Privacy Policy for the chunkx Website
This privacy policy provides information on the processing of personal data when you visit our website, when you make contact requests and book appointments, when you receive our newsletter, and when you use our digital assistant Anna in the website chat and on the phone.
Separate data protection notices apply to the use of the chunkx learning platform, including the app and chunkx creator. You can find them at chunkx.io/en/privacy.
1. Controller and Contact
The controller for the processing described in this policy is:
Chunkx B.V.High Tech Campus 6, Unit A
5656 AE Eindhoven
Netherlands
Data protection inquiries: privacy@chunkx.io
General contact: info@chunkx.io
2. Visiting the Website and Its Technical Provision
When you access our website, we process in particular your IP address, the date and time of access, the pages accessed, technical request data, and information about your browser, your operating system and, where applicable, the previously visited page.
The processing serves to deliver the website, to ensure its functionality, to analyse errors, and to detect and defend against attacks and abusive access.
For hosting, storage, delivery, and security functions, we use Amazon Web Services. Our contractual party is Amazon Web Services EMEA SARL, Luxembourg. The central systems of the website chat and the associated storage are located in the AWS Region Frankfurt. For delivery via CloudFront and for security checks, locations outside the EU or the European Economic Area may also be used.
The security service AWS WAF checks technical requests to our website. In particular, IP addresses, the URLs accessed, and request headers are processed in this context. Short-term samples may be viewed to review security events.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interests lie in the secure and reliable operation of our website and in the protection of our systems and their users.
As a rule, technical website and chat logs are deleted after 30 days. Where individual data is required to investigate specific security incidents, it may be stored for longer, until the investigation and the necessary follow-up measures have been completed. The WAF samples that can be viewed for a short time cover a period of up to three hours.
3. Contact, Forms, and Appointment Bookings
If you contact us via a form, by email, by phone, or in any other way, we process your contact details, where applicable information about your company, the content of your request, and the associated communication data.
We use this data to answer your request, to provide the information you asked for, to arrange appointments, and to prepare or manage any subsequent business relationship. The persons responsible for your matter are given access.
To send messages, we use, among others, Mailjet, a service of the Sinch Group.
For appointment bookings, we use Microsoft Bookings. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. A transfer of personal data to the USA cannot be excluded; Microsoft Corporation is certified under the EU-US Data Privacy Framework. For the bases of the transfer, see also Section 11. The embedded booking interface is loaded only after your consent. Technical connections to Microsoft are established in the process. When you book an appointment, the contact and appointment details you provide and the technical data required to provide the booking function are processed. Information on the cookies and storage technologies used in this context can be found in Section 7. Alternatively, you can arrange an appointment with us by email.
The legal basis is Art. 6(1)(b) GDPR insofar as the processing concerns a contract with you or pre-contractual measures at your request. For general requests and communication with contact persons at companies, the processing is generally based on Art. 6(1)(f) GDPR. Our legitimate interest lies in handling incoming matters and maintaining business contacts.
We store contact and communication data for as long as necessary to handle your matter and any subsequent business relationship. Thereafter, we delete the data unless statutory retention obligations apply or further storage is necessary for the assertion, exercise, or defence of legal claims.
Mandatory fields in forms are marked accordingly. Without the required information, we may not be able to handle the respective matter. Using a particular means of contact is voluntary.
4. AI-Powered Website Chat “Anna”
Function and Data Processed
Our digital assistant Anna answers questions about chunkx and supports the intake and forwarding of contact, demo, and support requests.
In this context, we process your messages, the conversation history, the generated answers, any contact and company details you provide, and technical session and security data. To put your request in context, information about the pages of our website you have visited may also be taken into account.
Anna is an AI system. Answers may be incomplete or incorrect. Please check important information and contact our team if necessary.
Please submit only information that is necessary for your matter. In particular, do not enter passwords, payment data, health data, or other particularly sensitive personal data.
AI Services Used
We operate the chat interface and the backend on AWS. To generate answers, we use Claude models via Anthropic’s direct API. Our contractual party is Anthropic Ireland, Limited, Ireland.
Our servers transmit to Anthropic the conversation context required for answering. This may include your messages, previous answers, and information about pages visited. Your IP address is not transmitted to Anthropic by our chat application as part of the model request. Your entries may nevertheless contain personal data.
Anthropic processes the data to provide and secure the service. Processing and storage also take place outside the EU or the EEA, in particular in the USA. Further information can be found in Section 11.
In accordance with the applicable contractual requirements, the transmitted chat data is not used to train general AI models.
Forwarding and Internal Handling
Where your matter requires handling by our team, your contact details, a summary, and the required conversation history may be forwarded to the responsible persons in sales or support.
Authorised employees can view stored conversations via internal tools insofar as this is necessary to handle requests, to clarify errors, or to check that the assistant is functioning properly. Specially authorised persons may be given access for technical administration.
Bot Protection
After the chat has been started, we use AWS WAF functions to protect against automated and abusive requests. IP address, browser characteristics, and interaction signals such as mouse movements, keystrokes, and form interactions may be processed in this context.
The browser-side capture of interactions for this chat protection takes place within the chat window. For this purpose, security identifiers are stored in cookies and in the browser’s local storage. Further details are given in Section 7.
Legal Bases
The processing to answer general questions and to provide the chat securely is based on Art. 6(1)(f) GDPR. Our legitimate interests lie in accessible and efficient communication, in handling incoming requests, and in protection against abuse.
Where the processing is necessary for a contract with you or for pre-contractual measures at your request, it is based on Art. 6(1)(b) GDPR.
For storage access that requires consent, the information in Section 7 applies in addition.
Alternatively, you can contact us by email.
Storage
Conversation histories, associated page information, and form entries in the central chat storage are deleted 30 days after the last message. As a rule, technical logs and audit data of the AI requests are deleted after 30 days.
As a rule, Anthropic deletes API inputs and outputs within 30 days of receipt or generation. In the case of possible violations of the usage rules flagged by automated security systems, content may be stored for up to two years and associated security classifications for up to seven years. Statutory requirements may require longer retention.
Data transferred to other communication or case-handling systems to handle a matter is subject to the storage and deletion criteria in Section 3. This also applies to personal information in summaries.
5. Telephone AI Assistant “Anna”
For taking and handling requests by phone, we use an AI-powered telephone assistant from sipgate GmbH, Gladbacher Straße 74, 40219 Düsseldorf, Germany.
At the start of the call, Anna points out her function as an AI-powered digital assistant. What you say is technically processed and converted into text so that the system can understand and answer your matter. Records of the conversation and summaries are created in this process.
In particular, your phone number, the time and duration of the call, the content of the conversation, the contact and company details you mention, and the generated transcripts and summaries are processed. Authorised employees can view this information to handle your matter and forward it to the responsible team.
The processing serves to take requests, to provide information, and to organise further handling. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in reliable availability and the efficient handling of incoming requests. Where the processing is necessary for a contract with you or pre-contractual measures at your request, Art. 6(1)(b) GDPR applies.
sipgate uses specialised service providers for speech and AI processing. According to the provider, processing as commissioned takes place within the EU. Call data is not used to train AI models.
The call transcripts are stored at sipgate as call events and are automatically deleted after 30 days under the standard setting we use.
Audio tracks are stored temporarily only as part of the technically necessary speech processing and are completely deleted once the transcription has been completed. No further storage of audio recordings takes place.
According to sipgate, the technically necessary temporary storage at the AI service providers used ends, upon completion of the respective transcription or summary processing, with the deletion of the data concerned.
sipgate creates backup copies. Deletion from these backup copies takes place in accordance with the provider’s deletion concept. Deleting a call event therefore does not necessarily mean that it is removed from all backup copies at the same time.
Where information or summaries are transferred to our communication systems for further handling of your matter, the storage and deletion criteria in Section 3 apply.
You can end the call at any time and contact us by email instead.
6. Analysis of Request Topics
We analyse incoming requests and stored conversation content to identify frequent questions, information gaps, and technical or content errors of our assistants. This may also be done through regularly performed AI-powered analyses.
The personal data contained in the requests may be processed in this context. The analysis serves to improve our information, processes, and assistants. It does not serve to create individual performance or aptitude profiles of the persons making requests.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the quality and clarity of our communication and in identifying and correcting errors.
The respective storage periods of the communication function concerned apply to the source data. Person-related analysis results are stored only for as long as necessary to clarify and correct the questions or errors identified. Reliably anonymised results may be used for longer.
8. Website Analytics and Marketing
Google Analytics
After your consent, we use Google Analytics 4, a service of Google Ireland Limited, Ireland, to analyse the use of the website.
In particular, pages accessed, interactions, technical device and browser information, approximate information on origin, and pseudonymous identifiers are processed. The analysis serves to understand the use of our website and to improve content and the user experience.
The storage of the analytics data is to be distinguished from the lifetime of the cookies. The data is stored for the period required for the analysis in accordance with the configuration of the service and is then deleted or anonymised.
lemlist and Associated Visitor Recognition
After your consent, we use a website pixel from lemlist and associated visitor recognition functions. In this context, technical access and usage information may be processed, and visits may be assigned to business contacts or companies insofar as the services used make this possible.
The purpose is to recognise interest in our offering and to tailor our business outreach accordingly. Technologies that do not set a cookie may also process personal data.
The legal basis for these optional analytics and marketing processing activities is your consent pursuant to Art. 6(1)(a) GDPR. For storage access requiring consent, the information in Section 7 applies in addition.
For possible transfers to third countries, see Section 11.
9. YouTube Videos
We embed videos from YouTube, a service of Google Ireland Limited, Ireland. The videos are loaded only after you have consented via the preceding enabling step.
When a video is loaded, your IP address, information about your browser and device, the page accessed, and your interactions with the video may in particular be processed. YouTube may store or read cookies and local storage entries in this process. If you are logged into a Google account, Google may assign the use to this account. Processing in the USA cannot be excluded.
The embedding serves to display our video content. The legal bases are your consent pursuant to Art. 6(1)(a) GDPR and, where applicable, Section 25(1) TDDDG.
You can withdraw your consent at any time with effect for the future via the enabling or consent settings provided. You can additionally delete cookies and local storage entries already stored via your browser.
11. Recipients and Processing Outside the EEA
Within chunkx, persons are given access insofar as this is necessary for their tasks.
External recipients are in particular the hosting, security, communication, AI, appointment booking, analytics, and marketing service providers named in this policy and, where necessary, their subcontractors. Where service providers process personal data on our behalf, this is done on the basis of agreements pursuant to Art. 28 GDPR.
Other recipients may be public authorities, courts, and legal advisors where there is a legal obligation or where this is necessary to protect legal claims.
Individual services lead to transfers to countries outside the EU or the EEA or enable access from such countries. This applies in particular to the Anthropic API, the international delivery and security network of AWS, and possible processing in the context of Google, Microsoft, and other communication or marketing services.
Anthropic stores API data in the USA; according to the provider, processing may also take place in other countries. For these transfers, the contract terms provide for EU Standard Contractual Clauses.
For other transfers, adequacy decisions pursuant to Art. 45 GDPR or appropriate safeguards pursuant to Art. 46 GDPR, in particular EU Standard Contractual Clauses, apply depending on the recipient and the service. The EU-US Data Privacy Framework can be relied on only insofar as the specific US recipient is validly certified and the processing concerned is covered.
In the case of processing in third countries, other possibilities of access by public authorities and limited possibilities of legal protection may exist. You can request information on the safeguards used for the respective transfer and a copy of the relevant contractual safeguards via privacy@chunkx.io.
12. Applications
If you apply to us, we process your contact details, application documents, and the communication data arising during the application process in order to review your application and to prepare a possible employment relationship.
For applications to Chunkx B.V., Art. 6(1)(b) GDPR is the basis of the necessary pre-contractual processing. Any necessary further retention to defend against legal claims is based on Art. 6(1)(f) GDPR.
After the process has been completed, the data is deleted as soon as it is no longer needed for the decision, for required evidence, and for defence against possible claims. Inclusion in a talent pool beyond this takes place only with separate consent.
If a job posting concerns another entity, the responsible employer and supplementary data protection information are set out in the respective job posting or application process.
13. General Storage and Deletion Rules
We store personal data for specific purposes. Decisive factors are in particular the duration of handling a matter, the necessity of a subsequent business relationship, statutory retention obligations, and the necessary assertion, exercise, or defence of legal claims.
Deletion from one system does not necessarily mean that the data has already been removed from all other systems. In particular, messages and summaries transferred for further handling, documents subject to statutory retention, and protected backup copies may be subject to different storage periods.
Once the respective reason for storage no longer applies, the data is deleted or reliably anonymised. Any further active use for other purposes requires a corresponding legal basis.
14. Your Rights
Under the statutory conditions, you have the right to:
- access to information on the processing of your personal data pursuant to Art. 15 GDPR;
- rectification of inaccurate data or completion of incomplete data pursuant to Art. 16 GDPR;
- erasure pursuant to Art. 17 GDPR;
- restriction of processing pursuant to Art. 18 GDPR;
- data portability pursuant to Art. 20 GDPR.
You can withdraw consent given at any time with effect for the future. The lawfulness of the prior processing remains unaffected.
Objection in the case of legitimate interests
You may object at any time, on grounds arising from your particular situation, to processing based on Art. 6(1)(f) GDPR. We will then no longer process the data concerned unless we can demonstrate compelling grounds worthy of protection that override your interests, rights, and freedoms, or the processing serves the assertion, exercise, or defence of legal claims.
Objection to direct marketing
You may object at any time, without giving particular reasons, to processing for direct marketing purposes. This also applies to any related profiling. The data will then no longer be processed for these purposes.
To exercise your rights, a message to privacy@chunkx.io is sufficient. Where necessary, we may request additional information to confirm your identity.
You can also lodge a complaint with a data protection supervisory authority, in particular at the place of your habitual residence, your place of work, or the suspected infringement. In the Netherlands, this is in particular the Autoriteit Persoonsgegevens.
15. Automated Decisions and Security
The assistants described support communication and the handling of your matters. Within the website and communication functions described here, we do not make any decisions based solely on automated processing with legal or similarly significant effect concerning you.
We implement appropriate technical and organisational protective measures. These include in particular access restrictions, secure transmission, and measures to secure, monitor, and restore our systems.
16. Changes
We adapt this policy when our processing, the services used, or legal requirements change. The “Last updated” date identifies the respective version.
Language Versions
This privacy policy is provided in German and English. In the event of any discrepancies between these versions, the German version shall prevail.