Privacy Policy

Last updated: 13.10.2026

1. Controller

EnRo UG (haftungsbeschränkt), Graisch 12, 91278 Pottenstein, Germany
Email: info@enro.solutions

2. Data protection contact

For privacy-related questions, contact: Sascha Roehrer,info@enro.solutions.

3. Processing when you visit our website (server logs)

When you access our website, our hosting provider processes technical data (e.g., IP address, date/time, requested page, user agent, referrer URL) to deliver the site and ensure security.

Purpose: website delivery, IT security, abuse prevention, troubleshooting.
Legal basis: Art. 6(1)(f) GDPR (legitimate interests).
Retention: typically 7–30 days.

4. Hosting and processors

This website runs on the platform of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, which acts as our processor under Art. 28 GDPR. The database in which we store contact requests and company analyses is restricted to storage locations in the European Union.

5. Cookies and similar technologies

This website only uses strictly necessary cookies and similar technologies (e.g., for security or language settings), where required at all.

Legal basis: Art. 6(1)(f) GDPR; and where applicable § 25(2) TDDDG (no consent required for strictly necessary access).

Audience measurement: on the public pages of this website we measure usage with Plausible Analytics (Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia). Plausible sets no cookies and stores nothing on your device. It records the page viewed, the referring page, browser, operating system, device type and the approximate origin (country, region, city), also how far a page was read and how long it was open, clicks on links to other websites (with their address), file downloads and the fact that a form was sent (not its content). Your IP address and your browser's identifier are processed only briefly to derive a value that changes every day; they are not stored. Recognising a visitor across several days or across other websites is therefore not possible. According to Plausible, the data is processed on servers in the European Union. The personal company analyses, their login pages and the internal area are not measured.

Purpose: audience measurement and improving the website.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in measuring reach without recognising individual visitors).
Retention: the measurements contain neither your IP address nor a lasting identifier; we keep them as long as we use Plausible.

6. Contact form and email

If you use our contact form, we process your name, email address, optionally your company, the topics you select and your message. The request is stored in our database at Cloudflare (storage location EU). We also receive a notification containing your request by email; it is sent via Resend (Resend, Inc., USA), acting as our processor, using servers in the EU (Ireland). If you email us directly, we process the information contained in your email.

To protect against abusive mass submissions, we derive a check value (hash) from your IP address and the current date. It is not linked to your request and is deleted after a short time, at the latest after one day.

Purpose: responding to inquiries, initiating business relationships, abuse prevention.
Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps) and/or Art. 6(1)(f) GDPR.
Retention: requests submitted through the contact form are deleted from our database automatically 12 months after receipt. Emails are kept until the request is resolved. If a business relationship arises, we retain the necessary information in line with legal retention obligations.

7. Company analyses with AI-assisted research

To show companies concrete opportunities for AI, we prepare personal company analyses. For this purpose we research publicly available information about the company (e.g., company website, industry, published information) using the AI service Claude by Anthropic, PBC (USA), acting as our processor. We transmit the company name, its public website and the public information researched; information from our contact form is not transmitted. We process personal data (e.g., names of managing directors) only where it is publicly available and needed for the assessment. Drafts and results are stored in our database at Cloudflare (storage location EU). Published analyses can be reached via a personal link and are excluded from search engine indexing.

Purpose: initiating business relationships.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in approaching potential customers).
Retention: as long as the analysis is needed for this purpose or until you object, which you can do at any time viainfo@enro.solutions.

We inform the company about a finished analysis by letter. For this we use the company name and business address from publicly available sources (the legal notice of the company website, the commercial register) and, where stated there, the name of a contact person. The letter contains the access details for the analysis.

Purpose: approaching business customers by post.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in approaching potential customers).
Objection: you can object to receiving such letters at any time (Art. 21(2) GDPR). A message toinfo@enro.solutions is enough; we will then no longer write to you.
Retention: as long as the analysis itself.

When a published analysis is opened via the personal link, we store the time at which the login page was opened, of the login and of later visits. We also store the approximate origin of the request (country, region, town and the name of the network operator, as derived from the IP address) and the IP address in shortened form (without its last part). We do not store the full IP address. Of a login attempt that fails we also store only these details, never the password that was entered. We do not store information about the device.

Purpose: to see whether and when the analysis was viewed, so that we can answer questions promptly.
Legal basis: Art. 6(1)(f) GDPR.
Retention: as long as the analysis itself.

In the analysis and in the letter we offer to pick an appointment for a talk online. The link and the QR code lead to a booking page of Google Calendar (Google Ireland Limited, Ireland). Nothing from Google is loaded on our pages for this: only when you open the link or scan the code does Google receive data from you (e.g., your IP address). If you book an appointment, we receive the appointment and the details you enter there. Google may also process data in the USA (see section 8). The booking page itself is additionally subject to Google's privacy policy. Booking is voluntary: you can reach us just as well through the inquiry form of the analysis or by email.

Purpose: arranging an appointment for a talk.
Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps) and/or Art. 6(1)(f) GDPR.
Retention: we delete appointments and the related details as soon as they are no longer needed for the talk and any business relationship arising from it.

8. Recipients and international transfers

We share data with service providers acting as our processors (hosting and database: Cloudflare; email delivery: Resend; AI-assisted research: Anthropic; audience measurement: Plausible). For booking appointments we use Google Calendar (Google Ireland Limited, Ireland; Google LLC, USA). If data is transferred outside the EU/EEA, we ensure appropriate safeguards (e.g., an adequacy decision such as the EU-US Data Privacy Framework, or Standard Contractual Clauses).

9. Your rights

You have the right to access, rectification, erasure, restriction, data portability, and objection (Art. 15–21 GDPR). Where processing is based on consent, you may withdraw consent at any time.

10. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement (Art. 77 GDPR).

11. Updates to this policy

We may update this Privacy Policy to reflect changes in law or our processing activities.