Privacy

Last updated: August 31, 2026

aleXation is built around a simple principle: personal data should only be processed where there is a reason to process it, and technology should not quietly turn every interaction into behavioural data.

This website therefore does not use advertising tracking, visitor profiling or analytics instrumentation.

Where artificial intelligence is used to support administrative work, we aim to keep its role transparent, limited and reviewable. You can also exclude the content of individual emails from AI-assisted analysis entirely by using NO AI: in the subject line.

This notice explains how personal data is processed when you visit this website or contact aleXation.

1. Controller

The controller responsible for processing personal data is:

Alexander Heisig
Dorfstr. 22a
82178 Puchheim
Germany

Email: info@alexation.com

2. Website and hosting

aleXation.com and its associated web properties are delivered as static websites.

The website and core aleXation One services are operated on server infrastructure located in Germany.

When you access the website, technical information necessarily has to be exchanged between your device and the server providing it. This may include, in particular:

• IP address,
• date and time of access,
• requested URL or file,
• transferred data volume,
• browser and operating-system information,
• referring URL where transmitted,
• technical status and error information.

This processing is necessary to deliver the website securely and reliably.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure, stable and technically correct provision of the website and the detection of technical faults or abusive access.

Technical server and security logs are retained only for as long as they are required for operation, security, troubleshooting or the investigation of abuse and are subsequently deleted unless a longer retention period is required by law or for the establishment, exercise or defence of legal claims.

3. No tracking, analytics or advertising profiles

We deliberately do not use website analytics, advertising trackers or behavioural profiling on this website.

In particular, the website application does not intentionally deploy:

• Google Analytics or comparable visitor analytics,
• advertising or retargeting pixels,
• cross-site tracking,
• fingerprinting,
• behavioural advertising profiles,
• marketing cookies.

We therefore do not ask you to accept tracking that we do not perform.

If the technical configuration of the website changes in the future, this Privacy notice will be updated before additional processing requiring information or consent is introduced.

4. Fonts and website assets

Fonts and other ordinary website assets are, wherever technically implemented in this website, provided as part of the website itself rather than being loaded merely for presentation from advertising or tracking services.

This avoids unnecessary disclosure of visitor information merely for presentation purposes.

5. Contact by email

If you contact us by email, we process the information contained in your message as well as the technical information required to receive and manage it.

Email and document collaboration are provided using Google Workspace.

Depending on the reason for your contact, processing may be based on:

• Art. 6(1)(b) GDPR, where your communication concerns a contract or steps taken at your request before entering into a contract;
• Art. 6(1)(c) GDPR, where processing is required to comply with a legal obligation;
• Art. 6(1)(f) GDPR, where processing is necessary for legitimate interests such as responding to correspondence, organising administrative matters, documenting communications, maintaining IT security or establishing, exercising or defending legal claims.

We do not require consent merely because electronic or AI-assisted tools are used to support an otherwise lawful administrative process.

6. AI-assisted administration

aleXation One may use AI-assisted systems to support administrative work.

Depending on the particular process, such systems may assist with tasks such as:

• classifying incoming messages or documents,
• extracting structured information,
• identifying the context of a document or communication,
• identifying relevant dates or other facts,
• preparing summaries,
• finding related information,
• preparing proposals for further human processing.

The purpose of these systems is to assist human administration, not to replace human responsibility.

We follow a data-minimisation approach. Information should, where technically possible, first be handled by deterministic processes or within our controlled infrastructure. External AI services are used only for explicitly enabled processing steps, and information made available to such services is reduced to what is necessary for that purpose wherever technically possible.

Managed external AI processing uses paid API/business service paths rather than consumer AI chat interfaces.

External model providers do not receive unrestricted access to the aleXation One data store. Model calls are made for defined processing steps and are subject to the privacy controls of the relevant workflow.

7. NO AI: — exclude your email from AI content analysis

You can exclude the content of an individual email from AI- or machine-learning-based content analysis by aleXation One.

Simply start the subject line with:

NO AI:

The marker is case-insensitive. For example, NO AI: and no ai: have the same effect.

When this marker is present, aleXation One does not submit the content of the email or its attachments to AI- or machine-learning-based systems for content analysis.

This applies both to externally provided AI models and to AI models that may operate within our own infrastructure.

The message may still undergo ordinary technical and deterministic processing necessary to receive and handle it. This can include, for example:

• email transport,
• technical security and spam protection,
• processing of email headers and MIME information,
• recording sender, recipient, date, message ID and subject,
• recording filenames and technical file information,
• hashing,
• secure storage,
• deterministic routing,
• linking the communication to an already known matter where this can be done without analysing the protected content,
• providing a link to the original message or document,
• manual processing by a human.

The NO AI: instruction therefore concerns AI-assisted analysis of the content. It does not prevent the technical processing necessary to transmit, secure, store and manually handle an email.

Independent email and infrastructure providers may perform their own technically necessary security, malware or spam-protection processes before a message reaches aleXation One. Those provider-side processes are outside the NO AI: mechanism.

Using NO AI: is optional and does not affect how your request is treated.

8. Human responsibility and automated decisions

AI systems may assist in preparing, structuring or organising information.

They do not independently make decisions about individuals that produce legal effects or similarly significantly affect them.

In particular, decisions concerning contractual relationships, rental relationships, legal claims or comparable matters remain subject to human responsibility and review.

9. Service providers and processing locations

External service providers are used only where required for the relevant service. Important categories include:

• Google Workspace for email and document collaboration;
• paid AI/model API providers for explicitly enabled AI-assisted workflows;
• technical infrastructure providers required to operate the services.

Where providers process personal data on our behalf, appropriate data-processing agreements are used where required by Art. 28 GDPR.

Core aleXation One data and services are operated on infrastructure in Germany. Externally provided services may, depending on the specific service and configured data region, involve processing outside the European Economic Area.

Where such processing occurs, it is carried out only under the data-protection framework applicable to the provider, including an applicable adequacy decision under Art. 45 GDPR or appropriate safeguards under Art. 46 GDPR where required.

Google Workspace provides contractual GDPR data-processing terms and European data-region controls for covered data depending on the Workspace edition and configured policy. The exact productive Workspace edition and configured region controls must be verified before publication; the public page must not claim EU-only Workspace processing unless the actual configuration supports that claim.

Paid AI API providers may offer European processing/data-residency controls. The productive configuration must be verified before publication. The page must not claim EU-only model processing unless the actual production API project/endpoint enforces it.

Information about applicable safeguards can be requested at info@alexation.com.

10. Retention

We retain personal data only for as long as it is required for the purpose for which it was processed.

The applicable period depends on the context.

For example:

• ordinary correspondence is deleted when it is no longer required for the underlying matter;
• contract-related information may be retained for the duration of the contractual relationship and subsequent limitation periods;
• accounting and tax records are retained for the applicable statutory periods;
• information relevant to legal claims may be retained while such claims can reasonably be asserted or defended;
• technical security information is retained only for the period necessary for security and operation unless an incident requires longer preservation.

Where several retention obligations apply, deletion takes place once the final applicable purpose or legal retention requirement has expired.

11. Your rights

Subject to the applicable legal requirements, you have the right to:

• obtain information about personal data processed about you under Art. 15 GDPR;
• request correction of inaccurate data under Art. 16 GDPR;
• request deletion under Art. 17 GDPR;
• request restriction of processing under Art. 18 GDPR;
• receive applicable personal data in a portable format under Art. 20 GDPR;
• object to processing based on Art. 6(1)(e) or (f) GDPR under Art. 21 GDPR.

Where processing is based on consent, you may withdraw that consent at any time with effect for the future.

The use of NO AI: is an additional technical option provided by aleXation and does not limit any statutory data-protection rights.

12. Right to lodge a complaint

You have the right to lodge a complaint with a competent data-protection supervisory authority.

For a private controller based in Bavaria, the competent supervisory authority is generally:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Germany

13. Changes to this Privacy notice

Technology and administrative processes may change.

We therefore review this Privacy notice when relevant processing activities, service providers or technical systems change.

Material changes affecting the processing of personal data will be reflected in this notice where required.