Privacy
Controller
The controller for the data processing on this website is CIRO GmbH, Maischer Str. 10, 85386 Eching, Germany, email: hello@ciro.gmbh.
Hosting
This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When the website is accessed, Vercel processes technically necessary data (in particular IP address, date and time of access, page accessed, browser and operating system information) in so-called server log files. The processing is based on Art. 6 (1) (f) GDPR; our legitimate interest lies in the secure and stable operation of the website. A data processing agreement is in place with Vercel, and the transfer to the USA is based on the EU standard contractual clauses and the EU-US Data Privacy Framework.
Web analytics
We use Vercel Web Analytics to evaluate the use of the website in aggregated form (for example page views and countries of origin). The service works without cookies and without cross-device profiles, and IP addresses are not stored permanently. The legal basis is Art. 6 (1) (f) GDPR (interest in improving our offering).
Cookies and consent
On your first visit, a banner asks whether we may use cookies and similar technologies for analytics and marketing. Without your consent we only use what is strictly necessary to operate the website (Section 25 (2) no. 2 TDDDG): the cookie “ciro-lang”, which stores your chosen language (stored for one year), and the entry “ciro-cookie-consent” in your browser’s local storage, which records your decision in the banner (stored for 365 days). Neither contains personal data.
You can change or withdraw your decision at any time via the “Cookie settings” link at the bottom of every page; a withdrawal takes effect for the future. To document consent (Art. 7 (1) GDPR) we log the decision itself – acceptance or rejection per category, time, page and device type – with Amplitude (see below). In the case of a rejection this happens under a random identifier generated for this single entry only, which does not allow any inference about you or your device; no user profile is created. The legal basis is Art. 6 (1) (c) GDPR in conjunction with Art. 7 (1) GDPR.
Web analytics with Amplitude
With your consent, this website uses the web analytics service Amplitude provided by Amplitude, Inc., 201 3rd Street, Suite 200, San Francisco, CA 94103, USA. The service lets us understand how visitors use the website – which pages are opened, which sections are read and which buttons are used – and improve the website accordingly. For this purpose the service uses cookies and comparable storage techniques on your device and collects a pseudonymous device identifier, the pages visited, your interactions with the page, information about browser, operating system and device type, the IP address, from which the approximate region is derived, and – if present in the page address – campaign parameters (UTM).
In addition we use Amplitude Session Replay. It records the course of your visit – mouse movements, scrolling, clicks and the page content visible at the time – so that we can trace usability problems. Input into form fields is masked and not transmitted.
Amplitude processes and stores the collected data exclusively in data centres within the European Union. All processing operations described, in particular the storing and reading of information on your device, are only carried out if you have given us your consent in accordance with Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG. Without your consent the service is not loaded. You can withdraw your consent at any time with effect for the future via the “Cookie settings” at the bottom of every page.
We have concluded a data processing agreement with the provider that ensures the protection of our visitors’ data and prohibits unauthorised disclosure to third parties. Insofar as access from the USA occurs in individual cases, for example in the course of support, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision by the European Commission.
Conversion measurement with the OpenAI pixel
With your consent, this website uses the conversion pixel provided by OpenAI. The provider for the European Economic Area is OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. We run ads with OpenAI, for example in ChatGPT. The pixel measures whether visits come from these ads and lead to an enquiry, so that we can evaluate how well the ads perform. For this purpose it reports every page view and every successfully submitted contact form to OpenAI, together with the page visited, an identifier from the ad click (if you arrived via an ad), a random browser identifier, information about browser and device, and your IP address.
When you submit the contact form, the pixel also detects your email address, phone number and name, converts them into a hash value (SHA-256) while still in your browser and transmits only this value to OpenAI. OpenAI does not receive the details in plain text through the pixel. The hash value is nevertheless personal data: OpenAI can match it against its own user data and thereby attribute an enquiry to an ad interaction.
On your device the pixel stores the cookies “__oppref” (identifier from the ad click, stored for 30 days), “__obref” (random browser identifier, stored for one year) and “__oaiq_consent” (your decision for the pixel, stored for 30 days), as well as the entry “oaiq_consent” in your browser’s local storage, which records the same decision.
We and OpenAI are each independent controllers for this measurement. OpenAI also processes the data in the USA; the transfer is based on the European Commission’s standard contractual clauses and the EU-US Data Privacy Framework. The legal basis is your consent under Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG. Without your consent the pixel is not loaded. You can withdraw your consent at any time with effect for the future via the “Cookie settings” at the bottom of every page; the pixel then stops sending events and removes its cookies. Further information can be found in OpenAI’s privacy policy: https://openai.com/policies/privacy-policy/
Getting in touch and the contact form
If you contact us by email or via the contact form, we process the information you provide (name, email address, company where applicable, content of the message) in order to handle your enquiry (Art. 6 (1) (b) GDPR, for general enquiries Art. 6 (1) (f) GDPR). To send the form messages we use the email service Brevo (Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin, Germany) as a processor. The data is deleted as soon as it is no longer required for handling the enquiry and no statutory retention obligations stand in the way.
Your rights
You have the following rights with regard to the personal data concerning you: the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and objection to the processing (Art. 21 GDPR). You also have the right to lodge a complaint with a data protection supervisory authority, for example the Bavarian Data Protection Authority (BayLDA), Ansbach, Germany.
Last updated: October 2026
This is a courtesy translation. In case of any discrepancy, the German version is legally binding.