Legal
Privacy notice
This English version is a translation of the German privacy notice (Datenschutzerklärung). The German version is authoritative.
1. Controller
CurveDesign GmbH
Mettendorfer Weg 24
91171 Greding
Germany
Phone: +49 8463 6036106
Email: kontakt@pridix.ai
Pridix is a brand of CurveDesign GmbH. Further details can be found in the legal notice.
Data protection enquiries: For questions about data protection and to exercise your rights, you can reach us at privacy@pridix.ai. CurveDesign GmbH remains the controller.
2. Overview
- This website sets no cookies, stores nothing in your browser's storage (no local storage, no session storage) and embeds no third-party advertising or analytics services.
- Fonts, images and program code are delivered exclusively from our own server. No content is loaded from third parties.
- We only process personal data if you provide it to us via one of the two forms. Your details are stored in encrypted form on our systems and transferred to our CRM system (section 10).
- Success is measured on the server as a simple daily count, without profiles, without identifiers and without storing IP addresses (section 4). For the web server access logs, see section 3.
3. Provision of the website and server logs
When you visit the website, your browser transmits technically necessary data to our server, in particular IP address, date and time, requested address, browser identifier (user agent) and, where applicable, the previously visited page (referrer). This data is required to deliver the website and to ensure secure operation.
Logs: The website application itself does not write IP addresses to its logs. The web server of our hosting provider (IONOS, Plesk) logs every request including the full IP address. These access logs are stored for 90 days and then deleted.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in providing the website securely and reliably and in detecting and fending off attacks.
Hosting: The website is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. The servers are located in a data centre in Baden-Baden (Germany). We have concluded a data processing agreement with IONOS pursuant to Art. 28 GDPR.
4. Audience measurement without cookies
To understand the success of the website and our campaigns, our server counts when delivering a page:
- the number of page views per page, language version and day,
- the source per day: campaign parameters from the requested address (e.g.
utm_source,utm_campaign) or the domain of the referring page, or “direct”, - the number of successful early access registrations, preview requests and confirmations of consent.
Only daily counter values are stored (for example “12 October · page view · home page · 418”). No IP addresses, identifiers, cookies or user profiles are stored; individual visits cannot be attributed to a person or linked to one another. Automated requests (e.g. search engine crawlers) are not counted.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in data-minimising success measurement). Your device is neither accessed nor is any information stored on it for this purpose; in our assessment, consent under Section 25 TDDDG (German Telecommunications Digital Services Data Protection Act) is therefore not required.
Retention: Daily counter values are deleted automatically after 760 days.
Source of sign-ups: When you submit a form, we store the source of your visit (campaign parameters, referring domain, landing page) together with your request in order to see which campaigns lead to requests. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in evaluating our campaigns).
5. Early access registration
Data: business email address (mandatory); optionally first and last name, company and role; time of registration and of any repeated submissions; source of the visit (section 4); version of this privacy notice; the language version of the website you used to register (German or English), so that we can write to you in that language.
Purpose: management of your non-binding, free registration and information about the market launch of Pridix. After submitting, you will receive a confirmation by email.
Legal basis: Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract). The information about the market launch is part of the registration you requested; we do not treat it as advertising within the meaning of Section 7 UWG (German Act against Unfair Competition), as you register out of a specific interest in Pridix.
Retention: Until the purpose has been achieved; automatic deletion no later than 365 days after the last activity. You can request deletion at any time.
6. News by email (double opt-in)
We only send news about Pridix if you have separately ticked the box in the early access form and confirmed this via the link in a separate email (double opt-in). A mere registration or a preview request does not constitute consent to advertising.
Proof: We store the time of the request and of the confirmation, as well as the version and a checksum of the consent wording you agreed to. The confirmation link is valid for 72 hours; the link only transmits a random code, which we store solely as a hash value. We do not store your IP address for this purpose.
Legal basis: your consent, Art. 6(1)(a) GDPR and Section 7(2) no. 2 UWG. For proof of consent: Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR.
Withdrawal: You can withdraw your consent at any time with effect for the future – via the link in every news email or by sending a message to privacy@pridix.ai. Your registration remains unaffected.
Retention: Unconfirmed consent requests expire after 72 hours; the associated details are removed 30 days later. We store confirmed consents for as long as you receive news, and the proof beyond that only for as long as necessary to defend against claims.
Sending: Email opens and link clicks are not measured. Should we use a separate service for sending news in future, we will update this notice beforehand.
7. Request for a personal preview
Data: first and last name, business email address, company (mandatory); optionally role and message; time and source of the request (section 4); the language version of the website (German or English), so that we can reply in that language.
Purpose: handling your request and arranging an appointment. You will receive an acknowledgement by email; internally, the responsible team is notified of the request – by default without your contact details. A preview request does not constitute consent to advertising.
Legal basis: Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract); for retaining business letters, Art. 6(1)(c) GDPR in conjunction with Section 257 HGB (German Commercial Code).
Retention: Automatic deletion no later than 365 days after the last processing, unless a contractual relationship arises or statutory retention obligations apply (e.g. for business letters).
8. Protection against misuse
To protect against automated submissions, we use an invisible control field, a time-limited form token and a limit on requests per sender. For this purpose, your IP address is briefly held in the server's memory as a hash value with a random key that is not stored, and discarded after 24 hours at the latest; the application does not store it permanently (for the web server's access logs, see section 3). No third-party captcha services are used.
Legal basis: Art. 6(1)(f) GDPR (protecting the website and those making requests against misuse).
9. Cookies and similar technologies
This website sets no cookies and does not read any information from your device that is not technically required to request the page. A consent banner is therefore not currently required. Should services requiring consent be used in future, we will obtain consent beforehand and update this notice.
10. Recipients, CRM system and transfers to third countries
Your details are processed exclusively by those employees of CurveDesign GmbH involved in the sale and support of Pridix and by our processors: IONOS SE for hosting (section 3), HubSpot for managing requests (see below) and Microsoft 365 for our mailboxes, the internal notifications about requests and sending the automatic confirmation emails (see below). Your details are not passed on for advertising purposes.
HubSpot CRM: We automatically transfer details from both forms to our CRM system HubSpot (provider: HubSpot Ireland Ltd., Dublin, Ireland) in order to handle your request and manage our contact with you. The following are transferred: email address, name, company, role and message, the type of request, the language version, the source of the visit (section 4) and – if given – the times and status of your consent to news. HubSpot processes these details as a processor and stores them in its EU data region. If your details are deleted on our side – at your request or once the retention period has expired – we also delete the details originating from this website in HubSpot. A contact created exclusively via this website is deleted in full. If HubSpot holds further details about you that arose independently (for example from an existing business relationship), we review their deletion separately under the rules applicable to them.
Legal basis: Art. 6(1)(b) GDPR insofar as the transfer serves the handling of your request, and Art. 6(1)(f) GDPR (legitimate interest in managing requests and customer relationships in a central system).
Contact by email: If you write to us (for example at kontakt@pridix.ai, sales@pridix.ai or privacy@pridix.ai), we process your details in order to deal with your enquiry. Our mailboxes, the internal notifications about requests via this website and the sending of this website's automatic emails run via Microsoft 365 (provider: Microsoft Ireland Operations Ltd., Dublin, Ireland), which acts as a processor; a data processing agreement is in place. Legal basis: Art. 6(1)(b) GDPR insofar as your enquiry concerns a contract or a request, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries).
Transfers to third countries: Even though HubSpot stores the details in its EU data region, a transfer to the parent company HubSpot, Inc. in the USA cannot be ruled out. The basis is an adequacy decision of the European Commission (Art. 45 GDPR, EU-US Data Privacy Framework), under which HubSpot, Inc. is certified; in addition, EU standard contractual clauses form part of the data processing agreement with HubSpot. For Microsoft 365, see above. Otherwise, no transfer to countries outside the EU or EEA is intended.
11. Retention periods at a glance
| Data | Retention |
|---|---|
| Early access registration | until the purpose has been achieved, no later than 365 days after the last activity |
| Preview request | no later than 365 days after the last processing, subject to statutory obligations |
| Unconfirmed consent | link valid for 72 hours, removal 30 days after expiry |
| Confirmed consent and proof | until withdrawal; proof thereafter for as long as necessary to defend against claims |
| Daily audience counts | 760 days, not personal |
| IP hash values for misuse protection | in memory only, 24 hours at most |
| Backups (encrypted) | 14 days rolling; deleted data disappears at the latest when the backup expires |
| Web server access logs (IONOS) | 90 days, with full IP address |
| Contact in the HubSpot CRM | same as the underlying request; deletion on our side deletes the details originating from this website in HubSpot (section 10) |
12. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on legitimate interests (Art. 21 GDPR). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR). Please contact privacy@pridix.ai (section 1).
Right to object (Art. 21 GDPR): Insofar as we process your data on the basis of legitimate interests (sections 3, 4, 8 and 10), you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.
13. Other information
Obligation to provide data: Providing your data is voluntary. However, without an email address (and, for a preview request, without your name and company) we cannot process your request.
Automated decision-making: No automated decision-making, including profiling, takes place.
Security: Data is transmitted in encrypted form (HTTPS). Details stored on our systems are encrypted; confirmation links are stored only as hash values.
Last updated: 14 October 2026 · version privacy-2026-10-14-final-en