Privacy

Email infrastructure provided by IONOS SE is used for the mailbox jan.koselka@jelmara.de:

If you send an email, message content and technical communication data may be processed through the systems of the email service provider.

The email service Resend, provided by Plus Five Five, Inc., is used for technical delivery of project and conversation enquiries sent from the JelmaraOS demo:

This may include processing the email address, name, company, enquiry content and technical email metadata. Resend processes Customer Data as a processor under its Data Processing Addendum.

According to Resend, primary processing operations take place in the United States. Its Data Processing Addendum provides appropriate safeguards for international transfers where required, including Standard Contractual Clauses. Further information is available in the Resend Data Processing Addendum.

This website is technically provided through Vercel. The provider is:

When the website is accessed, Vercel systems may process in particular the IP address, approximate location information derived from it, technical system and browser information, and request, diagnostic and log data.

Processing serves the secure, stable and efficient provision of the website, abuse prevention and technical error analysis. The legal basis is Art. 6(1)(f) GDPR. The legitimate interest is the secure and reliable provision of this website.

Where Vercel processes personal data as Customer Data on our behalf, this is carried out for the Pro service used on the basis of its Data Processing Addendum under Art. 28 GDPR. Where certain Service-Generated Data produced by Vercel is personal data, the Data Processing Addendum provides for Vercel to act as an independent controller for that processing.

Vercel Inc. is based in the United States. For transfers to certified companies in the USA, the European Commission has adopted an adequacy decision for the EU-U.S. Data Privacy Framework. Vercel states that it is certified under this framework. Where other transfer mechanisms are required, Vercel’s Data Processing Addendum provides, depending on the circumstances, in particular for the European Commission Standard Contractual Clauses under Decision (EU) 2021/914. The Data Processing Addendum, including the Standard Contractual Clauses incorporated into it, is available at vercel.com/legal/dpa. Further information about processing for which Vercel acts as controller is available in the Vercel Privacy Notice. The Frankfurt region configured for server-side functions does not mean that all processing takes place exclusively in Germany or the European Union.

Ask JELMARA uses the OpenAI API. For JELMARA as an API customer established in the European Economic Area, the current OpenAI Data Processing Addendum provides for OpenAI Ireland Limited as the OpenAI contracting party:

When you submit a question through Ask JELMARA, the question text you enter is sent to the OpenAI Responses API together with publicly approved JELMARA context selected server-side for the response. The transmission is used to generate an answer based on approved JELMARA information. Ask JELMARA is not intended for confidential, sensitive or personal information. Please do not enter such information in the input field.

Processing is based on the legitimate interest in providing a secure and controlled information and communication service pursuant to Art. 6(1)(f) GDPR. Where a specific enquiry is aimed at entering into a possible contract, processing may additionally serve pre-contractual measures pursuant to Art. 6(1)(b) GDPR.

JELMARA configures the OpenAI Responses API with “store: false”. This disables the regular storage of the response object as application state for that request. Separately, according to OpenAI, abuse-monitoring logs may contain API inputs and outputs and are retained by default for up to 30 days, unless a different retention configuration applies or longer retention is required.

OpenAI states that content submitted through its API platform is not used by default to train or improve its models unless the API customer explicitly opts in to such use.

OpenAI processes Customer Data under its Data Processing Addendum. For international transfers where required, the addendum provides for appropriate transfer mechanisms, including Standard Contractual Clauses or applicable adequacy decisions. Further information about API data controls is available in the OpenAI data controls documentation.

No analytics or marketing services are used in the current version of the website. JELMARA currently does not use non-essential cookies or its own tracking technologies that store information in your browser or read information from it.

Ask JELMARA additionally creates server-side, content-free operational telemetry for stability, error, cost and quality control. This may include a random request ID, language, outcome category, detected topic, technical counts, processing durations and, where available, token counts.

JELMARA does not store the submitted question text, answer text or conversation history in this first-party operational telemetry. It also does not store an IP address, browser identifier, persistent user identifier or cross-session identifier in this telemetry. It is not used to create user profiles or for marketing tracking and may be processed as server-side log information through the hosting infrastructure.

This is separate from technically required connection, security and log data used by the hosting service as described under “Website hosting”. JELMARA does not use this data for analytics or marketing tracking.

A consent or cookie banner is therefore not currently used. If the technical setup of the website changes, the consent requirements will be reassessed before deployment.

Personal data from an email enquiry is stored only for as long as necessary to process and follow up the enquiry. Longer storage takes place only where statutory retention obligations, existing contractual relationships or the establishment, exercise or defence of legal claims require it.

Technical hosting, security and log data is processed according to the criteria relevant to service provision, system security, error analysis and legal or contractual requirements. The specific retention period may also depend on the retention periods provided for by the Vercel and Resend services used.

For Ask JELMARA, the OpenAI API retention conditions described in section 6 apply in addition. In particular, “store: false” is used; separate abuse-monitoring logs may, according to OpenAI, be retained by default for up to 30 days.

Subject to the requirements of the GDPR, you may in particular have rights of access, rectification, erasure, restriction of processing, data portability and objection.

To exercise your rights, you can contact jan.koselka@jelmara.de.

You have the right to lodge a complaint with a data protection supervisory authority.

For a controller established in Baden-Württemberg, the competent authority may in particular be the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg: