Privacy Policy

1. Controller and data protection officer

The controller within the meaning of the GDPR, the German Federal Data Protection Act (BDSG) and the Telecommunications Digital Services Data Protection Act (TDDDG) is:

IRIS Analytics GmbH

Klostergut Besselich

56182 Urbar, Germany

Represented by its managing directors: Christoph Sauer, Benedikt Schmidt

Email: info@iris.de

Phone: 0157 5136 1501

Data protection officer: Lukmann Consulting GmbH, Packerstraße 131a, 8561 Söding, Österreich

2. General information on data processing

Legal bases

Where a section below does not name a specific legal basis, the following applies:

• Consent: Article 6(1)(a) and Article 7 GDPR; for storing or accessing information on your device, also Section 25(1) TDDDG.
• Contract and pre-contractual measures, including answering enquiries: Article 6(1)(b) GDPR.
• Legal obligations, for example retention duties under commercial and tax law: Article 6(1)(c) GDPR.
• Legitimate interests: Article 6(1)(f) GDPR, provided your interests, fundamental rights and freedoms do not override ours.
• Vital interests: Article 6(1)(d) GDPR.

Storage period and deletion

We follow the principles of data minimisation and storage limitation (Article 5(1)(c) and (e) GDPR). We keep personal data only as long as needed for the stated purpose or as required by statutory retention periods, for example up to 6 years under Section 257 of the German Commercial Code (HGB) and up to 10 years under Section 147 of the German Fiscal Code (AO). After that, the data is deleted.

Recipients

We only pass on personal data where a legal basis allows it. Recipients may include IT and hosting service providers acting as processors under a data processing agreement (Article 28 GDPR), tax advisers, auditors and public authorities where we are legally obliged to do so.

Transfers to third countries

Some service providers we use are based in, or process data in, countries outside the European Economic Area, including the USA. We only transfer data there if one of the following safeguards applies:

• an adequacy decision of the European Commission (Article 45 GDPR), for the USA the EU-US Data Privacy Framework, where the recipient is certified under it; or
• standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR), supplemented by additional measures where necessary.

You can request a copy of the relevant safeguards using the contact details in section 1.

Obligation to provide data and automated decisions

You are not legally or contractually obliged to provide personal data when visiting this website, except for the technical data that is necessary to display it. We do not use automated decision making, including profiling, within the meaning of Article 22 GDPR.

3. Your rights

You have the following rights regarding your personal data. To exercise them, contact us using the details in section 1.

• Access (Article 15 GDPR): information on the purposes, categories, recipients and storage period of your data, and a copy of it.
• Rectification (Article 16 GDPR) of inaccurate or incomplete data.
• Erasure (Article 17 GDPR), unless we are legally obliged to keep the data.
• Restriction of processing (Article 18 GDPR), for example while the accuracy of the data is being checked, if processing is unlawful but you do not want the data deleted, if you need the data to establish, exercise or defend legal claims, or while an objection is being assessed.
• Data portability (Article 20 GDPR): to receive data you provided on the basis of consent or a contract in a structured, commonly used, machine readable format, or to have it transferred to another controller where technically feasible.
• Withdrawal of consent (Article 7(3) GDPR) at any time, with effect for the future. Processing carried out before the withdrawal remains lawful.

Right to object (Article 21 GDPR)

Where we process your data on the basis of Article 6(1)(e) or (f) GDPR, you have the right to object at any time, on grounds relating to your particular situation. This also applies to profiling based on these provisions. We will then stop processing your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where we process your data for direct marketing, you may object at any time without giving reasons. We will then no longer use your data for this purpose.

Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority (Article 77 GDPR), in particular in the EU member state of your habitual residence, place of work or the place of the alleged infringement. The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz

Hintere Bleiche 34, 55116 Mainz, Germany

www.datenschutz.rlp.de

4. Website hosting and server log files

Our website is hosted by Webflow, Inc., 398 11th St., Floor 2, San Francisco, CA 94103, USA (“Webflow”). Webflow uses Amazon Web Services and Cloudflare as sub-processors: the website is served from servers in the USA (Amazon Web Services, region us-east-1) and delivered through Cloudflare’s content delivery network, which can serve it from a data centre close to you. Webflow processes data on our behalf under a data processing agreement and has data processing agreements with valid transfer mechanisms in place with its sub-processors. Where data is transferred to the USA, this is based on the EU-US Data Privacy Framework, under which Webflow is certified, and on standard contractual clauses.

The website itself does not store client data. Our production systems that hold client data run in the AWS regions contractually agreed with each client. Our internal productivity services hold company data in the EU region of Google.

When you visit our website, your browser automatically sends the following information, which is stored in server log files:

• IP address of your device
• device type, operating system, browser type and version
• host name of the accessing computer
• requested file and amount of data transferred
• date and time of the request
• whether the request was successful

This data is not combined with other data sources. Processing is based on Article 6(1)(f) GDPR. Our legitimate interest is the secure, error free delivery and optimisation of the website. Log files are stored by Webflow and its sub-processors only as long as necessary for the secure delivery of the website and are then deleted; Webflow does not publish a fixed retention period. If a security incident occurs, data may be kept longer to investigate it.

SSL/TLS encryption

For security, this website uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” and the lock symbol in your browser’s address bar.

5. Cookies, local storage and external services

Cookies and similar technologies

Our website uses cookies, local storage and session storage. Local storage keeps data in your browser until you delete it, for example your choice of light or dark mode. Session storage is deleted when you close the tab. Cookies are small files that a web server stores on your device, either for the duration of a session or permanently until they expire or you delete them.

Storing information on your device, or accessing it, is governed by Section 25 TDDDG:

• Strictly necessary technologies (for example saving your display mode or your consent choice) are used without consent under Section 25(2) No. 2 TDDDG. Any further processing of personal data is based on Article 6(1)(f) GDPR.
• All other technologies, in particular for analytics, are only used with your prior consent under Section 25(1) TDDDG and Article 6(1)(a) GDPR. You can withdraw your consent at any time in the cookie settings (link “Cookies Settings” in the footer of every page).

We use the following strictly necessary cookies:

• fs-cc and fs-cc-updated: store your consent choice, 180 days.
• _cfuvid: set by Cloudflare to tell apart visitors who share an IP address, so that the website can be protected against overload and attacks; deleted when you close your browser.
• besucht: remembers for 30 minutes that you have already seen the intro animation, so that it is not shown again on every page.

You can also delete cookies and website data in your browser settings at any time.

Analytics

With your consent, we analyse how visitors use our website, for example which pages are viewed, how long visits last and from which region visitors come. This helps us improve the website. We do not use this data to create advertising profiles. The legal basis is your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG, which you can withdraw at any time in the cookie settings (link “Cookies Settings” in the footer of every page).

For this we use Hotjar, provided by Hotjar Ltd, Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville, St Julian’s STJ 3141, Malta, a Contentsquare company. Hotjar records interactions such as clicks, mouse movements and scrolling and shows them to us in aggregated form (heatmaps) and as recordings of individual visits. Hotjar processes this data on our behalf under a data processing agreement.

• Legal basis: Article 6(1)(a) GDPR and Section 25(1) TDDDG.
• IP addresses: Hotjar does not store your IP address. To recognise returning visitors, Hotjar assigns a random identifier instead.
• Cookies and browser storage: Hotjar sets the cookies _hjSessionUser_5172026 (365 days, the random identifier for returning visitors) and _hjSession_5172026 (30 minutes, the current visit). During your visit, it also keeps entries in your browser’s local storage and session storage.
• Storage period: 365 days, after which the data is deleted automatically.
• Third country transfer: the data is stored in the EU (Amazon Web Services, Ireland). Companies of the Contentsquare group outside the EEA, including in the USA, may access it for support and maintenance; this is based on the EU-US Data Privacy Framework and on standard contractual clauses.

We do not use analytics data to create advertising profiles.

Spam and bot protection (reCAPTCHA)

To protect our contact and demo request forms against spam and automated misuse, we use reCAPTCHA, a service of Google. reCAPTCHA analyses information such as your IP address, browser and device data and how you interact with the page to tell people and automated programs apart. Since 2 April 2026, Google processes this data only on our behalf as a processor under Google’s terms for Google Cloud services. The reCAPTCHA script is loaded on every page of our website. Data may be processed in the USA; transfers are based on the EU-US Data Privacy Framework and on standard contractual clauses.

The legal basis is our legitimate interest in protecting our website and forms against misuse (Article 6(1)(f) GDPR). Access to information on your device takes place because it is strictly necessary for this protection (Section 25(2) No. 2 TDDDG).

Content delivery networks

Some program libraries of our website are loaded from the public content delivery networks jsDelivr (cdn.jsdelivr.net) and, on individual pages, jQuery CDN (code.jquery.com, operated by the OpenJS Foundation and delivered by Fastly, Inc., USA). To deliver the files, these services receive your IP address and the technical data your browser sends with every request. Data may be processed outside the EEA, including in the USA. The legal basis is our legitimate interest in the reliable and fast delivery of the website (Article 6(1)(f) GDPR).

6. Contacting us

If you contact us by email or phone, we process the data you provide (for example name, email address, phone number and the content of your message) to handle your enquiry. The legal basis is Article 6(1)(b) GDPR where your enquiry relates to a contract or pre-contractual measures, and otherwise Article 6(1)(f) GDPR, based on our legitimate interest in answering enquiries. We delete the data once your enquiry has been fully handled, unless statutory retention periods apply.

The same applies if you use the contact or demo request form on our website. We process the data you enter there (name, email address, company and your message). Form submissions are stored by our hosting provider Webflow (see section 4) and forwarded to us by email. The forms are protected by reCAPTCHA (see section 5).

We use Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) for email, with data stored in the EU region. Google may access data from the USA in individual cases; this is covered by the EU-US Data Privacy Framework and standard contractual clauses.

7. Data protection for applicants

This section explains how we process your personal data when you apply for a position at IRIS Analytics GmbH.

Data we process

• contact details (name, address, email address, phone number)
• application documents (cover letter, CV, certificates, references, work samples)
• information on qualifications, professional experience, availability and notice period
• salary expectations
• notes from interviews and assessments
• any other information you choose to share with us

Please do not send us special categories of personal data (for example health data or religious beliefs) unless they are relevant to your application, such as a recognised severe disability. If you do, we process them only under Article 9(2)(b) GDPR.

Sources

We receive your data directly from you. If you apply through a job portal, professional network (for example LinkedIn) or recruitment agency, we receive your data from that provider.

Purpose and legal basis

We process your data to assess your application and to decide whether to establish an employment relationship. The legal basis is Article 6(1)(b) GDPR (steps taken at your request before entering into a contract). If you are hired, your data is transferred to your personnel file and processed to carry out the employment relationship.

Where we keep your data after the process has ended to defend against legal claims, for example under the German General Equal Treatment Act (AGG), the legal basis is Article 6(1)(f) GDPR.

Who has access

Within our company, only the people involved in the recruitment process have access to your data, for example management, the hiring team for the relevant role and administration. We use the following service providers as processors under data processing agreements:

• Google Workspace (Google Ireland Limited) for email and applicant management, with data stored in the EU region
• LinkedIn

Use of AI tools in screening

To support a structured and fair review, we may use an AI tool to summarise and assess application documents against criteria defined in advance. Before documents are uploaded, we remove names, contact details, photos and other directly identifying information. The AI only supports our assessment; every decision on an application is made by a person. We do not make decisions based solely on automated processing within the meaning of Article 22 GDPR.

Obligation to provide data

You are not legally obliged to provide your data. However, we need the information that is required to assess your application. Without it, we cannot consider your application.

Storage period

If your application is unsuccessful, we delete your data 6 months after you have been informed of our decision. This allows us to defend against possible claims under the AGG (Section 15(4) AGG and Section 61b of the German Labour Court Act). If legal proceedings are pending, we keep the data until they are concluded.

Talent pool

With your consent (Article 6(1)(a) GDPR), we keep your application in our talent pool in order to consider you for future vacancies. Your data is deleted automatically no later than 2 years after you gave your consent. You can withdraw your consent at any time with effect for the future, for example by email to info@iris.de, after which we delete your data unless statutory retention obligations apply.

Sending applications by email

Email is usually transmitted with transport encryption, but it is not end to end encrypted. If you prefer a different way to send your documents, please contact us.

Your rights under section 3 apply in full to the processing of applicant data.

8. Our LinkedIn page

We maintain a company page on LinkedIn. The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. LinkedIn may also transfer data to LinkedIn Corporation in the USA; LinkedIn is certified under the EU-US Data Privacy Framework and also uses standard contractual clauses.

When you visit our LinkedIn page, LinkedIn processes your personal data, for example your IP address, device information and, if you are logged in, information from your LinkedIn profile. LinkedIn also uses cookies, including for advertising. We have no influence on this processing. Details can be found in LinkedIn’s privacy policy: https://www.linkedin.com/legal/privacy-policy.

LinkedIn provides us with anonymised statistics about visits to our page (Page Insights). For this processing, we and LinkedIn are joint controllers under Article 26 GDPR. LinkedIn has taken on the main responsibility for informing you and for handling your data subject rights: https://legal.linkedin.com/pages-joint-controller-addendum. You may nevertheless also contact us.

We use our LinkedIn page to present our company and to reach potential employees and business partners. The legal basis is our legitimate interest under Article 6(1)(f) GDPR. If you contact us via LinkedIn, for example by sending a message or an application, we process that data as described in sections 6 and 7.

9. External links

Our website may contain links to websites of third parties. When you click such a link, the operator of the target website receives data such as your IP address, the time of the click and the page you came from. We have no influence on how third parties process this data; their own privacy notices apply. Some of these websites may be located outside the European Economic Area.

10. Changes to this privacy notice

We update this privacy notice when our services or the legal requirements change. The current version is always available on this website.

Last updated: October 2026

‍