DE Emergency Schedule a call

Privacy Policy.

Data protection under GDPR. We process as little as possible. EU data residency by default. No tracking, no newsletter without consent. Sub-processor list public. Detail requests under NDA.

1. Controller

dynexo GmbH, Willy-Brandt-Platz 19, 38102 Braunschweig, Germany. Email: hallo@dynexo.de.

2. Data protection officer

We have appointed an external data protection officer. Contact: hallo@dynexo.de, subject line "DSB".

3. Collection and processing of data when visiting the website

When you access our website, we automatically collect the following information (server logs):

  • IP address of the requesting device (truncated after 14 days)
  • Date and time of the request
  • Requested URL
  • Volume of data transferred
  • HTTP status of the response
  • Referrer (where transmitted by the browser)
  • User-agent string

Legal basis: Art. 6(1)(f) GDPR (legitimate interest: secure and stable provision of the website). Retention period: maximum 14 days; IP addresses are then truncated or deleted.

4. Cookies and comparable technologies

We do not use tracking cookies. No third-party scripts are active on the website (no Google Analytics, no Meta Pixel, no LinkedIn Insight Tag). An optional localStorage entry is used for the language setting; it is not transmitted to third parties. If you reach the contact form through a link, we store in sessionStorage, for the duration of the session, which page and which link you came from, and send this with your request. This is not transmitted to third parties either.

Should we use a service in the future that processes data about your visit, we will ask you first. Such a service is loaded only after you have agreed; until then its script sits inert in the page source and is not executed. We store your decision in a localStorage entry (dxConsent) so that we do not have to ask again on every page. That storage is necessary to honor your decision and happens even when you decline. You can change your choice at any time from the link in the footer.

5. Forms and lead capture

If you use the contact form or the quick request, we process the data you enter solely to handle your inquiry and for any follow-up communication.

Data processed:

  • Name, company, email address (required fields in the contact form)
  • Message (optional)
  • for the quick request, only the email address
  • the page from which you opened the form, the label of the link and, where available, the referring page (referrer)
  • to detect automated submissions: the content of a field that is invisible to people, and the time between loading the page and submitting

The legal basis for your details and your message is Art. 6(1)(b) GDPR (pre-contractual measures at the request of the data subject). We process the information on where the inquiry came from (page, link, referrer) and the data used to detect automated submissions on the basis of Art. 6(1)(f) GDPR; our legitimate interest is to relate an inquiry to its context and to protect the form against spam. Retention period: maximum 24 months after last contact, then deletion or pseudonymization. Submissions identified as spam are not processed and are deleted after 90 days at the latest. We use the data exclusively to respond and prepare proposals. There is no newsletter and no automated marketing.

6. Processors and sub-processors

A complete list of our sub-processors is publicly available at /en/trust/sub-processors. Machine-readable version: /.well-known/sub-processors.json. For active clients, the full list forms part of the data processing agreement.

7. Data transfer to third countries

Default data residency: Germany / EU. Transfer to third countries takes place only where (a) the client has expressly consented and (b) we have put EU standard contractual clauses and a transfer impact assessment in place. US sub-processors are used only where the data transferred is neither personal nor sensitive.

8. Your rights as a data subject

You have the right to:

  • Access (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Object to processing (Art. 21 GDPR)
  • Withdraw a consent given (Art. 7(3) GDPR)
  • Lodge a complaint with the competent supervisory authority (Art. 77 GDPR)

The competent supervisory authority for dynexo GmbH is the Landesbeauftragte für den Datenschutz Niedersachsen.

Please direct requests concerning data subject rights to hallo@dynexo.de, subject line "GDPR request". We respond within the statutory period of one month.

9. Data security

We apply technical and organizational measures (TOMs) under Art. 32 GDPR. The most important measures:

  • TLS 1.3 for every transmission
  • AES-256 for data at rest
  • Audit mirror for every client operation
  • Clear separation of access (RBAC + network segmentation)
  • Annual penetration test

Detailed TOMs are provided as part of the data processing agreement.

10. Changes to this privacy policy

This privacy policy is updated when processing practices change. Active clients are notified in writing of material changes.

Last updated: 2026-05-27.