Privacy Policy
Last updated: November 2026
Protecting your personal data is important to us. AI Service Partners GmbH ("ASP", "we", "us") processes personal data exclusively in accordance with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications-Digital-Services Data Protection Act (TDDDG). Below we inform you about which personal data we collect, process and use in connection with the use of our website, the initiation and performance of consulting and IT projects, and the application process.
1. Controller and Contact
Controller within the meaning of Art. 4 (7) GDPR: AI Service Partners GmbH Französische Straße 47 10117 Berlin, Germany Email: info@asp-group.com Commercial Register: Local Court Charlottenburg, HRB 289656 B Authorised Managing Directors: Luca Ernst Ludwig Harrichhausen, Filippo Valerio Scopel
2. Data Protection Officer
We have not currently appointed a data protection officer, as the statutory requirements for a mandatory appointment (Art. 37 GDPR, § 38 BDSG) are not met at present. For all questions regarding data protection and the exercise of your rights, please contact: privacy@asp-group.com. Should a data protection officer be appointed, we will publish their contact details here.
3. Data Subjects and Categories of Personal Data
Depending on the type of use and contractual relationship, we process personal data in the following categories: • Website visitors: technical connection data, IP address, device and browser information, date and time of access, referrer. • Prospects and enquirers: name, company, role, email, phone number, message content. • Customers and contact persons: contract, communication, billing and project data. • Applicants: application documents, CV, qualifications, correspondence. • Service providers and partners: contact and contract data.
4. Access Data and Server log Files
Each time you visit our website, our hosting provider automatically collects information that your browser transmits and stores it in so-called server log files: IP address (in shortened form), date and time of the request, time zone difference to Greenwich Mean Time, content of the request, HTTP status code, volume of data transmitted, referrer URL, browser type and version, operating system. Legal basis: Art. 6 (1) lit. f GDPR. Legitimate interest: provision, stability and security of our website and abuse detection. Retention period: 30 days; longer only in the event of a specific security incident.
5. Hosting and Content Delivery
Our website is operated on infrastructure of Cloudflare, Inc. and Lovable/Supabase. These providers process connection data and content required to provide the website on our behalf. Data processing agreements pursuant to Art. 28 GDPR are in place and – where transfers to third countries occur – Standard Contractual Clauses of the European Commission (Art. 46 (2) lit. c GDPR) including supplementary technical and organisational measures (Transfer Impact Assessment) have been implemented.
6. Cookies and Similar Technologies
We do not use any analytics, tracking or marketing cookies on our website. We only store your language selection in your browser's local storage so that the website is displayed in your chosen language. This is strictly necessary to provide the service you explicitly requested (§ 25 (2) no. 2 TDDDG); no consent is required. You can delete this information at any time via your browser settings. Should we use non-essential technologies (e.g. web analytics) in the future, we will obtain your consent beforehand (§ 25 (1) TDDDG, Art. 6 (1) lit. a GDPR) and update this privacy policy.
7. Google Fonts
To display fonts consistently, this website uses Google Fonts provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you open a page, your browser loads the required fonts from Google servers. In doing so, your IP address is transmitted to Google; a transfer to the USA cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR). Legal basis: Art. 6 (1) lit. f GDPR. Our legitimate interest lies in a consistent and appealing presentation of our website. Further information: https://policies.google.com/privacy
8. Contacting us (Contact Form, Email, Phone)
When you contact us via our contact form, by email or by telephone, we process the information you provide (name, email address, company, phone number if given, and your message) in order to handle and respond to your enquiry. Mandatory fields in the contact form are marked as such; without this information we cannot process your enquiry. Contact form submissions are forwarded by our server by email to our mailbox. For email and office communication we use Microsoft 365 provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, as a processor (Art. 28 GDPR). Microsoft processes data predominantly within the EU (EU Data Boundary); a transfer to Microsoft Corporation in the USA cannot be fully ruled out. Microsoft is certified under the EU-US Data Privacy Framework. Legal basis: Art. 6 (1) lit. b GDPR where your enquiry relates to the conclusion of a contract, otherwise Art. 6 (1) lit. f GDPR (legitimate interest in responding to enquiries). Retention: we delete your enquiry once it has been fully dealt with, unless statutory retention obligations apply (e.g. for business correspondence under § 257 HGB, § 147 AO: 6 or 8 to 10 years).
9. Links to Social Networks
Our website links to profiles on LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Plaza, Dublin 2, Ireland). These are simple links, not embedded plugins: no data is transferred to LinkedIn when you visit our website. Only when you click a link are you taken to LinkedIn, where LinkedIn's privacy policy applies: https://www.linkedin.com/legal/privacy-policy
10. Data Processing Within Consulting and Implementation Projects
As part of our consulting, development and implementation services, we process personal data of our customers and – within the scope of data processing on behalf of the controller (Art. 28 GDPR) – personal data made available to us by our customers (e.g. for AI prototypes, data analyses, model training or the operation of automation solutions). Before starting any project that involves the processing of personal data or special categories of data, we conclude a data processing agreement with our customers and document the roles, purposes of processing, technical and organisational measures (TOMs) and, where applicable, a data protection impact assessment (Art. 35 GDPR). We use only carefully selected sub-processors and ensure that they provide an equivalent level of data protection.
11. Use of Third-Party AI Systems and Models
In customer projects, we use – following documented approval by the customer – AI models and platforms from established providers (including Anthropic, OpenAI, Google Cloud, Microsoft Azure, Databricks). Where personal data is processed, this is done on the basis of an appropriate legal ground, under data processing agreements, and – for transfers outside the EEA – on the basis of Standard Contractual Clauses including supplementary safeguards. Our customers' training data is not used to further develop the providers' models without explicit consent. In selecting, configuring and monitoring these systems we align with the requirements of the EU AI Act and recognised standards (e.g. ISO/IEC 42001, NIST AI RMF).
12. Applications
Applications you send us by email are processed exclusively for the purpose of the application procedure (Art. 6 (1) lit. b GDPR in conjunction with § 26 BDSG or Art. 88 GDPR). If no employment relationship is established, we delete your documents no later than six months after the end of the procedure, unless you have consented to longer storage (e.g. talent pool, Art. 6 (1) lit. a GDPR). This period serves to defend against possible claims under the German General Equal Treatment Act (AGG).
13. Recipients and Categories of Recipients
Your personal data is only shared with parties who need it for the purposes described, in particular: hosting and IT service providers (Cloudflare, Lovable/Supabase), providers of email and office software (Microsoft), AI and cloud platform providers within projects, ASP Group companies where necessary to handle your request, tax advisors, auditors and legal advisors (bound by professional secrecy), and authorities within the scope of statutory obligations. Processors are contractually bound under Art. 28 GDPR.
14. Data Transfers to Third Countries
Where we transfer personal data to countries outside the European Economic Area (EEA), we only do so if an adequacy decision of the European Commission exists (Art. 45 GDPR), Standard Contractual Clauses have been concluded (Art. 46 (2) lit. c GDPR), binding corporate rules apply or explicit consent has been given. We document additional technical and organisational safeguards in the form of a Transfer Impact Assessment.
15. Storage Duration
We only store personal data for as long as necessary for the respective purposes or where we are legally required to do so. The data will then be deleted or anonymised. Statutory retention obligations under commercial and tax law (generally 6 or 10 years) remain unaffected.
16. Obligation to Provide Data
You are not legally or contractually required to provide personal data. However, without the information in the contact form we cannot process your enquiry, and we need the relevant data to conclude and perform a contract.
17. Your Rights as a Data Subject
You have the following rights vis-à-vis us at any time: • Right of access (Art. 15 GDPR) • Right to rectification (Art. 16 GDPR) • Right to erasure (Art. 17 GDPR) • Right to restriction of processing (Art. 18 GDPR) • Right to data portability (Art. 20 GDPR) • Right to object to processing based on legitimate interests (Art. 21 GDPR) • Right to withdraw consent with effect for the future (Art. 7 (3) GDPR) • Right to lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular with the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin. An informal message to privacy@asp-group.com is sufficient to exercise your rights.
18. Right to Object under Art. 21 GDPR
WHERE WE PROCESS YOUR DATA ON THE BASIS OF ART. 6 (1) LIT. F GDPR (LEGITIMATE INTERESTS), YOU HAVE THE RIGHT TO OBJECT TO THE PROCESSING AT ANY TIME ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION. WE WILL THEN NO LONGER PROCESS YOUR DATA UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS WHICH OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS. WHERE YOUR DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU MAY OBJECT TO SUCH PROCESSING AT ANY TIME WITHOUT GIVING REASONS. You can object informally, e.g. by email to privacy@asp-group.com.
19. Automated Decision-Making
No automated decision-making including profiling within the meaning of Art. 22 GDPR takes place on our website. If in individual projects we operate AI-based decision-support systems on behalf of customers, we will provide separate information about this.
20. SSL/TLS Encryption
For security reasons, this website uses SSL/TLS encryption. You can recognise an encrypted connection by "https://" in your browser's address bar. Data you send to us, for example via the contact form, cannot be read by third parties.
21. Technical and Organisational Measures
In accordance with Art. 32 GDPR, we take appropriate technical and organisational measures to protect your personal data against loss, destruction, manipulation, unauthorised access and unauthorised disclosure. These include, among others, encrypted transmission (TLS), encrypted storage, role-based access controls, multi-factor authentication, regular security reviews and staff training on data protection and information security.
22. Changes to This Privacy Policy
We update this privacy policy whenever changes to the processing operations we carry out make this necessary. The current version is always available on this page.