AIVACUATE · TELENORMA AG
Privacy notice
Last updated: 17.09.2026
1. Controller and contact
TELENORMA AG
Johannes-Brahms-Straße 4
72461 Albstadt, Germany
Represented by its Management Board; Chairman: Gerd H. Schick.
For privacy questions and to exercise your rights, contact us at datenschutz@telenorma.de or by telephone on 07432-609-390-0.
Privacy contact: Management Board of TELENORMA AG.
2. Website access and hosting
Technical connection data, including IP address, requested URL, time and browser information, must be processed to serve this website and protect it against abuse. The legitimate interest is secure and reliable operation (Article 6(1)(f) GDPR).
The public website aivacuate.com is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, on servers in Germany. Hetzner provides the hosting infrastructure and processes technical data to deliver and secure the website. The planned retention periods for server logs are described in section 7.
3. Project check
The project check creates a summary of your answers in your browser. To preserve your selection when changing pages or languages, the answers are stored temporarily in your browser’s session storage. They remain there only for the current browser session and are reset after a successful form submission. They are sent to our server only when the contact form is submitted. No AI analysis takes place.
4. Contact form and email
When you use our contact form, we process your name, company, email address, project description and any additional information you choose to include to handle your enquiry. These required fields allow us to identify the business enquiry and reply. The form cannot be submitted without them. You can alternatively contact us directly by email or telephone. Please do not initially send confidential project documents or credentials.
While you type, the browser temporarily stores the form draft in session storage so that entries are not lost when changing languages. The draft is limited to the current browser window or session and is deleted after successful submission. The security check is always reloaded when the language changes.
Article 6(1)(b) GDPR applies to your own pre-contractual enquiries; Article 6(1)(f) applies to other enquiries and communication with business representatives. Our interest is the appropriate handling of business enquiries.
Following successful security verification, the information is sent to the designated internal mailbox. Recipients are the people handling the enquiry and the hosting provider where necessary for technical operation. The application does not store a message copy in its security database or send automatic acknowledgement emails. Transport encryption is provided for; end-to-end email encryption is not guaranteed.
We operate our own mail server in Germany to send form submissions and handle email. No external email delivery service is used for this purpose.
5. Spam protection and security data
The form uses an ALTCHA CAPTCHA check served by our website. After your confirmation, your browser computes a short cryptographic challenge. Our server verifies the solution, its validity and its association with the form session. No CAPTCHA scripts are loaded from third-party servers and no verification data is sent to an external CAPTCHA provider.
The check loads when the form is configured. The solution contains technical challenge data and a random session reference, not form text. Preventing automated submissions and email abuse is our legitimate interest (Article 6(1)(f) GDPR). The hosting infrastructure is separate from this locally operated check.
Additional protections include a hidden spam field, timing checks, rate limits and single-use tokens. The security database contains only keyed hashes of IP/email identifiers, counters, expiry times and random token identifiers. These identifiers are pseudonymous, not anonymous. Rate windows last 15 to 60 minutes; used tokens are blocked for one hour. Expired records are gradually deleted on further form requests and must be removed administratively when operation stops.
6. Cookies and external content
When the form is configured, the website sets a necessary security cookie containing a random identifier for up to one hour. It binds the security check to your browser and protects submission. Access for this necessary security function is based on section 25(2)(2) TDDDG. The locally served CAPTCHA component does not set an additional cookie. § 25 TDDDG.
On aivacuate.com, we do not use visitor statistics, analytics or marketing trackers, external fonts, embedded videos or social media plugins. Cloudflare and external CAPTCHA services are not used for the public website.
7. Retention and international transfers
Our deletion policy provides for the following standard periods:
- Enquiries that do not lead to a contract: deletion no later than six months after final resolution. Data is deleted earlier if its purpose has already ceased and no further reason for retention exists.
- Routine server and access logs: deletion no later than seven days after creation.
- Backups: rolling retention for no more than 30 days from creation of each backup. Data deleted from the live system may remain until that backup cycle expires. Backups are used only for recovery; previous deletions must be reapplied after recovery.
Longer retention applies only where data is needed to perform a contract, meet statutory retention duties or establish, exercise or defend specific legal claims. In a specific security incident, the necessary logs may be retained separately until the investigation and any necessary legal proceedings are completed. Access is restricted to that purpose; the data is then deleted. Technical spam-protection identifiers are subject to the short usage and cleanup rules described in section 5.
Hosting and our own mail server for aivacuate.com are located in Germany. For the website operation and form delivery described here, we use no additional external services and initiate no transfer of personal data to service providers outside the European Union or the European Economic Area. If you contact us through your own email provider or receive a reply, that provider also processes data under its own terms.
8. Your rights
Subject to the applicable legal conditions, you have rights of access, rectification, erasure, restriction and data portability. You may withdraw any consent at any time for the future. This website makes no automated decisions producing legal or similarly significant effects. Information on data subject rights.
Objection: Where processing is based on legitimate interests, you may object on grounds relating to your particular situation (Article 21 GDPR). You may object to direct marketing at any time.
You may lodge a complaint with a supervisory authority (Article 77 GDPR), particularly where you live, work or where the alleged infringement occurred. In Baden-Württemberg: Landesbeauftragter für den Datenschutz und die Informationsfreiheit, Heilbronner Straße 35, 70191 Stuttgart. Contact the supervisory authority.