Datenschutzerklärung

Privacy policy

Last updated: [Month Day, Year]

This policy explains how we process personal data when you visit our website, contact us, book or call a demo, or receive an email from us. We process personal data in line with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

1. Who is responsible

The controller responsible for processing your data is:

Data protection officer. In Germany you generally need one only if at least 20 people in your company regularly process personal data by automated means (§ 38 BDSG). If you appoint one, add their contact details here.

2. Summary

• This website does not use cookies, analytics, or advertising trackers, and it loads no content from third-party servers.
• When you visit, our hosting provider processes technical data such as your IP address so the site can load.
• When you email us, call our demo line, or book a demo, we use what you give us to respond and run the demo.
• We contact businesses by email using business contact details. You can object at any time and we will stop.

3. Visiting this website

Our website is hosted on Cloudflare Pages, a service of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare also manages our domain and its DNS. When you visit, Cloudflare's servers automatically process:

• your IP address
• date and time of the request
• the page requested and the referring page
• browser type, version, and operating system
• amount of data transferred and the response status

Purpose: to deliver the website and keep it secure and stable.
Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is a working, secure website.
Retention: we don't store these logs ourselves. Cloudflare keeps them only as long as needed to operate and protect the service.

Cloudflare acts as our processor under its data processing addendum (Art. 28 GDPR). Cloudflare is certified under the EU-U.S. Data Privacy Framework (see section 11).

Check before publishing: confirm Cloudflare's entry on dataprivacyframework.gov, and that Cloudflare's data processing addendum applies to your account. It is part of Cloudflare's self-serve terms.

4. Fonts

The fonts on this website are stored on our own server and load from there. Your browser does not connect to Google or any other font provider, and no data is sent to third parties when the fonts load.

Keep it that way. If you later add an embed that loads from another server, such as a booking widget, video, or map, add a section for it here.

5. Contacting us

When you email or call us, we process the information you give us, such as your name, email address, phone number, company, and the content of your message.

Purpose: to answer your request.
Legal basis: Art. 6 (1) (b) GDPR if your request relates to a contract or steps before a contract. Otherwise Art. 6 (1) (f) GDPR, based on our legitimate interest in answering inquiries.
Retention: we delete the data once your request is fully handled, unless statutory retention periods under German commercial and tax law apply.

Our email is provided by [Email provider, e.g. Google Workspace or Microsoft 365], with whom we have a data processing agreement.

6. Booking a demo

Our booking link takes you to [Calendly, operated by Calendly LLC, USA]. There you enter your name, email address, company, and preferred time, and optionally a phone number and notes. We receive this information to schedule and hold the demo.

Legal basis: Art. 6 (1) (b) GDPR (steps before a possible contract).
Retention: [12] months after the demo, unless we enter into a contract with you.

The demo takes place via [Zoom / Google Meet / Microsoft Teams]. The booking and video tools act as our processors. For transfers to the USA, see section 11.

Check before publishing: confirm on dataprivacyframework.gov that your booking and video tools are certified, and sign their data processing agreements.

7. Calling our demo line

When you call our demo line, our AI receptionist answers. At the start of the call you are told that you are speaking with an AI and that the call is recorded. We process:

• your phone number and the time and length of the call
• the audio recording of the call
• an automatic transcript and summary of the call

Purpose: to show how our service works and to review and improve the demo.
Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is demonstrating our product to businesses that are interested in it.
Retention: recordings and transcripts are deleted after [30] days.

We use [telephony provider, e.g. Twilio], [voice AI platform], and [language model provider] as processors. Please don't share sensitive personal information, such as health details, on the demo line.

Make the call match this text. Your demo agent must actually say at the start that it is an AI and that the call is recorded. Several US states require consent from everyone on a call before it is recorded.

8. Emails we send to businesses

We contact businesses in the United States by email to offer our services. For this we process business contact data:

• name and job title
• business email address
• company name, website, industry, and location

Source: we collect this data from [publicly available company websites, business directories, and B2B data providers such as …].
Purpose: to offer our services to businesses (direct marketing).
Legal basis: Art. 6 (1) (f) GDPR. Recital 47 GDPR recognizes direct marketing as a legitimate interest.
Retention: if there is no reply within [12] months, we delete the data. If you object, we keep only your email address on a suppression list so that we never contact you again.

Every email we send includes a way to opt out. We send emails using [mailbox provider, e.g. Google Workspace or Microsoft 365 via Primeforge] and [sending tool, e.g. Salesforge or Instantly], which act as our processors.

Why this section matters. Because your business is in the EU, the GDPR applies to your outreach even when the recipients are in the USA. When you collect data from sources other than the person, you must tell them where it came from (Art. 14 GDPR). Linking this policy in your email signature is a simple way to do that.

9. Data we process for our customers

When a business uses Callorin, we process data about the people who call that business, such as names, phone numbers, appointment details, call recordings, and transcripts. We do this on behalf of and under the instructions of that business, under a data processing agreement (Art. 28 GDPR). The business is responsible for that data. If you called a business that uses Callorin, please contact that business about your data.

10. Recipients and service providers

We share personal data only where needed for the purposes above:

• hosting, domain, and DNS: Cloudflare, Inc.
• email and outreach: [providers]
• scheduling and video calls: [providers]
• telephony and voice AI: [providers]
• CRM: [provider, e.g. HubSpot]

These providers act as our processors and are bound by data processing agreements. We also disclose data to authorities where the law requires it.

11. Transfers outside the EU

Some of our service providers are located in the United States. We transfer data to them only if one of these safeguards applies:

• the provider is certified under the EU-U.S. Data Privacy Framework, which the European Commission has found to provide an adequate level of protection (Art. 45 GDPR), or
• we have agreed the EU standard contractual clauses with the provider (Art. 46 (2) (c) GDPR).

12. How long we keep data

We keep personal data only as long as needed for the purpose it was collected for, as described in each section above. Where German commercial or tax law requires us to keep records, such as invoices and business letters, we keep them for the statutory period and then delete them.

13. Your rights

You have the right to:

• access the personal data we hold about you (Art. 15 GDPR)
• have incorrect data corrected (Art. 16 GDPR)
• have your data deleted (Art. 17 GDPR)
• restrict how we process your data (Art. 18 GDPR)
• receive your data in a portable format (Art. 20 GDPR)
• object to processing (Art. 21 GDPR, see section 14)
• withdraw any consent you have given, with effect for the future (Art. 7 (3) GDPR)

To use these rights, email [privacy@callorin.com].

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU country where you live or work. The authority responsible for us is [the data protection authority of your German state, with address].

14. Your right to object

15. Other information

Do you have to provide data?

No. You don't have to provide any personal data. Without your contact details, however, we can't answer your request or schedule a demo.

Automated decisions

We do not make decisions based solely on automated processing, including profiling, that have legal or similarly significant effects on you (Art. 22 GDPR).

Security

This website is served over an encrypted connection (TLS). We protect personal data with technical and organizational measures that match the risk.

Changes to this policy

We update this policy when our services or the law change. The current version is always on this page.