Privacy policy

Controller

The controller is NAVIGRO UG (haftungsbeschränkt), Schmiedegasse 24, 41836 Hückelhoven, Germany, represented by its managing director Tizian Kneschk. Email: info@navigro.eu. Further details are given in the legal notice (in German).

EUlyra is a platform developed and sold by NAVIGRO; eulyra.eu is a website of NAVIGRO UG.

We have not appointed a data protection officer, as there is no legal obligation to do so. Your contact for questions about data protection is Tizian Kneschk, who can be reached at info@navigro.eu.

Summary

• This website sets no cookies and uses no tracking and no analytics services.
• All files – including fonts and images – come from our own web space; no content is loaded from third-party servers.
• We only process personal data in the server log files, when you ask the assistant “Ask EUlyra” a question, apply for the early adopter programme, request a demo or write to us.

Hosting and server log files

The website is hosted by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany, in a data centre in Germany. ALL-INKL processes the data on our behalf; a data processing agreement under Art. 28 GDPR is in place.

With every request, the server stores in log files:

• IP address of the requesting device, shortened (11.22.33.44 becomes 11.22.0.0)
• date and time of the request
• address requested and amount of data transferred
• status code of the response
• address of the previously visited page (referrer), if your browser sends it
• browser and operating system (user agent)

The purpose is the secure and stable operation of the website, such as defending against attacks and finding errors. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in these purposes. The log files are deleted automatically after 7 days.

Application for the early adopter programme

If you apply via the form, we process:

• type (company or club), name of the company or club, industry or sport
• your name, your role and your business email address
• number of employees
• optionally, your preferred start, your phone number and your goal with EUlyra
• time of the application and of the confirmation, and the language of the page

The purpose is to handle your application: selecting participants, getting in touch and preparing a contract. The legal basis is Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract) and your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time with effect for the future, for example by email to early-adopter@eulyra.eu.

Confirmation by email: After you submit the form, we send you an email with a link. Your application only reaches us once you click it – this ensures that the email address belongs to you. Until then, your details are kept on our web space; unconfirmed applications are deleted automatically after 7 days.

After confirmation, we send your details by email to our mailbox and delete them from the web space – except for the record of your consents (below). If no contract is concluded, we delete them 6 months after the end of the selection process. If a contract is concluded, we keep them for its performance and afterwards for as long as statutory retention obligations apply.

Protection against misuse: To prevent mass requests, we store a hash of your IP address – not the address itself – for one hour. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting the form.

Providing the details is neither a legal nor a contractual requirement. Without the required details, however, we cannot handle your application.

Demo request

If you request a demo via the form, we process:

• type (company or club), name of the company or club, sector or type of club
• your name and your business email address
• number of employees
• optionally, your message, where applicable with the names and addresses of other people
• time of the request and of the confirmation, and the language of the page

The purpose is to set up demo access for you and to contact you about it. The legal basis is Art. 6(1)(b) GDPR (performance of the contract for the demo under the terms of use of the demo (in German) and steps taken at your request prior to entering into a contract for EUlyra) and your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time with effect for the future, for example by email to demo@eulyra.eu.

Confirmation by email: As with applications, your request only reaches us once you click the link in our email. Until then, your details are kept on our web space; unconfirmed requests are deleted automatically after 7 days. After confirmation, the website transfers your details to the demo environment (below) and also sends them by email to our mailbox; we then delete them from the web space – except for the record of your consents (below).

Demo environment: The website transfers the details from the form – together with the times of the request and of the confirmation, the language of the page and whether you have consented to marketing by email – in encrypted form to the demo environment on servers of Hetzner Online GmbH in Germany. There, your demo access is usually set up without any further steps; in some cases, we check the request by hand first. For your access, the demo uses your name, your email address and the name of your company or club. If you give further business addresses in your message so that colleagues can try out the demo with you, we also set up access for them and transfer their names and addresses. The legal basis for this is Art. 6(1)(f) GDPR; our legitimate interest and that of your company or club is trying out the demo together. The privacy notice of the demo (in German) informs you and these people about the processing there.

Our sales team: So that we can support you during the demo, we transfer your details once to our sales system, which runs on NAVIGRO’s own server in Germany. After that, the demo only reports high-level events with their date: demo created, first sign-in, first requirements profile drafted by the AI, first development plan drafted by the AI, reminder before the end, extension, expiry, deletion. We do not transfer the content of your demo, your entries or your clicks. In the demo environment, we delete the details that only the sales system needs (size, sector, message, consent) as soon as they have arrived there. The legal basis is Art. 6(1)(b) GDPR (your request) and, for the events, Art. 6(1)(f) GDPR – our legitimate interest is to support prospective customers appropriately during the demo. You can object to this processing for support purposes at any time (Art. 21 GDPR); an email to demo@eulyra.eu is sufficient.

Storage period: If no contract for EUlyra is concluded, we delete the details of your request 6 months after the end of the demo – or, if no demo access has been set up by then, no later than 12 months after the request. In the sales system, we also make your details unrecognisable if nothing happens for twelve months. If a contract is concluded, we keep them for its performance and afterwards for as long as statutory retention obligations apply.

To protect against misuse, we store a hash of your IP address for one hour, as with applications. Providing the details is neither a legal nor a contractual requirement; without the required details, however, we cannot set up demo access for you.

Marketing by email

If you also tick the optional marketing box when applying or requesting a demo and confirm this via the link in our email, we send you information and offers about EUlyra and NAVIGRO’s services by email. For this, we use your email address, your name and the name of your company or club.

The legal basis is your consent under Art. 6(1)(a) GDPR. It is voluntary and independent of your application or request. You can withdraw it at any time with effect for the future, by email to info@navigro.eu or via the unsubscribe link in every such email; this does not affect the lawfulness of processing before the withdrawal. After a withdrawal, we no longer send you marketing.

We send the marketing emails with our own sales system, which runs on a NAVIGRO server in Hückelhoven (Germany), via the ALL-INKL mail server (see above; a data processing agreement is in place). We do not use any other services for this.

Record of your consents

So that we can prove that and how you gave your consent (Art. 7(1) GDPR), we store the following on our web space after you confirm an application or demo request: your email address, the form and the address of its page, the language of the page, the times of sending and confirmation, the type of confirmation, the address and date of this privacy policy, the wording of the consents with their version (data protection and marketing, even if you did not consent to marketing, then with a note to that effect) and any later withdrawal – no IP address.

The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR and Art. 6(1)(f) GDPR; our legitimate interest is being able to prove the consents. We delete the record at the end of the third calendar year after the withdrawal or after the last marketing email to you; without marketing consent, at the end of the third calendar year after your application or request has been completed. This is generally how long claims relating to the consent can be asserted (Sections 195 and 199 of the German Civil Code).

Contact form

If you write to us via the contact form, we process your name, your email address, your message and, optionally, your company or club, phone number, the times at which we can best reach you and the topic, as well as the time and the language of the page. We send the details by email to our mailbox and do not store them on the web space; we do not send a confirmation to the address you entered.

The purpose is to answer your request. The legal basis is Art. 6(1)(b) GDPR where a contract or its preparation is concerned, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering), and your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time with effect for the future. To protect against misuse, we store a hash of your IP address for one hour, as with applications. We delete the details once your request has been dealt with and no retention period applies.

Contact by email

If you send us an email, we process your details in order to answer your request. The legal basis is Art. 6(1)(b) GDPR where a contract or its preparation is concerned, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering). We delete the details when they are no longer needed for this and no retention period applies.

Ask EUlyra (website assistant)

On our website you can ask the assistant “Ask EUlyra” questions about EUlyra. The answers are generated by an AI of Mistral AI SAS, 15 rue des Halles, 75001 Paris, France. It relies solely on the texts of this website and may contain errors; only the contract, the DPA and our documents are binding. Please do not enter any personal data.

The conversation is not saved: The conversation only exists in the open browser window. We do not set any cookies for it and store nothing on your device; it is deleted when you reload the page, close the tab or leave the page. Our server keeps neither the conversation nor the answers nor any identifier of you or your conversation.

Transfer to Mistral AI: For each answer, we send your question, the conversation so far and the language of the page to Mistral AI. Mistral AI processes the data as a processor on our behalf; a data processing agreement under Art. 28 GDPR is in place. Inputs and outputs are neither stored there nor used for training (Zero Data Retention). Mistral AI processes the data via its European endpoint in data centres in the EU or EEA. For security and network services, Mistral AI uses providers with locations outside the EU as well (for example in the USA); standard contractual clauses of the European Commission apply to these.

Stored questions: To improve our answers and frequently asked questions, we store each question individually for 7 days on our web space. Before that, we replace email addresses, telephone numbers, IBANs, postal addresses, links and names following a form of address with placeholders. We also store the topic, language, page, day and whether the assistant was able to answer the question – no answer, no time, no IP address and nothing that would allow the questions of a conversation to be linked to each other or to you. We do not store questions that have nothing to do with EUlyra. Once a day, we use Mistral AI (without storage there) to summarise the stored questions into newly worded sample questions – without the wording of the questions and without personal data. We keep this list without a time limit; we delete the individual questions after 7 days.

Statistics and protection against misuse: We count the questions per day by topic, language and page – as a number only. To limit the number of questions per hour, we store a hash of your IP address for one hour, never the address itself.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in answering your questions about EUlyra, improving our answers and protecting the assistant against misuse. Where a contract or its preparation is concerned, Art. 6(1)(b) GDPR is an additional legal basis. The assistant does not make any decisions about you.

Recipients

Within NAVIGRO, only the people handling your application or request receive your data. We use ALL-INKL (see above) as processor for web space and email and, for the demo environment, Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. This data is not transferred to countries outside the EU. The privacy notice of the demo (in German) names further recipients in the demo environment.

For the assistant “Ask EUlyra”, we use Mistral AI (see above) as a processor.

Your rights

You have the right to:

• access to your stored data (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21 GDPR)
• withdraw consent with effect for the future (Art. 7(3) GDPR)

To exercise these rights, contact info@navigro.eu. You can also lodge a complaint with a data protection supervisory authority, for example the authority responsible for us, the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

No automated decisions

Decisions on your application are made by people at NAVIGRO. No automated decision-making, including profiling, under Art. 22 GDPR takes place.