Privacy Policy

1. Name and Address of the Controller

Responsible for the processing of your personal data on the Website and in the context of the Conelio services within the meaning of Art. 4 No. 7 of the General Data Protection Regulation (hereinafter “GDPR”) is

Dr. Timo Koch (Conelio Labs – project) (hereinafter "Conelio" or "we"),
Weißenseestr. 122
81539 Munich
Email: hello@conelio.ai

If you have any questions regarding data protection, please also contact hello@conelio.ai.

2. General Information on Data Processing

2.1 Type and Scope of the Processing of Personal Data

We process personal data only to the extent permitted by law and in particular to the extent necessary to provide a functional website and our other services and products.

2.2 Legal Basis for the Processing of Personal Data

Insofar as we obtain the consent of you for the processing of personal data, Art. 6 para. 1 lit. a GDPR serves as the legal basis. When processing personal data that is necessary for the fulfilment of a contract to which you are a party, Art. 6 para. 1 lit. b GDPR serves as the legal basis. This also applies to data processing that is necessary for the performance of pre-contractual measures. Insofar as the processing of personal data is necessary to fulfil a legal obligation to which we are subject, Art. 6 para. 1 lit. c GDPR serves as the legal basis. In the event that vital interests of you or another natural person require the processing of personal data, Art. 6 para. 1 lit. d GDPR serves as the legal basis.

If the processing is necessary to safeguard a legitimate interest of us or a third party and if the interests, and your fundamental rights and freedoms do not outweigh the former interest, Art. 6 para. 1 lit. f GDPR serves as the legal basis for the processing.

2.3 Deletion of Data and Retention Period

The personal data processed by us for the purposes described below will generally be deleted or protected/blocked by technical measures (e.g. anonymisation) as soon as the purpose of the processing no longer applies. This also takes place when a prescribed storage period expires, unless there is a need for further storage of the personal data for another storage purpose. Unless we are legally obliged to store the data for a longer period (e.g. due to tax or commercial law retention obligations) or to disclose it to third parties (in particular law enforcement authorities), the decision as to which personal data we process depends on which functions of the Website or other services and products you use in each individual case.

2.4 External Links

Please note that links on our Website may take you to other websites that are not operated by us, but by third parties. Such links are either clearly labelled by us or are recognisable by a change in the address line of your browser. If these websites are not operated by us, we are not responsible for compliance with data protection regulations and the secure handling of your personal data on these websites operated by third parties.

3. Visit and General Use of our Website

3.1 Server Log Files

When you visit our Website, the browser used on your device automatically sends information to the respective server of our Website. This information is temporarily stored in a log file (“server log file”). The following information is recorded and stored until it is automatically deleted:

• IP address of the requesting computer shortened by the last octet,
• Date and time of access,
• Name and URL of the retrieved file,
• Website from which the access is made (referrer URL),
• Browser used and, if applicable, the operating system of your computer and
• Name of your access provider.

We process the aforementioned data for the following purposes:

• Ensuring a smooth connection to the respective website,
• To ensure a comfortable use of our Website,
• Checking and ensuring system security and stability, and
• for further administrative purposes.

Your IP address is collected in particular for the detection of malware and bots, for retrospective observation and analysis of attacks and unauthorised access attempts and for blocking IP addresses that lead to a high load on our Website due to a particularly high call density on a content.

The legal basis for data processing is Art. 6 para. 1 lit. f GDPR. Our legitimate interest follows from the aforementioned purposes of data collection. Under no circumstances do we use the data collected for the purpose of drawing conclusions about your person. We routinely delete this data after six (6) months at the latest, or in any case after the purpose of the processing no longer applies. We do not merge this personal data with other data sources. Disclosure only takes place insofar as this is necessary for the operation of our Website with regard to processors in accordance with Article 28 GDPR, e.g. with storage by our host provider. However, we reserve the right to check the server log files retrospectively if there are concrete indications of illegal or system-inappropriate use of our Website.

The collection of data for the provision of the Website and the storage of data in log files is absolutely necessary for the operation of the Website (cf. Art. 21 para. 1 GDPR). Consequently, there is no possibility for the user to object. It is not possible to visit our Website without the above-mentioned data processing.

3.2 Contact Request

If you send us an email using the contact option provided on our Website or contact us by any other means of communication, the personal data you provide will be processed by us. In this case, the personal data transmitted with the email or message and provided by you (name, email address, your IP address and the date and time of the contact enquiry) will be stored.

This information is transmitted by your email client or other communication channel and processed in our IT systems. The processing of this personal data is necessary for answering your request.

The legal basis for this data processing is our legitimate interest in responding to your request within the meaning of Art. 6 para. 1 lit. f GDPR. If, after you have contacted us, a contract is concluded with us in relation to the use of the platform, the further processing of your personal data is based on the legal basis of Art. 6 para. 1 lit. b GDPR.

The personal data will be processed for as long as is necessary to answer your request. If your request leads to the conclusion of a contract at a later date, the data will be processed for as long as this is necessary to carry out pre-contractual measures or to fulfil the contract. If no contract is concluded, the personal data will be routinely deleted every six (6) months at the latest. We do not merge your personal data with other data sources. Your personal data will not be disclosed to third parties.

The provision of your personal data in connection with sending an email or contacting us via another communication channel is voluntary, so please only provide the personal data that you consider necessary to answer your enquiry.

3.3 Social Media Accounts

We also use social networks, in particular “LinkedIn” (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (“LinkedIn”).

Our Website only contains a reference (link) to our LinkedIn company account. We do not use social media plugins or buttons that transfer data to LinkedIn as soon as our Website is accessed. Data is only transferred to LinkedIn once you actively click on the link and thereby leave our Website.

Account

We also operate our own company account on LinkedIn and process your personal data via this account to protect our legitimate interests in providing up-to-date information and interaction opportunities in accordance with Art. 6 para. 1 lit. f GDPR.

If you visit our LinkedIn account, such a visit also triggers the processing of your personal data by LinkedIn.

If this information is used by LinkedIn to provide us, as the operator of an account, with statistical information such as gender and age distribution about the use of the respective page or to display further information or advertisements to you according to your preferences, we are jointly responsible with LinkedIn for the data processing operations within the meaning of Art. 26 GDPR. We have therefore concluded a joint controllership agreement with LinkedIn in accordance with Art. 26 para. 1 GDPR.

The rights of data subjects under the GDPR (see section 7) can therefore in principle be asserted against both joint controllers, i.e. against us and against LinkedIn. Please note that despite the joint responsibility with LinkedIn pursuant to Art. 26 GDPR, we have no full influence on the data processing of the individual social networks. The corporate policy of the respective provider has a significant influence on our options. In the event of the assertion of data subject rights, we could only forward these requests to LinkedIn.

Because your data may be transferred to countries outside the European Union (via the parent company) in relation to data processing by LinkedIn, the aforementioned contract with LinkedIn contains the EU standard contractual clauses pursuant to Art. 46 para. 2 lit. c GDPR. In addition, LinkedIn’s parent company, based in the USA, is certified in accordance with the EU-US Data Privacy Framework (Art. 45 GDPR).

Own data protection information

Further information on the purpose, scope and further processing and use of the data by LinkedIn as well as your rights in this regard and options for protecting your privacy can be found in the data protection information at: https://www.linkedin.com/legal/privacy-policy?_l=de_DE.

4. Use of the Conelio Services

For the use of the Conelio services, you will generally be granted a right of access to the Conelio platform on the basis of a contractual agreement with your university, your employer or another institution (hereinafter “Organisation”). Via the platform you can simulate professional conversation situations – such as leadership, feedback, conflict or negotiation conversations – with AI-based conversation partners and receive automated feedback.

4.1 Log In

If you have been granted a right of access to the Conelio services, you can register within the agreed framework and in the agreed manner and subsequently receive the contractually granted access. Registration is usually based on an invitation or an access code or QR code provided by your Organisation.

As a rule, we process the following personal data that you provide during the registration process:

• First name and surname,
• Email address and
• log-in data, organisational, course or group affiliation and role.

The legal basis for data processing in connection with the registration process is Art. 6 para. 1 lit. b GDPR for the performance of the user agreement concluded with you on the basis of the TERMS OF USE FOR THE USE OF THE CONELIO PLATFORM. Insofar as we process the data on behalf of your Organisation, this is done on its documented instructions pursuant to Art. 28 GDPR; in this case the Organisation is the controller.

We delete this personal data after termination of the user agreement or after your access authorisation has expired, at the latest within 90 days, unless statutory retention obligations prevent this.

4.2 Training Sessions and Contents of the Conelio Services

Within a training session we process your inputs, in particular text and voice inputs and their transcripts, the scenarios and objectives you select, usage and metadata (such as time, duration and progress) as well as the automatically generated conversation contributions, feedback and evaluations. Voice inputs are processed solely to generate the transcript and the feedback; no biometric identification and no emotion recognition takes place.

Insofar as you access the Conelio services on the basis of a contractually granted right of access, we generally process the personal data arising in this context as a processor for your Organisation. In this case, your Organisation is the controller within the meaning of Art. 4 No. 7 GDPR; please address requests for access, rectification and erasure to them. If such a request reaches us directly, we will forward it to your Organisation without undue delay.

4.3 Use of Artificial Intelligence Systems

To generate the simulated conversation contributions and the evaluations, we use artificial intelligence systems. For this purpose we engage carefully selected service providers whom we have bound as processors or sub-processors pursuant to Art. 28 GDPR. These service providers process your data solely on our documented instructions for the provision of the service and may in particular not use it to train their own models.

We only use your inputs to train or further develop AI models if you have given separate consent (Art. 6 para. 1 lit. a GDPR) or if the data has previously been anonymised in such a way that a personal reference can no longer be established.

No decision based solely on automated processing within the meaning of Art. 22 GDPR which produces legal effects concerning you or similarly significantly affects you takes place. The feedback provided by the platform serves practice purposes only and does not constitute an assessment of performance.

You can find a current overview of the service providers engaged and information on the place of processing here. Insofar as personal data is processed outside the European Union or the European Economic Area, this takes place on the basis of an adequacy decision of the European Commission or the standard contractual clauses pursuant to Art. 46 para. 2 lit. c GDPR.

4.4 Retention Period for Training Contents

Your user account and the contents of your training sessions will be deleted as soon as your access authorisation ends, at the latest within 90 days thereafter, unless statutory retention obligations prevent this or a different deletion period has been agreed with your Organisation.

5. Cookies on the Website

In order to make visiting our Website attractive and to enable the use of certain functions, we use so-called cookies on the various subpages of our Website. These are small text files that are stored on your device and have various functions. Cookies do not cause any damage to your device and do not contain viruses, Trojans or other malware. Information is stored in the cookie that results in each case in connection with the specific device used. However, this does not mean that we obtain direct knowledge of your identity. Some of the cookies we use are deleted again at the end of the browser session, i.e. after you close your browser (so-called session cookies). Other cookies remain on your device and enable us or our partner companies (so-called third-party cookies) to recognise your browser on your next visit (so-called persistent cookies). If cookies are set, they collect and process certain user information such as browser and location data as well as IP address values to an individual extent. Persistent cookies are automatically deleted after a certain period of time, which can vary depending on the cookie. There are also cookies that are used to evaluate user behaviour or display advertising (so-called analysis or marketing cookies).

When you merely visit our Website, no cookies are currently set. Use of the Conelio platform requires a technically necessary session cookie which is needed for logging in and for maintaining your session. We do not use analysis or marketing cookies. The cookies used can be viewed under the “Cookies” button.

5.1 Purpose of the Use of Cookies

The purpose of using technically necessary cookies is to ensure the functionality and services of the Website and to make it easier for users to use our Website and thus ensure user-friendliness. Some functions of our Website cannot be offered without the use of cookies.

5.2 Legal Basis for the Use of Cookies

With regard to functional or technically necessary cookies, the legal basis is our legitimate interest in the aforementioned factors in accordance with Art. 6 para. 1 lit. f GDPR. We have a legitimate interest in the storage of cookies for the technically error-free and optimised provision of our services.

5.3 Duration of the Use of Cookies

Cookies are stored on your device and transmitted from it to our Website. As a user, you therefore have full control over the use of cookies. Our cookies are stored in your browser until they are deleted or, if it is a session cookie, until the session has expired. You can deactivate or restrict the transmission of cookies by changing the settings in your Internet browser. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are deactivated for our Website, it may no longer be possible to use all functions of the Website to their full extent. You can use the following links to find out about this option for the most commonly used browsers:

• Microsoft Internet Explorer: https://support.microsoft.com/de-de/help/17442/windows-internet-explorer-delete-manage-cookies
• Mozilla Firefox: https://support.mozilla.org/de/kb/Cookies-blockieren
• Google Chrome: https://support.google.com/chrome/answer/95647
• Safari: https://support.apple.com/kb/ph21411

6. Transfer of Data

Your personal data will not be transferred to third parties for purposes other than those listed below. We only transfer your personal data to third parties if:

• you have given your express consent in accordance with Art. 6 para. 1 lit. a GDPR,
• this is legally permissible and necessary for the processing of contractual relationships with you in accordance with Art. 6 para. 1 lit. b GDPR,
• in the event that there is a legal obligation for transfer/disclosure pursuant to Art. 6 para. 1 lit. c GDPR,
• Transfer/disclosure pursuant to Art. 6 para. 1 lit. f GDPR is necessary for the establishment, exercise or defence of legal claims and there is no reason to assume that you have an overriding legitimate interest in the non-disclosure of your data or
• this is carried out by a service provider acting on our behalf and on our exclusive instructions, whom we have carefully selected (Art. 28 para. 1 GDPR) and with whom we have concluded a corresponding contract for order processing (Art. 28 para. 3 GDPR), which obliges our contractor to implement appropriate security measures, among other things, and grants us comprehensive control authorisations.

Transfer to service providers in accordance with letter e) for the purpose of order processing takes place in the following areas: technical provision and programming of the Website, user communication, provision of software as a service.

Sub-processors of ours in connection with the provision of the Conelio services are communicated within the framework of the data processing agreement and in accordance with section 4.3.

If we process data in a so-called third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or if this is done in the context of the use of third-party services or disclosure or transfer of data to third parties, this will only take place if one of the above-mentioned legal bases exists and the special requirements of Art. 44 et seq. GDPR are ensured. I.e. the processing is carried out, for example, on the basis of an adequacy decision pursuant to Art. 45 GDPR and/or special guarantees, such as compliance with officially recognised contractual obligations pursuant to Art. 46 para. 2 lit. c GDPR (so-called “EU standard contractual clauses” pursuant to the implementing decision of the European Commission (EU) 2021/914 of 4 June 2021).

7. Data subject Rights and Right to lodge a Complaint

As a data subject whose personal data is processed, you have the right to

• to request information about your personal data processed by us in accordance with Art. 15 GDPR. In particular, you can request information about the purposes of processing, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the origin of your data if it was not collected by us, and the existence of automated decision-making including profiling and, if applicable, meaningful information about its details;
• in accordance with Art. 16 GDPR, to immediately request the correction of incorrect or incomplete personal data stored by us;
• in accordance with Art. 17 GDPR, to request the erasure of your personal data stored by us, unless the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defense of legal claims;
• in accordance with Art. 18 GDPR, to demand the restriction of the processing of your personal data if the accuracy of the data is disputed by you, the processing is unlawful, but you refuse to delete it and we no longer need the data, but you need it to assert, exercise or defend legal claims or you have lodged an objection to the processing in accordance with Art. 21 GDPR;
• in accordance with Art. 20 GDPR, to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format or to request its transmission to another controller; and
• to lodge a complaint with a supervisory authority in accordance with Art. 77 GDPR. As a rule, you can contact the supervisory authority of your usual place of residence or workplace or our place of business.

The supervisory authority responsible for our registered office is the

Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach
P.O. Box 1349, 91504 Ansbach
Phone: +49 (0) 981 180093-0
Fax: +49 (0) 981 180093-800
Email: poststelle@lda.bayern.de

To assert your rights as a data subject, with the exception of the right to lodge a complaint with the supervisory authority, simply send an email to hello@conelio.ai.

8. Right of Withdrawal for Data Processing based on Consent

If your personal data is processed on the basis of consent in accordance with Art. 6 para. 1 lit. a GDPR, you have the right to withdraw your consent at any time without giving reasons. As a result, we may no longer continue the data processing that was based on this consent in the future. However, the withdrawal of your consent does not affect the lawfulness of processing based on consent before its withdrawal.

If you wish to exercise your right of withdrawal, simply send an email to hello@conelio.ai.

9. Right of Objection

If your personal data is processed on the basis of legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR, you have the right to object to the processing of your personal data in accordance with Art. 21 GDPR, provided there are reasons for this arising from your particular situation. If your objection is directed against direct advertising, you have a general right to object; no justification is required in these cases.

If you wish to exercise your right to object, simply send an email to hello@conelio.ai.

10. Data Security

We use suitable technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or unauthorised access by third parties. We continuously adapt our security measures in line with technological developments. We use the widespread SSL (Secure Socket Layer) method in conjunction with the highest level of encryption supported by your browser when you visit our Website. As a rule, this is 256-bit encryption. If your browser does not support 256-bit encryption, we use 128-bit v3 technology instead. You can recognise whether an individual page of our Website is transmitted in encrypted form by the closed display of the key or lock symbol in the lower status bar of your browser.

However, we would like to point out that data transmission over the Internet (e.g. when communicating by email) can have security gaps. Complete protection of data against access by third parties is not possible.

11. Updates and Changes of this Privacy Policy

This Privacy Policy is valid as of September 2026. Due to the further development of our Website and services or due to changed legal or official requirements, it may become necessary to change this Privacy Policy. You can access and print out the current Privacy Policy at any time.