. 6 (1) c GDPR), financial and liquidity planning (Agicap) and AI services for internal work processes (Anthropic Claude, OpenAI ChatGPT — personal data only to the extent necessary and under appropriate agreements). Where data is transferred to providers outside the EU/EEA, we ensure an adequate level of protection through appropriate safeguards (e.g. EU standard contractual clauses).

18. Storage period

We store personal data only as long as necessary for the respective purpose or as required by statutory retention periods (e.g. commercial and tax law periods of up to ten years).

19. Your rights

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent (Art. 7 (3) GDPR)

To exercise your rights, an informal message to info@circle.gmbh is sufficient.

20. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

21. Currency

This privacy policy is dated June 2026 and may be updated as our website develops or legal requirements change.