Privacy Policy

1

Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

2

Collection and Storage of Personal Data

a) When visiting the website

When you access our website, your browser automatically sends information to our web server. This information is processed to deliver the site and is additionally stored in an access log (details below). The following information is transmitted automatically:

• IP address of the requesting device
• Date and time of access
• Name and URL of the requested file
• Website from which access was made (referrer URL)
• Browser used and, if applicable, operating system

The data listed above is processed for the following purposes: ensuring a smooth connection to the website, ensuring convenient use of the website and evaluating system security and stability, including detecting and defending against attacks. The legal basis for data processing is Art. 6(1)(f) GDPR; our legitimate interest follows from the purposes listed.

The website is delivered via the infrastructure of our processor Amazon Web Services (see section 3). Every request is stored in an access log (Amazon CloudFront, stored in Amazon CloudWatch Logs). A log entry contains the information listed above, with the IP address in full, as well as further technical details of the request, such as parameters of the requested address, HTTP status code, amount of data transferred, response time, protocol and encryption method used, the delivering CloudFront location and the country derived from the IP address. Content you send via the contact form is not part of the log.

The logs are stored in the AWS Region US East (N. Virginia, us-east-1); see section 3 for the transfer to the USA. Apart from our processor, only we have access to them. We analyse them solely for security purposes – to ensure system security and stability, in particular to detect and defend against attacks – and not for access statistics or audience measurement; they are not combined with other data sources and no user profiles are created. The entries are deleted automatically after 90 days (three months) (Art. 5(1)(e) GDPR); for technical reasons AWS usually completes the final deletion within 72 hours after this period ends, in rare cases later.

To protect against overload, a firewall operated by our processor Amazon Web Services (AWS WAF) counts the requests per IP address over a five-minute window. If an IP address exceeds the set limit, further requests from it are rejected temporarily. For troubleshooting, AWS also keeps a sample of individual requests, including the IP address, for up to three hours. No further storage takes place in this context. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the availability and security of the website.

This is to be distinguished from the abuse protection of the contact form: when you submit the form, your IP address is additionally processed briefly in pseudonymised form in order to limit the number of submissions. See b) for details.

b) When using the contact form

If you have any questions you can contact us via the form provided on the website. Your name, your company, a valid email address and a project description are required. Further information – phone number, type of enquiry, number of agents and budget range – may be provided voluntarily. Data processing for the purpose of contacting us is carried out pursuant to Art. 6(1)(a) GDPR on the basis of your voluntarily given consent, which you grant explicitly via a checkbox before submitting. You may withdraw this consent at any time with effect for the future; the lawfulness of processing carried out up to the withdrawal remains unaffected.

To protect against automatically generated submissions (spam), the form evaluates three technical details: an additional field that is invisible to you and is only ever filled in by programs, the time at which the page was loaded, and – in order to limit the number of submissions per connection – your IP address. No data is transmitted to third parties and no cookies are set in the process. The legal basis is our legitimate interest in preventing abusive enquiries and in the security of processing pursuant to Art. 6(1)(f) GDPR in conjunction with Art. 32 GDPR.

Your IP address is not stored in clear text. Together with a secret additional value it is converted into a string that cannot be reversed (SHA-256); for IPv6 addresses only the network portion is used beforehand. Only this string and a counter are stored – not the content of your enquiry. The entries are deleted automatically no later than 25 hours after they are created (Art. 5(1)(e) GDPR); we are therefore unable to draw any conclusions about your identity. Processing takes place in the Frankfurt am Main region (eu-central-1). If the quota is exceeded, your enquiry is not transmitted and the form displays a corresponding notice; in that case you can always reach us directly by email. Independently of this, the request made when you submit the form is – like any other request – recorded with your IP address in the access log described in a), but without the content of your enquiry.

The data you provide will be used exclusively to process your enquiry and will not be used for advertising purposes. Technically, the enquiry is processed by our processor Amazon Web Services and delivered by email to our mailbox, which is operated by our processor ALL-INKL.COM; see section 3 for details on both. No disclosure to third parties within the meaning of Art. 4(10) GDPR takes place.

We store your enquiry only for as long as is necessary to deal with it, and at most six months after our last contact concerning the enquiry; it is then deleted (Art. 5(1)(e) GDPR). If the enquiry leads to an engagement, it becomes part of the contract records and is subject to the statutory retention periods that apply to them. If you withdraw your consent, we delete the enquiry without undue delay unless a statutory retention obligation prevents this.

3

Disclosure of Data

Your personal data will not be transferred to third parties for purposes other than those listed below. We share your personal data with third parties only if:

• You have given your express consent pursuant to Art. 6(1)(a) GDPR
• Disclosure is necessary pursuant to Art. 6(1)(f) GDPR for the assertion, exercise or defence of legal claims
• There is a legal obligation for disclosure pursuant to Art. 6(1)(c) GDPR

Processors and recipients

We use service providers for technical operation who process personal data exclusively on our behalf and on our instructions. Under Art. 4(10) GDPR a processor is not a "third party", but it is a recipient within the meaning of Art. 4(9) GDPR. Data processing agreements pursuant to Art. 28 GDPR are in place with the following providers:

Transfers to third countries

Processing of your form data and the email dispatch take place within the European Union; the email mailbox is operated by a provider established in Germany. Amazon CloudFront is a global content delivery network; the purely technical retrieval of static page content may therefore be served from locations outside the EU. Where this involves a transfer to a third country, it takes place on the basis of the Standard Contractual Clauses adopted by the EU Commission pursuant to Art. 46(2)(c) GDPR together with supplementary safeguards. AWS stores the access logs described in section 2a in the US East (N. Virginia, us-east-1) Region; this involves a transfer to the USA. It takes place on the basis of the EU Commission's adequacy decision on the EU-U.S. Data Privacy Framework (Art. 45(1) GDPR), under which AWS is certified. Content submitted via the contact form is not affected by this.

4

Cookies and Local Storage

This website sets no cookies.

There is one exception, the cost and benefit calculator. The calculation runs entirely in your browser, and your inputs do not leave your device. Only if you click “Add result to the contact form” do we store your inputs and the result briefly in your browser's session storage (sessionStorage). The contact form reads this entry when it opens, copies the text into the “Project description” field and deletes the entry right away. Your browser removes it anyway when you close the tab or window.

The text reaches us only when you submit the form. Until then, you can change or delete it. Storing the entry briefly in your browser is strictly necessary for the transfer you explicitly requested, so it is permitted without consent under Section 25(2) No. 2 TDDDG (German Telecommunications Digital Services Data Protection Act). Processing after you submit the form is covered by section 2(b).

5

External Services and CDNs

This website loads the following external resources, which may establish a connection to third-party servers when the page is accessed:

6

Your Rights as a Data Subject

Under the GDPR you have the following rights regarding your personal data:

To exercise your rights please contact us by email at: info@cx-routes.com

You also have the right to lodge a complaint with a data protection supervisory authority regarding our processing of your personal data. The competent authority is the supervisory authority of the federal state in which you reside.

7

Data Security

The connection between your browser and our website is encrypted throughout using TLS (Transport Layer Security, version 1.2 or higher). Unencrypted requests via http:// are redirected automatically to the encrypted connection, and your browser is instructed via the HSTS security mechanism to access our website only over an encrypted connection in future. Whether a page is transmitted in encrypted form can be seen from the padlock symbol in your browser's address bar.

We also use appropriate technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or unauthorised access by third parties.

8

Currency and Amendments to This Privacy Policy

This privacy policy is currently valid and was last updated in October 2026. The further development of our website and services or changes to legal or regulatory requirements may make it necessary to amend this privacy policy. The current version of the privacy policy can be accessed and printed from the website at any time.