Crobi
Book a demo

Legal

Data protection

Last updated: 8 October 2026

This privacy policy explains which personal data we process when you visit crobi.ai, contact us or book a demo, why we process it, and which rights you have under the EU General Data Protection Regulation (GDPR) and German data protection law.

1. Controller

The controller responsible for processing personal data on this website is:

Vestaris GmbH

Blütenstraße 1580799 MünchenGermany
Represented by
Marcel Huth
E-mail
[email protected]
Phone
+49 160 - 9598 0387

Crobi is a product of Vestaris GmbH. Further details are in our imprint.

2. Hosting and server log files

This website is hosted by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (Cloudflare Pages). When you open a page, your browser automatically sends information that the hosting provider stores in server log files: IP address, date and time of the request, the page requested, the referring page, browser type and version, operating system and the amount of data transferred.

We need this data to deliver the website, keep it stable and secure, and defend against attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and reliable operation of the website. Log data is not combined with other data sources and is deleted by the provider after a short period, unless it is needed to investigate a security incident.

We have concluded a data processing agreement with Cloudflare. Cloudflare is certified under the EU-U.S. Data Privacy Framework; transfers to the USA are based on the European Commission’s adequacy decision (Art. 45 GDPR) and, in addition, on standard contractual clauses.

3. Fonts and other resources

All fonts, images and scripts that make up this website are served from our own domain. No connection is made to Google Fonts or other font or content delivery services when you load the page.

4. Cookies

The website itself does not set cookies and does not store information on your device. Where tools that use cookies or similar technologies are loaded through Google Tag Manager (section 5), we only do so where the law permits it, and with your consent where § 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) requires it.

5. Google Tag Manager

We use Google Tag Manager, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Tag Manager is a tool for managing website tags. It is loaded after your first interaction with the page (scrolling, touching or using the keyboard) or after five seconds. Tag Manager itself does not set cookies and does not create user profiles, but loading it transmits your IP address and technical information about your browser to Google, which may also process data in the USA.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the efficient management of the tools used on our website. Google is certified under the EU-U.S. Data Privacy Framework. Further information: Google privacy policy. If we use further tools through Tag Manager, we describe them in this policy.

6. Contacting us

If you contact us by e-mail or phone, we process the information you give us (for example your name, e-mail address, company and the content of your message) in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract or to steps before entering into one, and Art. 6(1)(f) GDPR otherwise; our legitimate interest is answering enquiries addressed to us. We delete the data once your enquiry has been dealt with, unless statutory retention obligations apply.

7. Booking a demo

The “Book a demo” links lead to an appointment booking page provided by Google (Google Calendar appointment scheduling). When you book an appointment there, Google processes the data you enter, such as your name, e-mail address and preferred time, and passes it to us so that we can hold the demo. The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract). Google’s privacy policy applies to the booking page itself: policies.google.com/privacy.

We use the booking data only to prepare and hold the demo and to follow up on it, and delete it once it is no longer needed for this purpose, unless statutory retention obligations apply.

8. Service providers

For this website we use the following service providers, who process personal data on our behalf or as independent controllers as described above:

  • Cloudflare, Inc., USA: hosting and content delivery (section 2)
  • Google Ireland Limited, Ireland: Google Tag Manager (section 5) and appointment booking (section 7)

9. Transfers to third countries

Some of the providers named above are based in the USA or may process data there. We only transfer personal data to countries outside the EU and the EEA where an adequacy decision of the European Commission exists (such as the EU-U.S. Data Privacy Framework for certified companies) or appropriate safeguards are in place, in particular the EU standard contractual clauses (Art. 46 GDPR).

10. Storage period

We store personal data only for as long as it is needed for the purpose for which it was collected, or for as long as statutory retention periods require, in particular under German commercial and tax law (§ 257 HGB, § 147 AO), which can be up to ten years.

11. Your rights

You have the following rights regarding your personal data:

  • Access to the data we hold about you (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Withdrawal of any consent you have given, with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR): Where we process your data on the basis of Art. 6(1)(f) GDPR, you can object to the processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

To exercise your rights, write to [email protected].

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.

12. Encryption

This website is served exclusively over an encrypted connection (TLS). You can recognise it by “https://” in the address bar and the lock symbol in your browser.

13. Changes to this policy

We update this privacy policy when our website or the services we use change, or when the law requires it. The current version is always available on this page.