Privacy Policy
Last updated: October 2026
1. Controller
The controller for data processing on this website is NexAI – Next Generation Artificial Intelligence GbR (hereinafter “NEXAI”), represented by its partners Maximilian Trenk and Jason Brian Merklein, Untere Bergstraße 13, 74586 Frankenhardt-Honhardt, Germany. For privacy questions, reach us at mbt@nex-a-i.com. You can reach our data protection officer at datenschutz@nex-a-i.com.
2. What data we process
We process personal data only to the extent necessary to provide the website and to handle your enquiries. Depending on how you use the site, this includes in particular: – data from the contact and partner form (name, email, company, for the partner form also type of company and website if applicable, message) and the content of your emails to us, – data from the sales partner application form (name, email, phone, desired role, sales experience, availability, optional profile link and message, origin of the page visit), – your email address and the time of your confirmation if you sign up for the newsletter, – input in the AI chat assistant and any contact details you voluntarily provide, – details for online appointment booking and for the AI phone/voice assistant (name, email, phone number, request, preferred time or callback request), – technical access data generated automatically when the website is called up (e.g. IP address, time, content requested). Details of purposes, legal bases, processors used and retention periods can be found in the sections below.
3. Legal bases
Depending on the processing, we rely on different legal bases: – Art. 6(1)(b) GDPR (contract or pre-contractual measures) – e.g. handling your enquiry and arranging appointments, – Art. 6(1)(c) GDPR (legal obligation) – e.g. statutory retention obligations and blocking your data after you object to advertising (section 13), – Art. 6(1)(f) GDPR (legitimate interests) – e.g. secure and efficient provision of the website and communication with prospects, – Art. 6(1)(a) GDPR (consent) – where we expressly ask for your consent (in particular the newsletter). We state the relevant basis for each individual processing activity in the sections below. Storage in your browser is additionally governed by § 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) (section 6). There is no automated individual decision-making, including profiling, within the meaning of Art. 22 GDPR.
4. Retention and erasure
We erase personal data as soon as the purpose of processing no longer applies, at the latest after the following standard periods – unless statutory retention obligations (in particular § 147 of the German Fiscal Code, § 257 of the German Commercial Code) apply, in which case the data is restricted for the duration of the period and then erased: – enquiries via the contact and partner form, chat, appointment booking and phone in our CRM: we delete the record of the enquiry 6 months after it was last handled. Your contact details (name, email address, phone number) are anonymised no later than 6 months after the last activity. If the enquiry leads to an order, the periods for customer data apply, – emails to us, including notifications about form submissions: in our mailbox for as long as we need them to handle the matter and answer follow-up questions; business letters and accounting records until the end of the statutory retention period. The copy in our email assistant: 180 days after receipt, attachments 90 days (section 7), – sales partner applications: 6 months after the application process has been concluded; your contact details in the CRM as above (section 12), – appointments in the booking calendar (online booking, chat and phone): anonymised 12 months after the last appointment; records of confirmations and reminders sent: 6 months; the appointment in the calendar of our partner portal: 6 months after the appointment, – chat: we do not keep a complete chat history permanently; details in section 9, – call logs of the voice assistant at our provider Vapi: around 14 days; call data in the CRM: 6 months, – telephone outreach to companies (research, lists, referrals, call records): own periods in section 13, – newsletter: until you withdraw your consent; for the proof of consent see section 8, – technical server/access logs: 30 days. Calls with the voice assistant are not recorded as audio.
5. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21, see the following section). You can withdraw any consent given at any time with effect for the future (Art. 7(3) GDPR); this does not affect the lawfulness of processing carried out before the withdrawal. An informal message to mbt@nex-a-i.com is sufficient to exercise your rights. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (LfDI BW), Heilbronner Straße 35, 70191 Stuttgart, Germany.
Your right to object (Art. 21 GDPR)
Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You may object to processing for direct marketing at any time without giving reasons; we will then no longer process your data for that purpose. An informal message to mbt@nex-a-i.com is sufficient.
6. Hosting and server logs
This website is hosted on a server in Germany by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. On our behalf (Art. 28 GDPR), Hetzner processes the technical access data generated when the website is called up — in particular your IP address, the time of access, the content requested, the referrer and the browser used (server log files) — in order to deliver the site and ensure security. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure, functioning website). We delete server logs after 30 days. Processing takes place exclusively on servers in Germany; no transfer to a third country occurs. Protection against misuse. For the chat, appointment booking and the application form, we process your IP address together with the time of your requests in the web server's memory in order to fend off too many requests in a short time (rate limiting). For this purpose it is neither stored nor passed on; the entry in memory is lost at the latest when the web server is next restarted. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in protection against misuse). Cookies and storage in your browser. This website does not use any cookies and no tracking or analytics services. The language version follows from the web address; nothing is stored in your browser for this. The only thing stored in your browser is the chat history, and only after you have sent a message (section 9). The exception is the password-protected editorial area, which only we ourselves use: logging in there sets a cookie.
7. Contact and partner form, email
When you contact us via the contact or partner form or by email, we process the data you provide (e.g. name, email address, company, for the partner form also type of company and website, message) and the content of your emails in order to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry is aimed at concluding or initiating a contract, and otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries). To send and deliver the associated emails we use Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, USA, as a processor. Emails are sent via a data centre in Ireland; because Resend is a US company, the data you submit is also transferred to the USA. Resend is certified under the EU-U.S. Data Privacy Framework, so the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR) and, additionally, on the EU Standard Contractual Clauses (Art. 46 GDPR). You can request a copy of the safeguards from us. Our email mailbox is operated for us as a processor by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Workspace). Your emails to us and our internal notifications are received there, for example about form submissions, applications, callback requests by phone and newsletter confirmations. Processing by Google LLC in the USA is possible; Google LLC is certified under the EU-U.S. Data Privacy Framework, so the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR) and, additionally, on the EU Standard Contractual Clauses (Art. 46 GDPR). Email assistant. Emails arriving in our mailbox — including notifications about form submissions — are reviewed by our self-operated email assistant on a server of Hetzner Online GmbH in Germany. It classifies the messages (by importance and type), summarises them, checks them for fraud attempts and drafts replies. It only sends a reply once a person has approved it, except to senders we have expressly approved for automatic sending; such replies carry a notice to that effect. For classification and drafts it transmits sender, subject, text and PDF and text attachments to an AI language model. The provider is our processor Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland; the data is processed by Anthropic PBC in the USA. Anthropic is not certified under the EU-U.S. Data Privacy Framework; the transfer is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) in Anthropic's data processing agreement. You can request a copy from us. The data is not used to train AI models. According to Anthropic, it deletes inputs and outputs within 30 days; if its safety systems flag a request as a possible violation of its usage policy, Anthropic retains it for up to 2 years. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in handling our correspondence promptly and in an orderly manner and in protection against fraud). The assistant does not make any decision with legal effect. We delete the copy in the email assistant 180 days after receipt, attachments after 90 days. Please do not send us health data or other particularly sensitive information by email. We also store the request and contact data you submit via the form in our self-operated CRM system (customer management) on a server in Germany (Hetzner Online GmbH, Gunzenhausen), in order to handle your enquiry and manage the ongoing contact; we operate the CRM ourselves and no hand-off to third parties takes place. We delete the record of your enquiry 6 months after it was last handled; your contact details are anonymised no later than 6 months after the last activity unless the enquiry leads to an order. Providing the data is voluntary; however, without the information required to respond we cannot process your enquiry.
8. Newsletter
If you sign up for our newsletter, we process your email address to send you information on applied AI and on our services once or twice a month. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. We use the double opt-in procedure: after signing up you receive a confirmation email with a link that is valid for 3 days, and we only add you to the distribution list after you confirm. If you do not confirm, we do not add you; we do not keep a list of unconfirmed sign-ups. When you confirm, we receive an internal message with your email address, the time of confirmation and the version of the consent text; it is our proof of your consent (Art. 7(1) GDPR). We do not store your IP address for this. You can withdraw your consent at any time with effect for the future, e.g. via the unsubscribe link in every newsletter email or by messaging mbt@nex-a-i.com. Withdrawal does not affect the lawfulness of processing carried out beforehand. We send the confirmation email and the newsletter via the processor Plus Five Five, Inc. (Resend), USA; the internal message containing the proof goes to our email mailbox (Google Workspace). For both, the information on recipients and third-country transfers in section 7 applies accordingly. Retention. We use your email address for the newsletter until you withdraw your consent. After that, we keep the proof of your consent until the end of the third calendar year after the withdrawal so that we can demonstrate the consent if necessary (Art. 6(1)(f) GDPR). Voluntariness. Providing your email address is voluntary; without it we cannot send you the newsletter.
9. AI-powered chat assistant
Our website offers an AI-powered chat assistant. You are communicating with an AI system, not with a natural person. Data processed. When you use the chat, we process the messages you enter (chat content) and — where you voluntarily provide them — your contact details (name, email address, phone number) and your request, in order to answer your enquiry and — at your request — to arrange a consultation appointment. So that the conversation is retained during a session, the messages of that session together with a random session identifier are stored in your browser's sessionStorage, but only after you have sent your first message; this data is deleted when you close the browser tab. If you reopen the chat in the same tab, the website reads this storage so that you can continue your conversation; it does not access it before then. This storage and this access are strictly necessary for the chat you requested (§ 25(2) no. 2 TDDDG). The chat does not set cookies. Purposes and legal bases. – Answering contract-related enquiries and arranging a consultation appointment: Art. 6(1)(b) GDPR (pre-contractual measures or performance of a contract). – Answering general enquiries without a contractual context and operating the chat assistant efficiently: Art. 6(1)(f) GDPR (legitimate interest in efficient communication with prospects and customers). Service providers and recipients. Your chat input is processed on our behalf (Art. 28 GDPR) by OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, using an AI language model; processing by OpenAI OpCo, LLC in the USA is possible. The services are linked via an automation instance we operate ourselves (software: n8n) on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. If you book an appointment in the chat, we create it in our self-operated booking calendar on a server in Germany (Hetzner Online GmbH). The consultation is conducted by a self-employed sales partner working on our behalf, who is given access to the appointment with your name, contact details and request for this purpose. We also record the appointment in the calendar of our partner portal (section 10). We send the confirmation and reminder via Resend (section 7). We store your request and contact data and a prospect record created from it in our self-operated CRM system on a server in Germany (Hetzner Online GmbH). No use for training. The data entered via the chat is not used to train our providers' AI models. Transfer to the USA. OpenAI is not certified under the EU-U.S. Data Privacy Framework. We base any transfer to OpenAI OpCo, LLC on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), which form part of our data processing agreement with OpenAI. You can request a copy from us. For Resend, section 7 applies. Retention. We do not keep a complete chat history permanently. In your browser it remains until you close the tab. Our automation server holds the last 20 exchanges of your session only in memory so that the assistant knows the context; they are lost at the latest when the server is next restarted. If a request fails with a technical error, its execution log is kept for no more than around 24 hours. According to OpenAI, it retains inputs and outputs for up to 30 days for abuse monitoring. In the CRM we do not store the chat history, only your contact details and your request summarised in one sentence. We delete the record of the enquiry 6 months after it was last handled, and your contact details are anonymised no later than 6 months after the last activity. We anonymise appointments in the booking calendar 12 months after your last appointment; in the partner portal we delete the appointment 6 months after it took place. Voluntariness. Providing your data is voluntary. However, without contact details we cannot arrange an appointment with you. Your rights / objection. You have the rights set out in section 5 (Your rights). Where we base processing on Art. 6(1)(f) GDPR, you also have the right to object at any time on grounds relating to your particular situation (Art. 21 GDPR).
10. Online appointment booking
You can book a consultation slot yourself on our contact page, and an introductory call on the “Sales partners” page. The following information applies equally if you book via the personal booking link of one of our contact persons (address nextime.nex-a-i.com). Data processed. To show you available times we query our booking calendar only for which slots are free — no event titles, contents or attendees are transmitted to your browser. When you book, we process your name, your email address, the time slot you selected and, if you choose to provide it, a brief description of your enquiry. If you book via a personal booking link, we ask for your name and phone number as mandatory details; email address and a note are optional there. Purpose and legal basis. The data is used solely to arrange and hold the appointment you requested. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures taken at your request). Booking calendar and recipients. The appointment is created in our self-operated booking calendar on a server in Germany (Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen); no transfer to a third country takes place. The consultation is conducted by a self-employed sales partner working on our behalf, who is given access to the appointment and the details listed above for this purpose. In addition, we store the appointment and the associated contact details in our self-operated CRM system on a server in Germany (Hetzner Online GmbH); no hand-off to third parties takes place. Our automation also enters the appointment with your name, contact details and request in the calendar of our self-operated partner portal (nexaiapp.de) on a server in Germany (Hetzner Online GmbH), so that the person responsible sees it there. Confirmation and reminder. After booking you receive a confirmation at the email address you provided, with a calendar entry to save and a personal link through which you can reschedule or cancel the appointment. We send you an email reminder 24 hours before the appointment. We use Resend to send these emails; section 7 applies accordingly. Without an email address you will not receive an email confirmation; we do not send text messages. Storage period. Your contact details in the booking calendar are anonymised 12 months after your last appointment; longer retention only takes place where statutory retention obligations apply. The personal link to reschedule or cancel expires one hour after the appointment. Records of sent emails are deleted after 6 months, the appointment in the partner portal 6 months after it took place. In the CRM we delete the record of your booking 6 months after it was last handled; your contact details there are anonymised no later than 6 months after the last activity. Voluntary provision and withdrawal. Providing the data is voluntary; without a name and email address (for a personal booking link: name and phone number) we cannot arrange the appointment. You can reschedule or cancel up to 24 hours in advance through the link in the confirmation, and after that, or at any time, by contacting us informally. The rights set out in section 5 apply.
11. AI phone / voice assistant
For appointment requests and callback requests we offer an AI-powered voice assistant — among other things via our phone number. At the start of the call you are informed that you are speaking with an AI system. On request, the assistant transfers your call to a person on our team. Data processed. We process your phone number, the details you provide (name, request, preferred time or callback request and — if provided — email address and callback number) and technical connection data in order to handle your enquiry, arrange a consultation appointment or call you back. The call is not recorded as audio. Purposes and legal bases. Art. 6(1)(b) GDPR (initiation/performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in efficient appointment scheduling and reachability). Service providers and recipients. – our own telephone system on a server of Hetzner Online GmbH in Germany – answering and forwarding the call; – Vapi, Inc., San Francisco, California, USA – voice assistant and telephony orchestration and speech synthesis; – Soniox, Inc., Foster City, California, USA – speech recognition, sub-processor of Vapi; – OpenAI Ireland Limited, Dublin, Ireland (possibly OpenAI OpCo, LLC, USA) – language model; – easybell GmbH, Brückenstraße 5a, 10179 Berlin, Germany – telephone connection (SIP); easybell processes the connection data as a telecommunications provider under its own responsibility. We create your appointment in our self-operated booking calendar on a server in Germany (Hetzner Online GmbH). The consultation is conducted by a self-employed sales partner working on our behalf, who is given access to the appointment. We also record the appointment in the calendar of our partner portal (section 10). If you provided an email address, you receive the confirmation and reminder via Resend (section 7). If you request a callback, we receive your name, callback number and request by email in our mailbox (Google Workspace, section 7). Automation and storage of your appointment, callback and call data run on our self-operated n8n instance and CRM system on servers in Germany (Hetzner Online GmbH). Transfer to third countries. Vapi and Soniox process the data in the USA; with OpenAI, processing in the USA is possible. None of these providers is certified under the EU-U.S. Data Privacy Framework; we base the transfer on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) together with supplementary measures. You can request a copy from us. Retention. The call is not recorded as audio. For troubleshooting, Vapi keeps a text log of the conversation for around 14 days. We anonymise your appointment in the booking calendar 12 months after your last appointment; in the partner portal we delete it 6 months after it took place. In the CRM we keep call data and the record of your enquiry for 6 months; your contact details there are anonymised no later than 6 months after the last activity, unless statutory retention obligations apply. For the email about a callback request, section 4 (emails to us) applies. Voluntariness. Providing the data is voluntary; without contact details and a preferred time we cannot arrange an appointment, and without a callback number we cannot call you back. The rights set out in section 5 apply.
12. Applications as a sales partner
On our "Sales partners" page you can apply as a self-employed sales partner (setter/closer). This concerns the initiation of a self-employed collaboration, not an employment relationship. Data processed. Name, email address, phone number, desired role, sales experience, availability, optionally a profile link (LinkedIn/Instagram) and a message, the selected language and the time of application. In addition we record the origin of your page visit (identifier of the link used or UTM parameters, domain of the referring page). The page reads this origin data only when you submit the application, from the current web address and your browser's information on the referring page, and transmits it together with the application; nothing is stored in your browser for this. We process your IP address in the web server's memory to limit misuse of the form (rate limiting, section 6); it is not stored for this purpose. Purposes and legal bases. Conducting the application and selection process and initiating a sales partner contract at your request: Art. 6(1)(b) GDPR. Evaluating which channels applications come from and protecting against misuse: Art. 6(1)(f) GDPR (legitimate interest in effective partner acquisition and in the secure operation of the form). Recipients and service providers. For the confirmation of receipt sent to you and the internal notification we use Plus Five Five, Inc. (Resend), San Francisco, USA, as a processor. The internal notification goes to our email mailbox (Google Workspace), where our email assistant captures it like any incoming email; section 7 applies accordingly. We store your application data in our self-hosted CRM system on a server in Germany (Hetzner Online GmbH, Gunzenhausen) to manage the process; no data is passed on to third parties. If you subsequently book an intro call, section 10 (online appointment booking) applies. If a collaboration comes about, you receive access to our partner portal (nexaiapp.de) with its own privacy notices. No automated decision-making. People decide on your application. No AI system assesses you; our email assistant merely classifies the internal notification like any other email (section 7). There is no automated decision-making within the meaning of Art. 22 GDPR. Retention. We keep your application data until the application process has been concluded and for 6 months thereafter in order to defend or assert claims, in particular under the German General Equal Treatment Act (AGG), which via § 6(3) AGG also covers access to self-employed activity. Longer retention of this application data only takes place with your separate consent. Your contact details in the CRM (name, email address, phone number, note that you are an applicant) are anonymised no later than 6 months after the last activity. If a collaboration comes about, the data is transferred to contract management. Voluntariness. Providing the data is voluntary; without name, email address, phone number and desired role we cannot process your application. The confirmation of receipt is a transactional message, not a newsletter. You have the rights set out in section 5; you may object to processing based on Art. 6(1)(f) GDPR under Art. 21 GDPR.
13. Telephone outreach to companies: origin of contact data, calls, objection
Our sales team calls companies to present our services. This section informs the companies and their contact persons whom we call or intend to call (Art. 14 GDPR). The controller is NexAI GbR (section 1). Which companies we call. Companies in Germany. We only call companies in another country if we have approved that country for our sales activities beforehand. We do not approve Austria for our sales activities; we do not call companies in Austria without their prior consent. In addition, we only call a Swiss phone number if the caller has first checked in the Swiss phone directory search.ch that the number is listed and does not carry an asterisk (no-advertising marker). search.ch receives the number searched for (Switzerland, adequacy decision of the EU Commission). Origin of the contact data (Art. 14(2)(f) GDPR). The contact data comes from one of three sources: – Our own research in publicly accessible sources: OpenStreetMap, the company's website (legal notice, contact and careers pages) and public tenders from the German federal procurement notice service (Bekanntmachungsservice des Bundes). The research only covers companies in Germany. – Lists: contact lists that our management adds itself or that a sales partner or employee submits to it. Our management only adds its own lists stating their source, and they are thereby approved; a submitted list is only called once our management has checked it and approved it, stating its source. We tell you this source at the beginning of the call. – Referrals: someone has recommended your company to us, for example a customer or business partner. Here, too, calls are only made after review and approval by our management, unless our management has added the referral itself. On request, we will give you all available information about the source (Art. 15(1)(g) GDPR). Data processed. Company details (name, town or address, website, industry, approximate size, register number, VAT ID), business phone number and email address, where applicable the name and position of a contact person and a note on the entry, plus the country derived from dialling code, website and address, the processing status (last outcome, number of attempts, follow-up date) and, where applicable, a block of the entry by us together with its reason. Research results also include short excerpts indicating a possible need (e.g. a published job advertisement or tender), each with source and time of retrieval. The research only collects names if this function is switched on, and only of authorised representatives (e.g. managing director, owner) as named in the legal notice or, if there is none, on the contact page or home page. The research does not collect private contact details and does not derive personal email addresses from names. Call records. Before each call, the caller enters the reason for the call: the type of reason and a short sentence, e.g. the job advertisement or who referred you. For each call we also record: time, outcome and duration, whether a conversation took place, whether and which privacy notice was given and who called, plus a call note and, where applicable, a call-back date or an agreed appointment and an objection. Calls made by our sales partners are transferred to our own CRM: time, outcome, duration, whether a conversation took place, the number called, company name and town, the call note, any agreed appointment and any objection; if a conversation took place, also the name, email address, phone number and town as a contact. The reason and the privacy notice are not transferred to the CRM. Purpose and legal basis. We contact companies that may benefit from our services (direct marketing to companies) and document the calls so that we can demonstrate that we comply with the rules when doing so and to record the work of our sales partners. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR (cf. Recital 47). Under § 7(2) no. 1 of the German Act against Unfair Competition (UWG), a promotional call to a company is only permitted with its at least presumed consent. The caller must therefore record a specific reason before each call; the fact that the industry fits or that the number is public is not sufficient. In the call screen our portal only shows the phone number once the reason has been entered, and a call outcome can only be recorded with a reason; the recorded reason is our evidence. Our callers are instructed not to withhold their number (§ 15(2) TDDDG). We only send marketing emails with your prior express consent (§ 7(2) no. 2 UWG), for example if you ask for documents during the call. Recipients. The contact data is made available via our partner portal to the self-employed sales partners who call on our behalf and on our instructions; they are not permitted to use it for their own purposes or pass it on to third parties. We run the partner portal, the research and the CRM ourselves on servers in Germany (Hetzner Online GmbH, Gunzenhausen); no external AI service is involved in the research or the call records. The websites and services queried during research only receive the respective request, no personal data. Contact lists that the management compiles before adding them to the portal are edited in our spreadsheet storage at Google Workspace (Google Ireland Limited; for the transfer to third countries see section 7). If you ask for documents during the call or we arrange an appointment, our email assistant drafts the related emails (documents, appointment confirmation, reminder and the notification to the person responsible for the appointment) with the AI language model of Anthropic Ireland, Limited, Dublin, our processor. For this, Anthropic receives company, contact person, email address, phone number, website, town, where applicable the appointment, the note on the entry and the call note; this data is transferred to Anthropic PBC in the USA; for the retention period at Anthropic see section 7. Anthropic is not certified under the EU-U.S. Data Privacy Framework; we base the transfer on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), and you can request a copy at mbt@nex-a-i.com. If a sales partner pastes the transcript of a conversation with you into our training assistant to have it evaluated for training our sales partners (legitimate interest, Art. 6(1)(f) GDPR), it is received by OpenAI Ireland Limited, Dublin, as our processor; processing by OpenAI OpCo, LLC in the USA is possible, and we base this transfer on the EU Standard Contractual Clauses. On request, the portal replaces email addresses, phone numbers and street addresses before sending, but not names. Storage period (deviating from section 4). – Entries in our call lists: 12 months after the last call attempt, or 12 months after being added to the list if never called. Earlier if our management rejects the list or the list is deleted. If the contact becomes a customer, the periods for customer data apply from then on. An objection remains noted on the entry for as long as the entry exists. – Reasons entered before a call and blocks of individual entries by us: together with the entry. – Call records: when the entry is deleted, they lose the link to your company and the sentence describing the reason is deleted, at the latest on the following day. If an appointment resulted from the call, the link to that appointment remains until the appointment is deleted (see “Agreed appointments”). Without company, name or number, the time, outcome and duration of the call and the type and time of the reason and of the privacy notice are kept as evidence of our sales partners' work. – Origin and approval of a list (list name, origin, source, who submitted it and who decided; no contact data): until the end of the third calendar year after the year in which the list was rejected or its last entry was deleted, whichever is later. It is kept as long as any entry from the list still exists. – Agreed appointments: 12 months after the appointment. The internal message handing over an appointment to a colleague: 12 months. – Emails you asked for during the call: the request including its content, as evidence of your consent, for 36 months. – The internal request with which we arrange for this email to be sent (company, contact person, phone number, email address, website, town, note on the entry and call note): 24 months after the last message in it. – Transcripts of conversations that a sales partner pastes in for evaluation: 6 months. – In the CRM: calls for 6 months. Contact details from conversations are anonymised no later than 6 months after the last activity. – Research: companies we do not pursue 30 days after the research is completed, unused results after 6 months, results transferred to our call lists 12 months after the transfer (the entry in the call list then follows the period above). The research keeps names of persons for no more than 12 months, and for companies we do not pursue no more than 7 days. – Checks of Swiss phone numbers (checksum of the number, result, person checking, time): 36 months. – Block list after an objection: indefinitely (see below). Deleted data remains in our encrypted backups for up to about 30 days. Information and objection. At the beginning of the call we tell you where your contact data comes from and inform you of your right to object. You can object to the processing of your data for direct marketing at any time (Art. 21(2) GDPR), during the call or by email to mbt@nex-a-i.com. We will then no longer call you and will permanently block the company's phone number, email address and website domain from further contact in our partner portal and our research (Art. 21(3) GDPR), regardless of whether the data comes from our research, a list or a referral. If the call is transferred to our CRM, we note the objection there on the call record. The block also applies if the same data turns up again later in a list, a referral or our research. For this block we do not store the values in plain text, only as a checksum that is used solely for the block. The legal basis for the block list and the objection note is Art. 6(1)(c) in conjunction with Art. 21(3) GDPR. We delete research data about your company. All other rights under section 5 remain unchanged.