Πολιτική απορρήτου

This English version is provided for convenience. The German version is legally binding.

Name and contact details of the controller (Art. 4(7) GDPR)

CrossScore Software UG

Eugen-Richter-Str. 45
99085 Erfurt
Germany

Represented by: Dipl.-Inf. Tino Hebestreit and Dipl.-Inf. Andreas Krug

Phone: +49 (0) 3691 740 65 55
Fax: +49 (0) 3691 740 65 56

Email: info@hebestreit-krug.de

This privacy policy applies to the website mentore.ai.

Security and protection of your personal data

We consider it our primary task to keep the personal data you provide confidential and to protect it from unauthorised access. We therefore apply the utmost care and state-of-the-art security standards to ensure maximum protection of your personal data.

As a private company, we are subject to the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). We have taken technical and organisational measures to ensure that the data protection rules are observed both by us and by our external service providers.

Definitions

The law requires personal data to be processed lawfully, fairly and in a transparent manner in relation to the data subject. To ensure this, we explain the legal definitions used in this privacy policy:

1. Personal data
   Any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.
2. Processing
   Any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
3. Restriction of processing
   The marking of stored personal data with the aim of limiting its processing in the future.
4. Profiling
   Any form of automated processing of personal data used to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
5. Pseudonymisation
   The processing of personal data in such a way that it can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures.
6. Filing system
   Any structured set of personal data which is accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis.
7. Controller
   The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
8. Processor
   A natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
9. Recipient
   A natural or legal person, public authority, agency or other body to which the personal data are disclosed, whether a third party or not. Public authorities which may receive personal data in the framework of a particular inquiry are not regarded as recipients.
10. Third party
    A natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.
11. Consent
    Any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

Lawfulness of processing

Processing of personal data is only lawful if there is a legal basis for it. Under Art. 6(1)(a)–(f) GDPR, the legal basis may in particular be:

• (a) the data subject has given consent to the processing for one or more specific purposes;
• (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
• (c) processing is necessary for compliance with a legal obligation to which the controller is subject;
• (d) processing is necessary in order to protect the vital interests of the data subject or of another natural person;
• (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, in particular where the data subject is a child.

Information on the collection of personal data

(1) Below we explain how personal data is collected when you use our website. Personal data includes, for example, name, address, email addresses and user behaviour.

(2) If you contact us by email, we store the data you provide (your email address and, where applicable, your name and phone number) in order to answer your questions. We delete this data once storage is no longer necessary, or restrict processing if statutory retention obligations apply.

Data collected when you visit our website

If you only use the website for information, i.e. you do not join the waiting list or otherwise send us information, we only collect the personal data your browser transmits to our server. This data is technically necessary to display the website and to ensure its stability and security (legal basis: Art. 6(1)(f) GDPR):

• IP address
• date and time of the request
• time zone difference to Greenwich Mean Time (GMT)
• content of the request (specific page)
• access status/HTTP status code
• amount of data transferred
• website from which the request comes
• browser
• operating system and its interface
• language and version of the browser software.

Hosting

This website is hosted by Mittwald CM Service GmbH & Co. KG, Königsberger Straße 4–6, 32339 Espelkamp, Germany. The data listed above is processed on its servers in Germany. A data processing agreement under Art. 28 GDPR is in place. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and reliable provision of the website. Fonts and all other files are delivered from this server; no content is loaded from third parties.

Cookies and local storage

(1) This website does not set any cookies and does not use any third-party tracking or advertising services. A cookie banner is therefore not required.

(2) If you switch the display between light and dark yourself, this choice is saved in your browser’s local storage (localStorage, entry “mentore-ton-wahl”) so that the website remembers it on your next visit. This entry does not leave your device and is not transmitted to us. It is stored at your explicit request (Section 25(2) no. 2 TDDDG). You can delete it at any time in your browser settings or set the display back to “automatic”.

Language and day/night view

To show the website in your language and to choose the light or dark display according to the time of day at your location, our server derives your country and an approximate location (rounded coordinates) from your IP address. We use a database stored on our own server (DB-IP Lite); your IP address is neither passed to third parties nor stored. Your browser calculates sunrise and sunset from the approximate location. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a user-friendly presentation of the website.

Waiting list

(1) You can join the Mentoré waiting list with your email address. We use your email address solely to inform you about the launch of Mentoré. The legal basis is your consent under Art. 6(1)(a) GDPR.

(2) Your sign-up is stored in our content management system on the server named above and also sent by email to info@mentore.ai. Together with your email address, we store the time of sign-up and a general indication of origin (e.g. search engine, campaign, landing page) as determined by our visitor statistics (see below). To protect against automated sign-ups, the server checks how much time passed between loading the page and submitting the form; no data is passed to third parties for this.

(3) You can withdraw your consent at any time with effect for the future, e.g. by email to info@mentore.ai. We delete your sign-up after you withdraw your consent, and at the latest once we have informed you about the launch, unless you have given us further consent.

Visitor statistics without cookies

(1) To understand how our website is used and to improve it, we keep visitor statistics. They run entirely on our own server; no data is passed to third-party providers and no cookies or other browser storage are used.

(2) We record the page visited, the time, the website you came from (or campaign parameters in the address), browser and operating system in broad versions, device type, language and the country derived from your IP address. A small script also reports which links and buttons are clicked, how far a page is read and whether a form was started or submitted – but not what you enter.

(3) Your IP address is not stored. To group page views into a visit, the server computes a checksum from a shortened IP address, browser, operating system, device and language using a secret key that is replaced regularly (after seven days at the latest). Recognition beyond this period is therefore not possible. Individual page views are deleted after 90 days; only aggregated figures without personal reference remain.

(4) If your browser sends a “Global Privacy Control” or “Do Not Track” signal, your visits are not counted.

(5) The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is analysing and improving our website. You may object at any time (see “Right to object”), e.g. by enabling “Global Privacy Control” in your browser.

Other features and services of our website

(1) In addition to purely informational use, we offer services that you can use if you are interested. For these you usually need to provide further personal data, which we use to provide the service and to which the principles above apply.

(2) In some cases we use external service providers to process your data. They have been carefully selected and commissioned by us, are bound by our instructions and are checked regularly.

(3) If our service providers or partners are based outside the European Economic Area (EEA), we inform you of the consequences in the description of the service. Currently no data from this website is transferred to countries outside the EEA.

Children

Our services are generally aimed at adults. Persons under the age of 18 should not send us any personal data without the consent of their parents or guardians.

Rights of the data subject

(1) Withdrawal of consent
Where processing is based on consent, you have the right to withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal. You can contact us at any time to exercise this right.

(2) Right to confirmation
You have the right to obtain confirmation from us as to whether we process personal data concerning you. You can request this at any time using the contact details above.

(3) Right of access
Where personal data is processed, you can request access to it at any time, free of charge, including: (a) the purposes of processing; (b) the categories of personal data; (c) the recipients or categories of recipients, in particular recipients in third countries or international organisations; (d) where possible, the planned storage period or the criteria used to determine it; (e) the existence of the right to rectification, erasure, restriction of processing or to object; (f) the right to lodge a complaint with a supervisory authority; (g) where the data was not collected from you, any available information on its source; (h) the existence of automated decision-making, including profiling, under Art. 22(1) and (4) GDPR and meaningful information about the logic involved and its consequences. Where data is transferred to a third country or an international organisation, you have the right to be informed of the appropriate safeguards under Art. 46 GDPR. We provide a copy of the personal data undergoing processing; for further copies we may charge a reasonable fee based on administrative costs.

(4) Right to rectification
You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you and to have incomplete data completed, including by means of a supplementary statement.

(5) Right to erasure (“right to be forgotten”)
You have the right to obtain the erasure of personal data concerning you without undue delay where (a) the data is no longer necessary for the purposes for which it was collected; (b) you withdraw your consent and there is no other legal basis; (c) you object under Art. 21(1) GDPR and there are no overriding legitimate grounds, or you object under Art. 21(2) GDPR; (d) the data has been processed unlawfully; (e) erasure is required to comply with a legal obligation; or (f) the data was collected in relation to information society services under Art. 8(1) GDPR. This right does not apply where processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation or a task in the public interest, for reasons of public health, for archiving, research or statistical purposes under Art. 89(1) GDPR, or for the establishment, exercise or defence of legal claims.

(6) Right to restriction of processing
You have the right to obtain restriction of processing where (a) you contest the accuracy of the data, for a period enabling us to verify it; (b) the processing is unlawful and you request restriction instead of erasure; (c) we no longer need the data but you need it for legal claims; or (d) you have objected under Art. 21(1) GDPR, pending verification of whether our legitimate grounds override yours.

(7) Right to data portability
You have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format and to transmit it to another controller where processing is based on consent or a contract and is carried out by automated means. Where technically feasible, you can have the data transmitted directly from one controller to another.

(8) Right to object
You have the right to object at any time, on grounds relating to your particular situation, to processing of personal data concerning you based on Art. 6(1)(e) or (f) GDPR, including profiling based on those provisions. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Where personal data is processed for direct marketing, you have the right to object at any time; the data will then no longer be processed for this purpose. You may exercise your right to object by automated means using technical specifications.

(9) Automated individual decision-making, including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless the decision is necessary for a contract, is authorised by law with suitable safeguards, or is based on your explicit consent. In these cases you have at least the right to obtain human intervention, to express your point of view and to contest the decision.

(10) Right to lodge a complaint with a supervisory authority
Without prejudice to any other remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of your personal data infringes the GDPR.

(11) Right to an effective judicial remedy
Without prejudice to any administrative or non-judicial remedy, including the right to lodge a complaint under Art. 77 GDPR, you have the right to an effective judicial remedy if you consider that your rights under the GDPR have been infringed as a result of processing not in compliance with it.

Last updated: November 2026