AI Works

Privacy policy

Privacy Policy

This privacy policy explains which personal data we process when you visit the website www.ai-works.com (including the English version under /en/), for which purposes and on which legal basis we do so, and which rights you have.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

AIS Management GmbH
Luise-Ullrich-Straße 20
80636 München
Deutschland

E-mail: info@ais-management.de
VAT identification number: DE 197110134
Represented by the managing director(s):

2. Data Protection Contact

For questions about data protection or to exercise your rights, you can reach us at:

E-mail: info@ais-management.de
Postal address: as given in section 1

3. Hosting

This website runs on a server administered with the management platform Laravel Forge and hosted by the following provider:

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany

The data centres are located in Germany (Nuremberg and Falkenstein). All data required to deliver the website, in particular the server log files (section 4) and the information you submit via forms, is processed on this provider's infrastructure. We have concluded a data processing agreement with Hetzner pursuant to Art. 28 GDPR.

We set up and maintain the server with Laravel Forge, a service of Laravel Holdings Inc., USA. Forge accesses the server for this purpose; access to personal data is not intended, but cannot be ruled out technically.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in providing our online services securely and efficiently through a professional provider.

4. Server Log Files

Each time you access our website, the web server automatically stores the following information transmitted by your browser:

  • IP address of the requesting device
  • date and time of access
  • requested URL
  • referrer URL (the previously visited page, if transmitted)
  • user agent (browser type and version, operating system)

The log files serve to ensure fault-free operation and system security and to investigate attacks. They are not combined with other data sources. The log files are deleted automatically after 14 days, unless their retention is required to investigate a specific security incident.

In addition, the application keeps an error and event log so that we can detect and fix faults. In individual cases it may contain personal data, such as an e-mail address when sending an e-mail fails. The log is started afresh every day and deleted after 14 days. Background jobs that could not be carried out (e.g. an undeliverable e-mail) are kept with their content for no more than 7 days. For every e-mail sent by the website, we log the recipient address, subject and time so that delivery can be traced; this delivery log is deleted after 12 months.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the technical security and functionality of the website).

5. Consent Management

To obtain and manage your consent to the use of cookies and similar technologies, we use our own consent tool. No third-party consent management platform is used; no data is transmitted to third parties when the banner is displayed or operated.

On your first visit, you decide in the banner whether, in addition to the technically necessary functions, you wish to allow the categories "Statistics", "Marketing" and "External content". Your decision is stored in your browser's local storage and in a first-party cookie named cookie_consent (lifetime: 12 months). The cookie contains only your decisions for the individual categories, a timestamp and the version number of the consent text; it does not contain any identifier that would make you identifiable across other websites.

In addition, we store a pseudonymous consent record on the server side (selected categories and services, version of the consent text, language, time of the decision, browser identifier (user agent) and a hash of the truncated IP address formed with a key that changes daily) in order to fulfil our obligation to demonstrate consent under Art. 7(1) GDPR. This record is deleted after 12 months.

You can change or withdraw your consent at any time with effect for the future by opening the "Cookie-Einstellungen" (cookie settings) link in the footer of the website.

Legal basis: Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) for storing the cookie and the local storage entry, which is strictly necessary to implement your decision; Art. 6(1)(c) GDPR (obligation to demonstrate consent under Art. 7(1) GDPR) and Art. 6(1)(f) GDPR (legitimate interest in legally sound documentation) for the consent record.

6. Technically Necessary Cookies

Our website sets the following cookies, which are strictly necessary for its operation and are therefore set without consent. They contain no advertising or tracking identifiers.

  • ais-management-session – session cookie of the Laravel application framework. It assigns consecutive page views to the same session, for example to retain form input and status messages. Lifetime: two hours (120 minutes) after the last activity.
  • XSRF-TOKEN – protection against cross-site request forgery (CSRF); ensures that forms can only be submitted from our website. Lifetime: two hours.
  • cookie_consent – stores your decision in the consent banner (section 5). Lifetime: 12 months.

Legal basis: Section 25(2) no. 2 TDDDG; for the associated processing of personal data, Art. 6(1)(f) GDPR.

7. Contact Form

When you send us a message via the contact form, we process your name, e-mail address, telephone number (optional) and your message. The information is stored in the website's database and forwarded to us by e-mail so that we can handle your enquiry. To protect against spam, we use a honeypot field that is invisible to human users; no captcha service and no third party is involved.

The contact form is available in a dialog window. The landing pages "KI-Sprint", "Grundkurs KI für die Immobilienwirtschaft" and "KI-gestützte Dokumentenanalyse" also offer a request form. There we process your first and last name, e-mail address, company, your message and the subject of the request; you receive a confirmation of receipt by e-mail. Otherwise these requests are processed in the same way as messages sent via the contact form.

AI-assisted pre-sorting: So that we can respond to enquiries more quickly, the text of your message is automatically summarised, categorised, checked for spam and given a draft reply for our team by an AI service (OpenAI) after receipt. Only the message text (and, where applicable, the selected topic) is transmitted; your name, e-mail address, telephone number and company are not, and any e-mail addresses and telephone numbers contained in the text are masked beforehand. Job applications are excluded. The result is used solely for our internal processing; no automated decision within the meaning of Art. 22 GDPR takes place. The result is deleted together with your enquiry. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in handling enquiries promptly).

Retention period: Your enquiry is deleted automatically from the website database six months after receipt. We delete the forwarded e-mail once your request has been dealt with; if the contact leads to a business relationship, we retain the correspondence within the statutory retention periods.

Legal basis: Art. 6(1)(b) GDPR, insofar as your enquiry is aimed at concluding or performing a contract; otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries).

8. Job Applications

You can use the application form to apply for advertised positions or to submit an unsolicited application. In doing so, we process your name, e-mail address, telephone number, your message and the application documents you upload (e.g. CV, certificates). The data is used exclusively to conduct the application process and is made accessible only to the persons involved in the selection.

Retention period: Your application is deleted automatically from the website database six months after receipt, together with the uploaded files. The documents forwarded by e-mail are deleted 6 months after the application process has ended, unless you have expressly consented to longer retention (for example for a talent pool). If you are hired, the documents are transferred to your personnel file.

Legal basis: Art. 6(1)(b) GDPR in conjunction with Section 26 of the German Federal Data Protection Act (BDSG) (decision on the establishment of an employment relationship); longer retention takes place only on the basis of your consent under Art. 6(1)(a) GDPR.

9. Whitepaper Download

To request a whitepaper, you enter your name, e-mail address, company and, optionally, a message in the form. You receive the download link by e-mail; the link is signed and valid for a limited time only. With your consent in the form, our team also receives an e-mail with your details so that we can contact you about the subject of the whitepaper. We also record whether and when the download link was used. Your request is stored for 12 months and then deleted.

If you have consented to the "Marketing" category in the consent banner, a conversion event is transmitted to the services named in sections 11 and 12 as soon as you click the download button. Without this consent, no transmission takes place; the download works regardless.

Legal basis: Art. 6(1)(b) GDPR for providing the whitepaper; Art. 6(1)(a) GDPR for contacting you about the whitepaper and for transmitting the conversion event. You can withdraw your consent at any time with effect for the future, for example by e-mail to the address given above.

10. Web Analytics (Matomo, Google Analytics)

Matomo

For statistical analysis of the use of our website, we use the open-source software Matomo. Matomo is self-hosted on our group's infrastructure and operated by builtworld, not by an external analytics provider. Analytics data is not transmitted to third parties outside the group of companies.

Matomo is loaded only after you have consented to the "Statistics" category. When analytics is enabled, the following cookies are set:

  • _pk_id – pseudonymous visitor identifier for recognising returning visitors. Lifetime: 13 months.
  • _pk_ses – session identifier for grouping the page views of one visit. Lifetime: 30 minutes.

Your IP address is truncated before storage so that it cannot be traced back to your connection. We use the data collected (pages visited, time spent, approximate location, device type, browser) exclusively to improve our website.

Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG (consent), which can be withdrawn at any time via "Cookie-Einstellungen" in the footer.

Google Analytics 4

In addition to Matomo, this website may use Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Whether Google Analytics is active is shown in the "Cookie settings" under the "Statistics" category; if it is not listed there, it is not used.

Google Analytics is loaded only after you have consented to the "Statistics" category. We use Google Consent Mode: the analytics storage signal is set to "denied" by default and switched to "granted" only after your consent; advertising signals are not affected and depend solely on the "Marketing" category. If consent is given, the following cookies are set:

  • _ga – pseudonymous identifier to distinguish visitors. Lifetime: 2 years.
  • _ga_* – session state. Lifetime: 2 years.

The data processed comprises the pages visited, time spent, approximate origin (country, region), device type and browser. Google Analytics 4 does not store full IP addresses. The data may be transferred to servers of Google LLC in the USA; Google is certified under the EU-US Data Privacy Framework. Event data is retained in Google Analytics for 14 months. Further information: https://policies.google.com/privacy.

Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG (consent), which you can withdraw at any time via "Cookie settings" in the footer. On withdrawal, the Google Analytics cookies are deleted.

11. Google Ads Conversion Tracking

We use the conversion tracking of Google Ads, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It allows us to measure whether users who reached our website via a Google advertisement subsequently downloaded a whitepaper or requested an appointment via "Termin vereinbaren" (book an appointment).

The service is loaded only after you have consented to the "Marketing" category. We use Google Consent Mode; all signals are set to "denied" by default and are switched to "granted" only after your consent. Without consent, Google sets no cookies and no data is transmitted to Google.

If consent is given, Google sets the cookie _gcl_au (lifetime: 3 months) as well as further cookies of its own. In the process, your IP address, browser information and the conversion data may be transmitted to servers of Google LLC in the USA. Google is certified under the EU-US Data Privacy Framework. Further information: https://policies.google.com/privacy.

Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG (consent), which can be withdrawn at any time via "Cookie-Einstellungen".

12. LinkedIn Insight Tag

We use the LinkedIn Insight Tag of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, to measure conversions from LinkedIn campaigns (whitepaper download, click on "Termin vereinbaren") and to build audiences for advertising on LinkedIn.

The Insight Tag is loaded only after you have consented to the "Marketing" category. If consent is given, LinkedIn sets, among others, the following cookies:

  • li_sugr – browser identifier. Lifetime: up to 90 days.
  • bcookie – browser identifier. Lifetime: up to 2 years.
  • UserMatchHistory – synchronisation of advertising IDs. Lifetime: 30 days.
  • AnalyticsSyncHistory – time of the last synchronisation. Lifetime: 30 days.

Your IP address, device and browser information and events such as page views are transmitted to LinkedIn; processing by LinkedIn Corporation in the USA is possible. LinkedIn is certified under the EU-US Data Privacy Framework. Further information: https://www.linkedin.com/legal/privacy-policy.

Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG (consent), which can be withdrawn at any time via "Cookie-Einstellungen".

13. External Content (Two-Click Solution)

In some places we embed content from external providers. This content is blocked by default; you see a placeholder instead. Only when you click "Inhalt laden" (load content) or enable the "External content" category in the cookie settings does your browser connect to the respective provider. Only then are data such as your IP address, the page visited and browser information transmitted, and the provider may set its own cookies. The following providers may be embedded:

  • YouTube videos – Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Where possible, we use the enhanced privacy mode (youtube-nocookie.com), in which YouTube sets no personalisation cookies before playback. Privacy policy: https://policies.google.com/privacy.
  • Vimeo videos – Vimeo Inc., 330 West 34th Street, New York, NY 10001, USA. Privacy policy: https://vimeo.com/privacy.

With YouTube and Vimeo, personal data may be transferred to the USA (section 16).

Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG (consent given by clicking "Inhalt laden" or enabling the "External content" category), which can be withdrawn at any time via "Cookie-Einstellungen".

14. Links to LinkedIn and Other Social Networks

References to our company profile on LinkedIn and, where applicable, other social networks are plain links only. We do not use social media plugins or share buttons that connect to the network as soon as the page loads. Data is transmitted only when you click the link and open the provider's page; from that point on, the provider's privacy policy applies.

The same applies to booking appointments via Calendly (Calendly LLC, USA; "Termin vereinbaren" button) and to route links to Google Maps for our locations: these are plain links that open the provider's page only when you click them. We record that you clicked "Termin vereinbaren" only with your consent, via the analytics and marketing services named above.

15. Recipients and Processors

Within our company, only those departments that need your data for the purposes described receive access to it. In addition, we use the following service providers, which process your data on our behalf (Art. 28 GDPR) or to which data is transmitted only after your consent:

  • Hetzner Online GmbH, Germany – hosting (section 3).
  • Laravel Holdings Inc., USA – server management with Laravel Forge (section 3).
  • OpenAI (OpenAI Ireland Ltd., Dublin, Irland) – AI-assisted pre-sorting of enquiries (section 7).
  • – delivery of e-mails generated by the website (contact enquiries, applications, download links, confirmation e-mails).
  • – our e-mail mailboxes in which enquiries and applications arrive.
  • builtworld – operation of the self-hosted Matomo instance (section 10).
  • Google Ireland Limited, Ireland – web analytics (if enabled), conversion tracking and YouTube, only after consent (sections 10, 11 and 13).
  • LinkedIn Ireland Unlimited Company, Ireland – Insight Tag, only after consent (section 12).
  • Vimeo Inc., USA – videos, only after consent (section 13).

Data is disclosed to other third parties only if we are legally obliged to do so, if this is necessary to enforce our rights, or if you have consented.

16. Transfers to Third Countries

Transfers to countries outside the EU or EEA take place to the USA, namely in connection with Google, LinkedIn and Vimeo. Data is transmitted to these providers only after your prior consent.

For the AI-assisted pre-sorting of enquiries (section 7), message texts without contact details may be transferred to OpenAI in the USA. For server management with Laravel Forge (section 3), access from the USA is technically possible.

The transfer is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR), insofar as the respective provider is certified under it, and additionally on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). For consent-based services, the transfer is also based on your explicit consent (Art. 49(1)(a) GDPR); please note that in the USA, access by public authorities is possible against which you may not have effective legal remedies.

17. Retention Periods

We store personal data only for as long as is necessary for the respective purpose or as required by statutory retention obligations. In summary:

  • Server log files: 14 days
  • Application error and event log: 14 days
  • Background jobs that could not be carried out: 7 days
  • E-mail delivery log: 12 months
  • cookie_consent cookie: 12 months
  • Server-side consent record: 12 months
  • Session (cookies ais-management-session and XSRF-TOKEN, session data on the server): two hours after the last activity
  • Contact enquiries (including AI pre-sorting): 6 months after receipt
  • Job applications: in the website database, including uploaded files, 6 months after receipt; forwarded documents 6 months after the end of the process, unless consent to longer retention has been given
  • Whitepaper requests: 12 months
  • Matomo cookies: _pk_id 13 months, _pk_ses 30 minutes
  • Google Ads: _gcl_au 3 months
  • Google Analytics: _ga and _ga_* 2 years; event data in Google Analytics 14 months
  • LinkedIn: bcookie up to 2 years, li_sugr up to 90 days, UserMatchHistory and AnalyticsSyncHistory 30 days

After the period has expired, the data is deleted or anonymised, unless commercial or tax law retention obligations (generally 6 or 10 years) require longer storage.

18. Rights of Data Subjects

You have the following rights with regard to your personal data:

  • Access (Art. 15 GDPR) to whether and which data we process about you.
  • Rectification (Art. 16 GDPR) of inaccurate data or completion of incomplete data.
  • Erasure (Art. 17 GDPR), unless a statutory retention obligation prevents it.
  • Restriction of processing (Art. 18 GDPR) under the conditions set out there.
  • Data portability (Art. 20 GDPR): receipt of the data you have provided in a structured, commonly used and machine-readable format.
  • Objection (Art. 21 GDPR): You may object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests. You may object to processing for direct marketing purposes at any time without giving reasons.
  • Withdrawal of consent (Art. 7(3) GDPR) at any time with effect for the future (section 20).

To exercise your rights, an informal message to the contact details given in section 2 is sufficient. In cases of doubt, we may request proof of identity.

19. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data infringes the GDPR (Art. 77 GDPR). The authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Germany
https://www.lda.bayern.de

You may also contact the supervisory authority of your habitual residence or place of work.

20. Withdrawal of Consent

You may withdraw any consent you have given at any time with effect for the future; the lawfulness of processing carried out until then remains unaffected.

  • Cookies and external services (Statistics, Marketing, External content): Open the "Cookie-Einstellungen" link in the footer and disable the relevant categories. You may additionally delete cookies already set by the affected services in your browser.
  • Other consents (e.g. longer retention of application documents): Send an informal message to the contact details given in section 2.

21. Date of This Privacy Policy

We update this privacy policy whenever the legal situation, our website or the services we use change. The version published on this page applies.

Last updated: October 2026