Privacy notice for rottagentix.io
Last updated: 12 October 2026
Controller and contact
RottAgentiX GmbH, Vogelbergstraße 17, 89079 Ulm, Germany, represented by Managing Director Peter Rottmann, is the controller responsible for personal data processed through this website. For privacy questions or to exercise your rights, contact contact@rottagentix.io.
This notice applies to rottagentix.io. It does not cover independent linked websites or the separate review website hosted on ChatGPT Sites.
Website access and hosting
Our hosting provider is STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. Delivering this website involves processing technical connection data, including your IP address, request date and time, requested URL or file, response status, transferred data volume and browser-supplied information about your browser, operating system and, where applicable, referring page.
We process these data to deliver the website, diagnose technical faults and prevent or investigate abuse and attacks. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of our website. STRATO acts as a hosting processor under its data processing agreement.
STRATO makes access logs available in the customer portal for the preceding six weeks and states that IP addresses in the supplied access statistics are anonymised. This does not mean that all technical data are anonymous at initial collection. Technical data are retained only as necessary for operation, troubleshooting and security. Data necessary to investigate a specific incident or pursue associated legal claims may be retained until that purpose ends.
Email enquiries
When you email us, we process your email address, contact details you provide, message and communication metadata to respond and, where appropriate, prepare a business engagement. Article 6(1)(b) GDPR applies where you request steps towards a contract with you. General business enquiries and communications with company representatives are processed under Article 6(1)(f) GDPR, based on our legitimate interest in responding to enquiries and maintaining business relationships. Legally required retention is based on Article 6(1)(c) GDPR.
We use Microsoft 365, including Exchange Online, for business email. Microsoft and its service subprocessors may process communication data to provide these services. Applicable contractual safeguards are described in the Microsoft Products and Services Data Protection Addendum. Processing outside the EU or EEA may occur, including for global service delivery and support. Where required, transfers rely on an applicable adequacy decision or appropriate Article 46 GDPR safeguards, particularly the agreed EU standard contractual clauses. You may contact us for information about the relevant safeguards.
Providing information is voluntary. We need a reachable contact address and sufficient detail to respond meaningfully. Please do not send patient information, health data or other particularly sensitive information through this general business contact channel.
Contact form and abuse prevention
If you submit the contact form, we process your name, email address, selected topic and message. Required fields are marked. These details are voluntary and are not required merely to browse the website. Without a reachable email address and a description of your enquiry, we cannot respond meaningfully.
Our STRATO-hosted server validates the submission and sends it to our fixed business mailbox through Microsoft Graph. Your email address is used as the reply-to address. The form does not send automatic messages to arbitrary visitor addresses. The purposes, legal bases, Microsoft processing, transfers and retention arrangements described for email enquiries also apply to form enquiries.
To prevent spam and abusive sending, we process short-lived form tokens, validation indicators and a pseudonymous IP-derived identifier generated using a server-held key, together with counters and expiry times. These data protect the service and are not used for advertising or cross-device tracking. Identifiers expire within a maximum 24-hour window. Expired entries are removed on subsequent server requests and by a scheduled cleanup process intended to run at least daily; technical service interruptions may delay execution. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is protecting the website and email service against abuse. Pseudonymous identifiers remain personal data.
Message content is not additionally stored in application logs or passed to an AI agent for automated assessment. Please do not submit patient information or health data.
Local fonts and device storage
DM Sans and Space Grotesk are served by the same web server as this website. Loading these fonts does not connect your browser to Google. The hosting information above applies.
Our website code currently uses no cookies, local storage, analytics trackers or advertising trackers. Technical server logs are separate from storage on your device. Where technically necessary device access or storage is introduced, its permissibility is assessed under section 25(2) TDDDG. Non-essential device access or storage requires prior consent under section 25(1) TDDDG. Subsequent personal data processing also requires a GDPR legal basis.
Recipients
People responsible for handling enquiries at RottAgentiX receive access where required for their task. Technical providers receive data needed to provide their respective services, including STRATO for hosting and Microsoft for business email. Data may also be disclosed where legally required or necessary to establish, exercise or defend legal claims. We do not sell your contact details or subscribe you to a newsletter merely because you contacted us.
Retention of business communications
We retain enquiries as long as necessary to handle them and any associated business relationship. If no engagement follows, data are deleted once that purpose ends, unless a legal retention obligation or a specific need to defend legal claims applies.
For an engagement, retention depends on the type of record and applicable commercial and tax requirements. Data necessary to establish, exercise or defend legal claims may be retained until that purpose ends. Deletion from recovery backups may occur later; recovery copies are not used for ordinary ongoing processing.
Your rights
Subject to the applicable legal conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. Where processing is based on consent, you may withdraw that consent at any time with effect for the future; withdrawal does not affect prior lawful processing.
You may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation. We will stop processing the affected data unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or processing is necessary to establish, exercise or defend legal claims. You may object to processing for direct marketing at any time without giving such grounds.
Contact contact@rottagentix.io to exercise your rights. You also have a right to complain to a supervisory authority, particularly where you normally live or work or where you consider an infringement occurred. The authority for our registered location is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg.
Automated decisions and updates
This website does not make automated decisions, including profiling, that produce legal effects or similarly significant effects. Form submissions are not assessed by an AI agent to decide automatically whether to enter a business engagement.
We update this notice when services, processing activities or legal requirements change.