Privacy Policy.
Last updated: October 12, 2026
1. Controller and scope
O2O Insights GmbH, Schützenstrasse 7, 73033 Göppingen, Germany, is the controller for personal data processed in operating this website and for our own contact and contractual processes. You can reach us at info@elevateone.ai. This notice explains the purposes, legal bases and rights associated with using ElevateOne.
Where we process personal data from your business exclusively on your behalf, you remain the controller for that processing. The respective duties, instructions and technical measures must be governed by a separate data processing agreement under Article 28 GDPR before such processing takes place.
2. Data we process
Depending on the function used, we process technical access data such as IP address, time, pages requested and browser information, as well as contact, account and business data you provide. Contact enquiries include, in particular, name, email address, company, subject and message. Product functions may also process documents, operational data, questions and results you provide.
Provide only data needed for the relevant function and which you are lawfully entitled to share. Contact form fields marked as required are needed to process your enquiry. Without them, we may be unable to process it; optional fields are voluntary.
Market and feedback analyses may also use publicly accessible business websites, review platforms and data from systems you connect as sources. Such content may include personal information, such as names or review text. Data protection requirements also apply to publicly available data, including the applicable information duties under Article 14 GDPR.
3. Purposes and legal bases
- Providing agreed product functions, managing accounts and handling contractual enquiries: Article 6(1)(b) GDPR where you are personally a party to the contract. For business contact persons, necessary business communication is based on Article 6(1)(f) GDPR; our interest is managing the business relationship.
- General enquiries: Article 6(1)(f) GDPR. Our legitimate interest is responding to your enquiry. Article 6(1)(b) GDPR applies where it concerns entering into a contract with you.
- Secure website operation, troubleshooting and prevention of misuse: Article 6(1)(f) GDPR. Our interest is providing a functioning, protected service.
- Consent-based audience and usage analysis: Article 6(1)(a) GDPR; storage or access on your device which is not necessary additionally requires consent under section 25(1) TDDDG.
- Compliance with legal obligations, such as retaining accounting records: Article 6(1)(c) GDPR.
4. Your data protection rights
Subject to the applicable legal requirements, you have rights of access, rectification, erasure, restriction of processing and data portability. You may withdraw consent at any time for the future. Withdrawal does not affect the lawfulness of earlier processing.
Right to object: Where processing is based on Article 6(1)(e) or (f) GDPR, you may object on grounds relating to your particular situation. You may object to processing for direct marketing at any time without giving reasons.
You may also lodge a complaint with a data protection supervisory authority, in particular in the country of your habitual residence, workplace or the alleged infringement. The competent authority for our registered office is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg.
Information and complaints at the Baden-Württemberg supervisory authority
5. Cookies, local storage and Google Analytics
We store your cookie preferences in your browser’s local storage. This is necessary to respect your choice and is based on section 25(2) no. 2 TDDDG; personal data processing is based on our legitimate interest in reliable consent management under Article 6(1)(f) GDPR. Your preferences remain stored until you change them or delete your browser data.
Google Analytics 4 is loaded only after you expressly consent to analytics cookies. Google’s service processes, among other things, page views, interactions and technical device information to analyze website usage. The legal bases are Article 6(1)(a) GDPR and section 25(1) TDDDG. Google Signals and personalized advertising are disabled in our website configuration.
Analytics cookies set through our GA4 configuration are limited to twelve months; further visits do not automatically extend their lifetime. Google’s separate retention of user- and event-level data depends on the GA4 property configuration; standard properties offer two or fourteen months. Aggregated reports are not subject to the same period. Further information is available from Google.
This website currently embeds no separate marketing tracking services. Selecting the marketing category therefore does not activate an additional service. Using additional services that require consent requires appropriate information and valid consent beforehand.
You may change or withdraw your preferences at any time through “Cookie settings”. Non-essential analytics remains disabled if rejected. You may also delete previously stored cookies in your browser.
6. Hosting, email and AI processing
We use Microsoft Azure to host our website and the ElevateOne app, including its backend. We use IONOS/1&1 services for email. AI-powered product functions use different model services, in particular Google Gemini. Inputs and context information necessary for the relevant function may be transmitted to the service used. Using an AI function does not constitute blanket consent to arbitrary additional uses of data.
When selecting and integrating service providers, data protection roles, contractual requirements and necessary safeguards must be observed. A contract under Article 28 GDPR is required where a service provider processes personal data on our behalf. Data processed on your behalf is governed by the agreed instructions and the relevant data processing agreement.
7. Recipients and payment processing
Data may be disclosed as necessary to IT providers for hosting, email, AI processing and analytics, and to payment providers. Professional advisers or authorities may also receive data where needed to comply with legal duties or establish, exercise or defend legal claims. Disclosure requires an applicable legal basis.
When you purchase through Paddle, the Paddle entity identified at checkout processes payment and billing data as an independent controller and merchant of record. We receive order and contractual information needed to provide and manage your subscription. Processing directly in Paddle checkout is additionally governed by its privacy notice.
8. Transfers outside the EEA
International providers, in particular Google or Paddle, may process data outside the European Economic Area. Such transfers require compliance with Articles 44 et seq. GDPR, for example an applicable adequacy decision or appropriate safeguards such as EU standard contractual clauses and additional measures where necessary. Certification under an adequacy framework is relevant only for the specifically covered entity with valid certification.
Merely using the service or accepting this privacy notice does not constitute consent to third-country transfers. Where explicit consent under Article 49 GDPR is exceptionally required, it must be obtained separately after informing you of the specific risks. You may request information on recipients and safeguards relevant to a particular processing activity, and a copy of available safeguards, at info@elevateone.ai.
9. Retention and deletion criteria
We retain personal data according to its purpose. Contact enquiries are retained for handling and necessary follow-up. Contractual and account data is needed to perform the contract. Technical logs are processed for operation, troubleshooting and security and must not be retained longer than necessary for those purposes. Return and deletion of customer data processed on your behalf are governed by the agreed instructions and data processing agreement.
Statutory retention duties, in particular for commercial and tax records, and the need to preserve or defend legal claims may justify longer retention. Processing is then restricted to those purposes. Once the purpose and relevant retention grounds no longer apply, data must be deleted or anonymized. Separate information on local cookie preferences and analytics is provided in section 5.
10. Security and protection of your data
We implement appropriate technical and organizational measures according to the risk of processing under Article 32 GDPR. These include protection against unauthorized access and secure transmission. No internet application can guarantee absolute security; statutory security and information duties remain unaffected.
The service is intended for business users, not children. If we become aware of unlawfully processed children’s data, we assess the necessary protective and deletion measures.
11. Changes to this notice
We update this privacy notice when the processing described or legal requirements change. An update does not replace any required new consent. Statutorily required information must be provided beforehand if further processing for another purpose is intended.
12. Contact
For data protection enquiries and to exercise your rights: info@elevateone.ai or O2O Insights GmbH, Schützenstrasse 7, 73033 Göppingen, Germany.