Privacy Notice — ekipa VentureKit Demo

Version 1.0 | Juni 2026 | Demo Environment

English version — for reading purposes only, not legally binding. The binding German version is available at /demo-datenschutz.

This Privacy Notice explains what personal data ekipa GmbH processes when you access and use the ekipa VentureKit Demo Environment, the legal basis for such processing, and the rights available to you as a data subject. It is issued in accordance with Art. 13 of the General Data Protection Regulation (GDPR).

1. Controller

ekipa GmbH Münchener Straße 41, 60329 Frankfurt am Main Email: hello@ekipa.de | Website: ekipa.de

Data Protection Officer (external): IITR Datenschutz GmbH, Dr. Sebastian Kraska Email: data-protection@ekipa.de

Competent supervisory authority: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Wiesbaden, Germany.

2. Scope and purpose of this Demo Environment

The VentureKit Demo Environment is a standalone trial instance made available to prospective clients for evaluation purposes only. It contains exclusively synthetic, non-real demonstration data.

Important: The Demo Environment is not intended for the processing of real, productive or personal data beyond what is strictly necessary for account access. Users are explicitly requested not to enter real personal data, confidential business information, or sensitive content into the Demo Environment.

3. What personal data do we process?

Processing in the Demo Environment is limited to the minimum necessary for providing access:

3.1 Account data

Business email address (used as login identifier)
First and last name (optional, if provided upon registration)
Organisation name (optional)

3.2 Technical usage data

Login timestamps and session data
Interactions with platform features (page views, actions taken)
Technical device data (browser, operating system, IP address)

3.3 AI feature usage data

The Demo Environment includes an active AI-powered reporting feature. When the Demo User interacts with this feature (e.g. by entering prompts or generating reports), the following data is processed:

Prompt input entered by the Demo User
Platform data referenced by the AI feature (synthetic demonstration data only)
AI-generated output

This data is transmitted to Anthropic, Inc. (USA) for the purpose of processing the request. See Section 5 for details.

Important: The Demo User is explicitly requested not to enter real personal data, confidential business information or sensitive content into AI prompts. The AI feature accesses only data present in the Demo Environment workspace, which contains exclusively synthetic demonstration data.

4. Legal basis for processing

Processing of the above data is carried out on the basis of Art. 6(1)(f) GDPR (legitimate interest). ekipa's legitimate interest lies in providing a technically functional, personalised demonstration of VentureKit to prospective clients who have expressed interest in the platform. As processing is limited to a professional B2B context and confined to the minimum data necessary for account access, your fundamental rights and interests do not override this legitimate interest.

No contractual relationship is required or established by accessing the Demo Environment. Access does not constitute an agreement to any service contract or commercial commitment.

5. Recipients and processors

ekipa GmbH engages the following service providers for the operation of the Demo Environment. Data Processing Agreements (DPAs) have been concluded with all providers:

| Provider | Purpose | HQ | DPA | |---|---|---|---| | Convex, Inc. | Backend database, real-time sync, data storage | EU (Frankfurt) | Yes | | Hetzner Online GmbH | Web application hosting and server operations | Germany | Yes | | Mailjet SAS | Transactional emails (invitation and login link) | EU (France) | Yes |

The AI reporting feature of VentureKit (powered by Anthropic, Inc., USA) is active in the Demo Environment. When the Demo User interacts with the AI feature, prompt input and referenced workspace data are transmitted to Anthropic, Inc. for processing. This transfer is carried out on the basis of the EU–US Data Privacy Framework (DPF, adequacy decision of 10 July 2023) and additionally safeguarded by Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR and Anthropic's Data Processing Addendum. Anthropic expressly does not use API request data to train its AI models.

6. International data transfers

Convex, Hetzner and Mailjet process data exclusively within the European Union; no third-country transfers are required for these providers during standard Demo use.

For AI features (if activated): see Section 5 above.

7. Retention periods and deletion

Demo Environment data is retained only for the duration of the demo period and a brief administrative period thereafter:

| Data category | Retention period | |---|---| | User account (email, name) | 30 days after end of demo access | | Technical logs (login, session) | 30 days after end of demo access | | System/audit logs | 90 days |

Upon expiry, data is automatically and irreversibly deleted or anonymised. Deletion can be requested at any time via data-protection@ekipa.de.

8. Cookies

The Demo Environment uses only technically necessary cookies:

Session management (session cookie after login)
Authentication token (HttpOnly cookie, SHA-256-hashed)
CSRF protection

No tracking, advertising or analytics cookies are used. No cookie consent banner is required pursuant to § 25(2) TDDDG (Telecommunications Digital Services Data Protection Act, as amended December 2024).

9. Your rights as a data subject

Under the GDPR, you have the following rights:

Access (Art. 15 GDPR) — right to obtain information about data processed about you
Rectification (Art. 16 GDPR) — right to correct inaccurate or incomplete data
Erasure (Art. 17 GDPR) — right to request deletion (subject to legal retention obligations)
Restriction of processing (Art. 18 GDPR) — right to restrict processing under certain conditions
Objection (Art. 21 GDPR) — right to object to processing based on legitimate interest

To exercise your rights, please contact: data-protection@ekipa.de

You also have the right to lodge a complaint with the supervisory authority: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Wiesbaden, Germany.

10. Data security

ekipa GmbH implements appropriate technical and organisational measures (TOMs) to protect your data in accordance with Art. 32 GDPR, including encrypted data transmission (TLS), access controls, and regular security reviews. The Demo Environment is hosted on a separate domain from the productive VentureKit platform.

11. Changes to this Privacy Notice

ekipa GmbH reserves the right to update this Privacy Notice. The current version is always available at the Demo Environment login page. Material changes will be communicated by email.

12. Contact

General enquiries: hello@ekipa.de | ekipa GmbH, Münchener Straße 41, 60329 Frankfurt am Main

Data protection enquiries: data-protection@ekipa.de | IITR Datenschutz GmbH, Dr. Sebastian Kraska (external DPO)