Privacy policy

Last updated: 8 October 2026

This is a translation for convenience. The German Datenschutzerklärung is the legally binding version.

This policy explains which personal data we process when you visit www.ar-giri.com or contact us, why, and on which legal basis.

1. Controller

AR-Experts GmbH
Röhrer Weg 8
71032 Böblingen
Germany
Phone: +49 (0) 7031 2050721
Email: contact@ar-giri.com
Represented by the managing director Dr. Björn Schwerdtfeger

For privacy questions, write to contact@ar-giri.com with the subject “Privacy”.

2. Overview

Purpose Data Legal basis Service
Deliver and protect the website IP address, time, page, browser Art. 6(1)(f) GDPR Cloudflare
Manage consent Consent status, time Art. 6(1)(c) GDPR Usercentrics
Handle demo requests Name, email, company, phone, message Art. 6(1)(b) and (f) GDPR HubSpot
Protect the form from bots Browser and connection signals Art. 6(1)(f) GDPR Cloudflare Turnstile
Visit and marketing analytics (consent only) Cookie IDs, page views, referrer Art. 6(1)(a) GDPR, § 25(1) TDDDG HubSpot
Improve the website (consent only) Clicks, scroll depth, session flow Art. 6(1)(a) GDPR, § 25(1) TDDDG Contentsquare

3. Hosting and delivery (Cloudflare)

This website is delivered through Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). For every request Cloudflare processes technically necessary data: IP address, date and time, requested address, referrer, browser and operating system. This is required to deliver the pages, fend off attacks and find errors. The legal basis is our legitimate interest in a secure, fast website (Art. 6(1)(f) GDPR). Log data is kept only as long as needed for operation and security, usually a few days.

Cloudflare is certified under the EU-US Data Privacy Framework. A data processing agreement with standard contractual clauses is in place. More: cloudflare.com/privacypolicy.

Without your consent we only use technically necessary cookies. All other services (HubSpot tracking, Contentsquare) load only after you agree in the consent banner (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change or withdraw your choice at any time through “Cookie settings” at the bottom of every page.

Consent is managed with the Usercentrics consent management platform (Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany). It stores your consent decision, date and time, banner version and an anonymised ID. We are legally required to be able to prove consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR). More: usercentrics.com/privacy-policy.

5. Demo requests and contact form (HubSpot)

When you request a demo, we process your name, business email address, company and, if provided, phone number and message, plus the page you sent the request from. We use this data to answer your request, schedule a meeting and prepare an offer. The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps) and our legitimate interest in handling business enquiries (Art. 6(1)(f) GDPR).

Requests are stored in our CRM, HubSpot (HubSpot Ireland Limited, 2nd Floor 30 North Wall Quay, Dublin 1, Ireland; parent company HubSpot, Inc., USA). Our HubSpot account runs in the EU data centre. Access from the USA cannot be ruled out; HubSpot is certified under the EU-US Data Privacy Framework and standard contractual clauses apply in addition. A data processing agreement with HubSpot is in place. More: legal.hubspot.com/privacy-policy.

If you also agree to receive news from GIRI, we store that consent (Art. 6(1)(a) GDPR). You can withdraw it at any time through the unsubscribe link in every email or by writing to us.

We delete request data when it is no longer needed and no statutory retention obligations apply. If a contract results, commercial and tax retention periods apply.

6. Abuse protection (Cloudflare Turnstile)

To protect the demo form from automated requests, we use Cloudflare Turnstile. Turnstile checks browser and connection signals to tell whether a request comes from a person, without setting advertising cookies. The legal basis is our legitimate interest in preventing spam and attacks (Art. 6(1)(f) GDPR). Provider and transfers as in section 3. We also limit the number of requests per IP address.

With your consent, HubSpot sets cookies (for example __hstc, hubspotutk, __hssc) to recognise returning visits, attribute where a visit came from (for example a campaign) and link a later request to your earlier visits. This shows us which content helps prospects. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). The cookies expire after 13 months at most. Provider as in section 5.

With your consent we use Contentsquare (Contentsquare SAS, 7 rue de Madrid, 75008 Paris, France) to understand how visitors use our pages: clicks, mouse movement, scroll depth and session flows in pseudonymised form. Input into form fields is not recorded. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). More: contentsquare.com/privacy-center.

9. Booking meetings

For meetings we link to booking pages from Calendly (Calendly LLC, USA), Google Calendar (Google Ireland Limited, Ireland) and HubSpot Meetings. Only when you book does the provider process the data you enter there on our behalf. The legal basis is Art. 6(1)(b) GDPR. Transfers to the USA are covered by the EU-US Data Privacy Framework or standard contractual clauses.

10. Fonts

The Montserrat font is served from our own server. No connection to Google servers is made.

11. Videos

Videos are embedded only after you click “Load video”. A connection to YouTube (Google Ireland Limited) in privacy-enhanced mode (youtube-nocookie.com) is then made, and Google receives at least your IP address and the page you are on. The legal basis is your consent given by the click (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

12. Communication via WhatsApp Business

You can contact us through WhatsApp Business (WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland). If you write to us there, or give us your phone number in a form for contact via WhatsApp, we process your phone number and the content of the messages to handle your request (Art. 6(1)(a) or (b) GDPR). More: whatsapp.com/legal.

13. AI tools in sales

For sales communication (for example draft replies or phone assistance) we use AI services from OpenAI, ElevenLabs and Vapi. Only the communication data needed for the conversation is processed, never to assess people. The legal basis is our legitimate interest in efficient communication (Art. 6(1)(f) GDPR). Transfers to third countries rely on standard contractual clauses or the EU-US Data Privacy Framework. You can object to this processing at any time.

This website links to our Help Center, to documents in Notion and to third-party websites. Once you follow such a link, the respective provider is responsible for the processing there.

15. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent with effect for the future (Art. 7(3)). Write to contact@ar-giri.com.

Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests, you can object at any time for reasons arising from your particular situation. You can object to processing for direct marketing at any time without giving reasons.

You also have the right to lodge a complaint with a supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

16. Security

This website is served only over encrypted connections (TLS). We use technical and organisational measures in line with the state of the art; AR-Experts GmbH is ISO 27001 certified.

17. Changes

We update this policy when the website or the services we use change. The version published here applies.