This privacy policy describes which personal data is processed when you visit this website and on what legal basis. It applies to this website only. A separate privacy policy applies to processing within the PM Cockpit platform. Data that customers enter there on their own responsibility is processed by us exclusively as a processor under a contract pursuant to Art. 28 GDPR.
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Evoltir GmbH, Kurfürstenstr. 1, 80801 Munich, Germany, represented by its Managing Director Ziga Babosek. E-mail: info@evoltir.com, phone: +49 (0)89 20 500 85035.
Registered in the commercial register of the Munich Local Court under HRB 317286.
No data protection officer has been appointed, as there is no legal obligation to do so (§ 38 BDSG, Art. 37 GDPR). For questions about data protection, please use the contact details in section 1.
(1) We process our users' personal data only to the extent necessary to provide a functional platform and our content and services. As a rule, processing takes place only with consent or on a legal basis.
(2) The legal bases are in particular Art. 6 (1) (a) GDPR (consent), (b) (performance of a contract and pre-contractual measures), (c) (legal obligation) and (f) (legitimate interest).
(3) Important note on roles: For customer content and project data processed on behalf of a business customer when using the platform, the respective business customer is in principle the controller. We process such data exclusively as a processor on the basis of a separate data processing agreement under Art. 28 GDPR. This privacy policy covers the processing for which we ourselves are the controller (in particular the operation of our website and the contract, contact, account and usage data we process under our own responsibility).
(4) Personal data is deleted or blocked as soon as the purpose of storage no longer applies and no statutory retention obligations prevent this.
(5) Where we do not collect personal data directly from you, we usually receive it from the company you work for, for example when your user access is set up. This concerns in particular your name, business contact details and assigned user role.
Each time the platform is accessed, our system automatically records data and information from the accessing device (in particular IP address, date and time of access, pages accessed, amount of data transferred, browser type and operating system). This data is technically required to display the platform, ensure stability and security and detect misuse. The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in the secure, stable and functional operation of the platform and in detecting and preventing misuse. Log files are deleted after 30 days unless security-related incidents require longer retention. Longer storage only takes place where necessary for this purpose and legally permissible.
Our website is delivered through the network of Cloudflare, Inc. (see section 8); the preceding paragraph applies accordingly to the connection data processed in this context. The website's fonts are served locally; no connection to third-party servers is established for this.
We use technically necessary cookies and comparable technologies that are required to operate the platform and for authentication (sign-in, session management). Under § 25 (2) no. 2 TDDDG, no consent is required for storing information on, or accessing information from, your device where the technology is strictly necessary. Where we process personal data as controller in this context, this is based on Art. 6 (1) (f) GDPR (our legitimate interest in providing the platform securely), unless another legal basis applies. We only use non-essential cookies with your consent. The same applies to comparable non-essential technologies; where personal data is processed, Art. 6 (1) (a) GDPR is generally the relevant legal basis.
Reach measurement on our website: To understand how our website is used, we use Cloudflare Web Analytics from Cloudflare, Inc. When you open a page, the address requested, the referring website, browser and device type, country and page load times are transmitted to Cloudflare and evaluated only in aggregated form as statistics. Cloudflare Web Analytics does not set cookies, does not store any information on your device and does not recognise you across page views or visits; no user profile is created. The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in evaluating the use of our website in aggregated form and improving it accordingly.
A user account is required to use the platform. The information required for this must be provided; otherwise no user account can be set up. During registration and use we process in particular your name, business e-mail address, login credentials, role and usage logs. Where we process this data under our own responsibility, the legal basis is Art. 6 (1) (f) GDPR (our legitimate interest in securely setting up and managing user access and in providing the contractually agreed service to our business customers). Where processing is carried out on behalf of the business customer, the business customer is the controller. Account data we process under our own responsibility is generally stored for the duration of the contractual relationship and deleted afterwards, unless statutory retention obligations or other lawful grounds for retention apply.
If you contact us by e-mail, via the forms on our website (for example a demo request or a guide download) or via the support portal, we process the data you submit to handle your request. The legal basis is Art. 6 (1) (f) GDPR (our legitimate interest in handling your request); where processing is necessary to perform a contract with you as the data subject, Art. 6 (1) (b) GDPR applies. We send transactional e-mails (invitations, notifications) via a service provider based in the European Union (see section 8). We store this data for up to three years after your request has been closed, unless a statutory retention obligation or another lawful reason for longer storage applies.
Protection of the website forms against misuse: To protect against spam and automated requests, we use Cloudflare Turnstile from Cloudflare, Inc. on our forms. Turnstile only becomes active when you fill in a form and checks technical characteristics of your browser and your IP address to determine whether a request comes from a human; a challenge is only shown if this check is inconclusive. The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in protecting our website and our mailboxes against misuse.
To initiate, perform and invoice our contracts with business customers, we also process data of their contact persons, in particular name, business contact details, position, contract-related correspondence and required billing and payment information. The legal basis is Art. 6 (1) (f) GDPR (our legitimate interest in handling the business relationship), Art. 6 (1) (b) GDPR for contracts directly with natural persons, and Art. 6 (1) (c) GDPR for statutory retention obligations. We retain documents relevant under commercial and tax law for the statutory periods under § 257 HGB and § 147 AO.
To provide the platform, we use carefully selected processors with whom a data processing agreement under Art. 28 GDPR is in place in each case. The EU regions stated are the intended primary processing locations. Possible access from third countries and transfers to third countries are addressed separately in section 10:
The platform offers AI-supported functions for analysis and decision support. Where customer content is processed in this context, this takes place on behalf of the respective business customer in accordance with the data processing agreement. These functions are provided exclusively via models operated within the European Union. Customer data is not used to train AI models.
Where personal data is transferred to recipients outside the European Union or the European Economic Area, this takes place on the basis of an adequacy decision under Art. 45 GDPR or appropriate safeguards under Art. 46 GDPR, in particular EU standard contractual clauses.
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing (Art. 21 GDPR). You can withdraw any consent you have given at any time with effect for the future. Where we process personal data on the basis of Art. 6 (1) (f) GDPR, you can object under Art. 21 (1) GDPR on grounds relating to your particular situation.
You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany. To exercise your rights, please use the contact details in section 1. Where we process personal data exclusively as a processor on behalf of our business customers, the respective business customer, as controller, is responsible for handling and fulfilling data subject rights. Data subjects should therefore address such requests directly to the respective business customer. We support our business customers in fulfilling their data protection obligations in accordance with the statutory provisions.
We take technical and organisational measures in line with the state of the art to protect your data, in particular encryption in transit (TLS), encryption at rest, role-based access control and strict tenant separation.
This privacy policy is dated October 2026. Further development of the platform or changes in legal requirements may make it necessary to amend it. The current version is always available on this website and on the platform.
This English version is provided for convenience. In case of any discrepancy, the German version prevails.
For questions about the processing of your personal data, or requests for information, blocking, or deletion, please contact us directly. Data processing inside the Evoltir PM Cockpit product itself is governed by a separate Data Processing Agreement (DPA).