Privacy Policy

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws and other data protection provisions is:

We take the protection of your personal data very seriously and treat it confidentially and in accordance with statutory data protection regulations and this privacy policy. Personal data is any information relating to an identified or identifiable natural person.

We collect, process and use personal data only where a legal basis exists or you have consented to the processing. The legal bases arise in particular from:

• Art. 6(1)(a) GDPR — Consent of the data subject
• Art. 6(1)(b) GDPR — Performance of a contract or pre-contractual measures
• Art. 6(1)(c) GDPR — Compliance with a legal obligation
• Art. 6(1)(f) GDPR — Legitimate interests

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, and delivered as a static site (no application server or database behind the website). Vercel operates a global edge network with server locations including the EU. Data transfer to the USA is based on Standard Contractual Clauses (Art. 46(2)(c) GDPR) and the EU-U.S. Data Privacy Framework. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and efficient provision).

All data transfers between your browser and our servers are encrypted via HTTPS (TLS 1.2 or higher). This applies to both the homepage and the platform. You can recognise an encrypted connection by the lock symbol in your browser address bar and the "https://" prefix.

We currently use only technically necessary cookies on this website (e.g. storing the selected language DE/EN and the cookie settings themselves). We do not integrate any analytics tool that uses cookies or cross-site tracking (no Google Analytics or comparable) or advertising cookies. Two cookieless reach measurements do run: (1) Vercel Web Analytics, part of our hosting, counts page views anonymously; it sets no cookies, stores no IP address and recognises a visitor only for one day via a non-reversible hash. (2) On the pages of our online products we report one page view per product and day to our own platform (app.invictix.de), together with any campaign parameters in the address (utm_*) and the host name of the referring page. Only a daily count per product is stored -- no time of day, no identifier, no device and no IP address; the IP address is used only transiently to limit requests. The legal basis for both measurements is Art. 6(1)(f) GDPR (legitimate interest in reach measurement without accessing the end device).

We nevertheless display a cookie banner with the categories Necessary, Analytics and Marketing so that consent can be obtained if we introduce additional, non-essential cookies in the future. The Analytics and Marketing categories are currently inactive.

The provider of these pages automatically collects and stores information in server log files, which your browser automatically transmits to us:

• Browser type and version
• Operating system used
• Referrer URL (previously visited page)
• Hostname of the accessing device
• Time of the server request
• IP address (anonymised after 7 days)

These data cannot be attributed to specific persons and are not merged with other data sources. Storage is based on Art. 6(1)(f) GDPR (legitimate interest in the smooth operation and security of the website). Log files are automatically deleted after 30 days.

The contact form on this website is technically handled via our own Microsoft 365 infrastructure. If you use the form or contact us by email, the data you provide (name, company, email address, phone number, address, topic, message content) is delivered directly to us by email in order to process your enquiry and for any follow-up questions. No further third-party providers are involved in delivery.

In addition, we record your enquiry in our CRM system (our own platform, operated on a server of STRATO GmbH in Germany) so that we can assign and follow it up. We store alongside it: where the enquiry came from (form or self-check), any campaign parameters of the visited address (utm_*), the host name of the referring site (not the full address) and the first page visited in this session. Until you submit the form, this origin information only exists in your browser (sessionStorage, no cookie) and is transmitted only when you submit.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries and in operating a technically reliable form). Enquiries that do not lead to a contract are deleted after 12 months at the latest. Otherwise, data is deleted once the purpose ceases to apply and no statutory retention obligations exist.

On our support page, you can ask an AI-powered assistant questions about our offering. Your question is transmitted to an AI provider (Anthropic PBC, USA) to generate an answer. The question and answer are then stored to improve our offering and our FAQ (e.g. which questions are asked frequently).

If you additionally provide an email address voluntarily so that we can reply to you personally, Section 7 of this policy (Contact Form and Email Contact) applies in addition. Please do not submit particularly sensitive data (e.g. health data, Art. 9 GDPR) in the free-text field.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in answering questions and improving our offering). Stored questions are deleted or evaluated anonymously after 24 months at the latest.

If you sign up for the newsletter “Invictix Systems News”, we process your email address and, if you provide them, your name and company in order to send you articles and news from Invictix Systems about every two weeks. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR.

• Confirmation procedure (double opt-in): After signing up you receive an email with a confirmation link. The link is valid for seven days (sign-up on the website) or 48 hours (sign-up with a download). Only after clicking it are you subscribed. Unconfirmed sign-ups are deleted when the link expires.
• Proof of consent: We store the time of sign-up and confirmation, your IP address, the browser identifier, the wording and version of the consent and the page on which you signed up, for as long as the newsletter runs and for the statutory limitation periods afterwards.
• Processing: in our own platform on a server of STRATO GmbH in Germany. The confirmation and unsubscribe pages are located at app.invictix.de.
• Delivery: through our email service Microsoft 365 (Microsoft Ireland Operations Limited) on the basis of a data processing agreement. We do not measure opens and do not use tracking pixels.
• Links in the newsletter lead to our website and may contain a campaign identifier (utm_*). It is only stored when you submit the contact form (see Section 7).
• Withdrawal: You can withdraw your consent at any time with effect for the future, via the unsubscribe link in every email or by writing to us. The lawfulness of the processing carried out until then remains unaffected.
• After withdrawal we store your email address only in a block list so that we do not write to you again by mistake (legitimate interest, Art. 6(1)(f) GDPR, and proof of the withdrawal).

Downloads (whitepapers and templates): If you order a free download, we process first name, last name, company, optionally your role and your email address in order to send you the download link (Art. 6(1)(b) and (f) GDPR). The link is valid for 30 days and can be used up to ten times. For your order we create a contact in our CRM (source: download) and store the origin information from Section 7. The order is anonymised after 24 months. We only use your address for the newsletter if you additionally and expressly consent to this; the download does not depend on it.

We use the following processors with whom data processing agreements (DPA) pursuant to Art. 28 GDPR have been concluded:

Your personal data is generally not transmitted to third parties, except:

• You have given your express consent (Art. 6(1)(a) GDPR)
• Disclosure is necessary for contract performance (Art. 6(1)(b) GDPR)
• There is a legal obligation to disclose (Art. 6(1)(c) GDPR)
• Disclosure is necessary for legitimate interests and your interests do not override (Art. 6(1)(f) GDPR)

Personal data is deleted or blocked as soon as the purpose of storage ceases to apply. In addition, the following retention periods apply:

You have the following rights with regard to personal data concerning you:

To exercise your rights, please contact: info@invictix.de

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.

We reserve the right to amend this privacy policy so that it always complies with current legal requirements or to implement changes to our services. The new privacy policy will then apply to your next visit.

Last updated: October 16, 2026