Privacy & Data Protection

1. Controller

2. Website delivery and server logs

When this website is accessed, technical data may be processed to deliver the requested content and protect the service. This can include IP address, date and time, requested URL, referrer, browser and operating-system information, response status and transferred data volume.

The purposes are secure and reliable delivery, error analysis and protection against misuse. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interests are the security, integrity and availability of the website. Technical hosting, content-delivery and IT-security providers process data on our behalf where required.

3. Local media and fonts

Images, videos and fonts used on this website are delivered from the website infrastructure. The site does not currently embed third-party video players, maps, social-media plug-ins or externally hosted web fonts.

4. Cookies, analytics and tracking

GappAI does not currently use non-essential cookies, advertising pixels or audience analytics on this website. No consent banner is displayed because no optional tracking technology is intentionally activated. Technically necessary storage may be used only where required to provide a service expressly requested by the visitor.

If optional analytics, embedded platforms or marketing technologies are introduced, this notice and the consent mechanism will be updated before activation.

5. Readiness assessments, pilot proposals and business enquiries

When you complete the Physical AI Readiness Check, we process your organisation, business email, sector, description of the operation, six self-assessment answers, calculated score and readiness band, optional Radar consent choice and the technical submission record. We use this information to provide and email the requested result, protect the service, qualify an appropriate next step and, where requested, contact you about the assessed operation. The result is an initial indication and is not used for solely automated decisions that produce legal or similarly significant effects.

When you submit the pilot proposal form, we process the business email address, organisation, organisation website, sector, country, proposed physical operation, operating environment, robot-access situation, expected outcome, optional timing and the technical submission record. When you use the corporate contact form, we process contact name, organisation, optional organisation website, business email, enquiry topic, message and the technical submission record. We use these details to assess and route the request, prevent misuse, send a transactional receipt confirmation, notify the responsible GappAI contact, respond to you and, where appropriate, prepare pre-contractual scoping.

Processing is based on Art. 6(1)(b) GDPR where the request concerns pre-contractual steps taken at your request, and otherwise on Art. 6(1)(f) GDPR. Our legitimate interests are the secure handling, evaluation and documentation of professional business enquiries. Form submissions are stored in the website's protected application database; they are not used for unrelated marketing without a separate legal basis.

If you contact us by email or telephone instead, we process the information you provide and any related correspondence or business notes for the same purposes and legal bases.

5a. GappAI Live and Discovery requests

For an event request, we process your adult contact name, email, event type, city, preferred dates or period, approximate duration, intended robot role and any optional company or phone information. Discovery requests additionally use the relevant organisation or school, school level, approximate group size and venue information, or university, course, languages, availability, motivation and confirmation of adult age for volunteers. We also record the programme, language, source page, request reference, acknowledgement time and delivery status.

We use these details to assess suitability, coordinate a requested event, funding discussion or voluntary contribution, respond and prevent duplicate or abusive submissions. The legal bases described for enquiries above apply as appropriate to the request. These forms do not subscribe you to marketing. Records are held in the website's application database and necessary transactional messages use the email provider described below. Requests that do not develop into a continuing relationship are reviewed for deletion within twelve months of the last relevant communication.

Do not submit children's names, images, recordings or pupil lists. Event sensor operation, recording, cloud processing and any separate photo or video permission are addressed in event-specific planning. Children's images or speech are not used for model training by default, and photo or video permission is not a participation condition. The website's programme forms do not activate advertising or audience analytics.

6. Careers correspondence

When you submit the careers form, we process your name, email address, optional telephone number, current country and city of residence, area and role of interest, experience and education level, current Germany/EU work-authorisation status, motivation, optional professional-profile links, optional work-location preference, CV and the technical submission record. We do not request nationality, photographs or identity documents at this stage.

We use this information only to receive, assess, route and document your application, communicate with you and make recruitment or employment decisions. Processing is based on § 26 BDSG and, where applicable, Art. 6(1)(b) GDPR. The CV is stored in protected object storage; its metadata and the remaining application record are stored in the protected application database.

Unsuccessful application data is generally deleted no later than six months after completion of the relevant process, unless longer storage is required to establish, exercise or defend legal claims. Inclusion in any future talent pool would require a separate, voluntary consent and a defined additional retention period.

7. GappAI Physical AI Radar

If you voluntarily request the Radar, we process your email address, selected language, signup source, consent-text version, request and confirmation time, subscription status and the technical delivery record. Registration uses double opt-in: the address is added to the active distribution list only after the confirmation link is clicked. After confirmation, the latest released edition may be sent immediately so that a new subscriber does not need to wait for the next monthly edition. The legal basis is your consent under Art. 6(1)(a) GDPR. Radar consent is separate from any assessment, pilot or contact request and is not required to use those services.

Each edition includes a direct unsubscribe option. You may also withdraw consent at any time by contacting contact@gappai.de. Withdrawal does not affect prior lawful processing. Pending, unconfirmed requests are deleted or anonymised after they are no longer required for confirmation and misuse prevention; confirmed subscription records are retained until withdrawal and for a limited period afterwards where necessary to evidence and honour the withdrawal.

8. Recipients and international transfers

Access is limited to authorised GappAI personnel and service providers that require the data for hosting, security, email, professional advice or business operations. For transactional readiness, pilot, contact and career-application emails, and for Radar confirmation and distribution, the recipient address, submission reference or subscription status and necessary message content are transmitted to Plus Five Five, Inc. (Resend), which acts as an email-delivery processor. The CV itself is not attached to those messages; authorised reviewers receive a protected download link. Open and click tracking are not intentionally enabled for transactional messages. For Radar distribution, technical delivery, bounce, complaint and unsubscribe status may be processed to operate and protect the list. We do not sell personal data.

Resend's primary processing operations are in the United States. The transfer is governed by its data-processing addendum, including the EU Standard Contractual Clauses, and any other applicable transfer mechanism under Chapter V GDPR. Other infrastructure or support-provider transfers outside the EU/EEA are likewise protected through an applicable adequacy decision, the EU Standard Contractual Clauses or another permitted mechanism.

9. Retention

Personal data is retained only for as long as necessary for the stated purpose. Readiness assessments, pilot proposals and business enquiries that do not lead to a continuing relationship are reviewed for deletion no later than 12 months after the last relevant communication. Radar records follow the separate consent-based retention rule described above. Career applications follow the separate six-month rule described above. If a contractual or employment relationship develops, applicable commercial, tax, employment and limitation-period requirements determine the longer retention period. Data is then deleted or anonymised unless further storage is legally required.

10. Your rights

Subject to the legal conditions, you may request access, rectification, erasure, restriction, data portability and withdrawal of consent, and you may object to processing based on legitimate interests. Contact contact@gappai.de. A withdrawal does not affect processing that was lawful before withdrawal.

11. Right to complain

You may lodge a complaint with a data protection authority. The authority responsible for Berlin is:

12. Security and updates

We use appropriate technical and organisational measures proportionate to the risks of website and communications processing. This notice may be updated when the website, service providers or legal requirements change.

Last updated: 10 September 2026