Privacy Policy

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Zuhair Shalabi
Studio One
Neumarkt 5
42103 Wuppertal
Germany

Email: info@mosaicconnect.io

This Privacy Policy applies to the websites mosaicconnect.io and alkudaimi.io, insofar as the processing operations described below take place on the respective website.

Not every function described is available on both websites. In particular, the registration, communication and application functions offered may differ.

We process personal data exclusively within the framework of the applicable data protection regulations, in particular the GDPR and the German Federal Data Protection Act (BDSG).

Personal data is information relating to an identified or identifiable natural person. This includes, for example, names, email addresses, telephone numbers, IP addresses, account data and the content of messages.

Depending on the processing operation, we base the processing on the following legal bases:

• Art. 6(1)(a) GDPR: consent of the data subject.
• Art. 6(1)(b) GDPR: performance of a contract or implementation of pre-contractual measures.
• Art. 6(1)(c) GDPR: compliance with a legal obligation.
• Art. 6(1)(f) GDPR: protection of legitimate interests, unless overriding interests or fundamental rights of the data subject prevail.

The applicable legal basis in each case is explained below.

Our websites and the associated technical systems are operated using services provided by Hostinger.

These include in particular web hosting, virtual private servers (VPS), databases and email services.

When our websites are accessed, the following data in particular may be processed:

• IP address
• date and time of access
• pages visited and files requested
• browser type and browser version
• operating system
• referrer URL, if transmitted
• technical status and error data

This processing serves to provide the websites, to ensure their functionality and to detect and defend against technical faults and security attacks.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and reliable operation of our websites.

Technical log data is only stored for as long as is necessary for the purposes stated. Where legal obligations or specific security incidents require longer retention, a different storage period may apply.

To protect our websites and to improve their availability and performance, we use services provided by Cloudflare.

These include in particular:

• Content Delivery Network (CDN)
• Web Application Firewall (WAF)
• detection of and defence against automated access
• protection against attacks and misuse

When these services are used, technical connection data, in particular IP addresses, request information, browser and device data and security-relevant characteristics, may be processed by Cloudflare.

The processing serves to defend against attacks and to operate our websites securely.

Legal basis: Art. 6(1)(f) GDPR.

In the course of providing the services, personal data may be processed outside the European Union or the European Economic Area. Where necessary, appropriate data protection safeguards must be in place for this.

Cloudflare provides further information in its privacy policy:
https://www.cloudflare.com/privacypolicy/

User accounts can be created on mosaicconnect.io.

In the course of registration and use of the account, the following data in particular may be processed:

• name
• email address
• telephone number
• company name
• industry
• company website address
• login credentials and technical account information

The data is used to set up and manage the user account, for authentication and to provide the functions offered.

Passwords are not stored as directly readable plain text but are protected using secure hashing methods.

Legal basis: Art. 6(1)(b) GDPR, insofar as the processing is necessary for the use of the account or contractual services. Security-related processing may additionally be based on Art. 6(1)(f) GDPR.

Account data is generally processed for the duration of the existing user account, insofar as it continues to be necessary.

After twelve months of inactivity, a review is planned to determine whether certain data is still needed. This does not automatically result in the complete deletion of the account after twelve months.

After an account has been deleted, personal data is deleted unless statutory retention obligations or other lawful reasons for further storage exist.

If you contact us via a contact form or by email, we process the information you provide.

This may include in particular:

• name and contact details
• company information
• content of the enquiry
• any attachments submitted
• time and technical information about the transmission

The processing is carried out to handle your enquiry and for further communication.

Legal basis: Art. 6(1)(b) GDPR for contract-related or pre-contractual enquiries. In other cases, Art. 6(1)(f) GDPR based on our legitimate interest in the proper handling of incoming enquiries.

We use services provided by Hostinger for our email communication.

Contact enquiries are generally retained for up to six months after processing has been completed, unless longer storage is necessary for the performance of a contract, legal defence or due to statutory obligations.

Insofar as we offer online appointment scheduling, we process the data required for this, for example:

• name
• email address
• telephone number, if applicable
• requested appointment
• other information provided voluntarily

Appointments are managed using our own solution operated on our hosting infrastructure.

Legal basis: Art. 6(1)(b) GDPR for contract-related appointments; otherwise Art. 6(1)(f) GDPR.

Appointment-related data is generally stored for up to six months after the respective process has been completed, unless longer statutory or contractual retention reasons exist.

AI-powered chatbots and digital assistants may be provided on our websites.

These functions enable users to ask questions, retrieve information and receive support with certain tasks.

8.1 Data Processed

When these functions are used, the following data in particular may be processed:

• messages and questions entered
• content of the previous conversation history
• personal data provided voluntarily, if any
• technical session and connection information
• for logged-in users, where applicable, the account information required to assign the conversation

Please do not enter any sensitive personal data or confidential information of third parties in chatbots unless this is necessary for your enquiry and legally permissible.

8.2 Technical Processing

To technically control chatbot processes, we use, among other things, n8n on a self-operated VPS within our hosting infrastructure.

For the AI-supported processing of chat messages, we also use the Google Gemini API.

In this context, messages entered and relevant parts of the previous conversation history may be transmitted to the Google Gemini API so that a response can be generated.

Even though we do not separately attach names, telephone numbers or email addresses to the API, such information may be part of the messages entered by the user.

Processing via Google Gemini concerns the chatbot functions intended for this purpose. It does not mean that all personal data stored on our websites is automatically transferred to Google.

8.3 Purposes and Legal Bases

The processing is carried out to provide the chatbot functions requested by the user, to handle their questions and to technically ensure operation.

Legal basis: Art. 6(1)(b) GDPR, insofar as the use is part of a contractual service or pre-contractual enquiry. In other cases, Art. 6(1)(f) GDPR may apply, provided that the necessary balancing of interests supports this. Insofar as a particular processing operation requires consent, it is carried out on the basis of Art. 6(1)(a) GDPR.

8.4 Storage Period

The following retention periods are planned for chat histories:

• guest users: generally 30 days
• registered users: generally 60 days

The data is then to be deleted unless there are legal reasons for longer storage.

Any longer retention of individual information that may be necessary, for example to handle a specific contractual or legal case, remains reserved.

8.5 Notes on AI-Generated Content

Responses from AI systems are generated automatically and may be incomplete or incorrect.

The use of an AI chatbot does not mean that decisions with legal or similarly significant effects on users are made exclusively by automated means.

We may use information from customer enquiries, user accounts and business communication to understand the respective needs, to assign enquiries and to offer suitable services.

Insofar as the processing is necessary to handle an enquiry or to carry out pre-contractual measures or a contract, it is carried out on the basis of Art. 6(1)(b) GDPR.

Any further analysis of chat histories for personalised advertising is only carried out if valid separate consent has been given for this.

The use of our services is not made dependent on voluntary consent to additional marketing measures.

If you have expressly consented to receiving promotional emails, we may use your email address to send you information about our offers and services.

Legal basis: Art. 6(1)(a) GDPR.

Consent is voluntary and can be withdrawn at any time with effect for the future.

To do so, you can use the unsubscribe link in a corresponding email or contact us at info@mosaicconnect.io.

As proof of consent given, we may store in particular the time, content and technical evidence of the consent, insofar as this is legally required.

Withdrawal does not affect the lawfulness of the processing carried out up to that point.

If you apply to us, we process the personal data submitted as part of your application.

This may include in particular:

• name and contact details
• CV
• professional qualifications and experience
• cover letter and references
• other application documents submitted voluntarily
• information from communication during the application process

Applications may be received via corresponding forms or by email.

The data may be stored within our systems operated at Hostinger, in particular in databases and email inboxes.

11.1 Purpose and Legal Basis

The processing is carried out to conduct the application process and to decide on the establishment of an employment relationship.

Legal basis: Art. 6(1)(b) GDPR in conjunction with the relevant provisions of employee data protection law, where applicable.

Insofar as application documents contain special categories of personal data within the meaning of Art. 9 GDPR, these are only processed if there is a corresponding legal basis for this.

11.2 AI-Supported Analysis

To support the handling of applications, CVs may be analysed using an AI model operated locally on our VPS.

This analysis may serve to structure information from application documents and to support the responsible persons in reviewing professional qualifications.

CVs are not transmitted to the Google Gemini API for this analysis.

The AI serves as a supporting tool. The final decision on an application is made by a responsible person.

No decision on hiring or rejecting an application is made exclusively by automated means.

11.3 Access and Storage Period

Only the controller and appropriately authorised persons have access to application documents, insofar as this is necessary to process the application.

In the event of a rejection, application data is generally deleted three months after the conclusion of the application process, unless longer retention is necessary in an individual case for the establishment, exercise or defence of legal claims.

Applicants are not permanently added to a talent pool for future vacancies.

In the course of our services, we may process project-related data, business contact details, communication content and other information necessary for the provision of services.

Legal basis: Art. 6(1)(b) GDPR, insofar as the processing is necessary for the performance of the contract.

After a project has been completed, we review which personal data is still required.

Data that is no longer required is deleted unless statutory retention obligations or legitimate reasons for further storage exist.

The relevant statutory retention periods apply to certain business documents, invoices and tax-relevant documents.

To ensure the availability and recoverability of our systems, we create regular data backups.

According to our planned backup concept, weekly backups are created and generally retained for a period of 30 days.

Personal data may therefore temporarily remain in technically secured backups after it has been deleted from the active system.

Access to backups is to be restricted to authorised persons. Data is only restored insofar as this is necessary for legitimate backup or recovery purposes.

We use fonts to display our websites consistently.

Insofar as Google Fonts are used, they are provided locally via our hosting infrastructure in accordance with our planned technical configuration.

With fully local integration, no direct connection between the browser and Google Fonts is required for the mere display of these fonts.

Our websites may contain links to external services, in particular to YouTube and Google Maps.

If you click on such a link, you leave our website and access the respective external service.

In doing so, the respective providers may process personal data, in particular technical connection data, in accordance with their own data protection provisions.

The respective operators are generally responsible for data processing on external websites.

Our websites may use cookies or comparable technologies insofar as these are necessary to provide certain functions, for example for session management, authentication or security.

Insofar as consent is required for storing information on end devices or accessing it, this is governed by the applicable statutory requirements, in particular Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG).

The subsequent processing of personal data is governed by the relevant provisions of the GDPR.

In the course of the processing operations described, personal data may be transmitted to or processed by the following categories of recipients in particular:

• hosting and infrastructure operators, in particular Hostinger
• security and network service providers, in particular Cloudflare
• AI service providers, in particular Google in connection with the use of the Gemini API for certain chatbot functions
• internally authorised persons, insofar as they need the data to perform their tasks
• authorities or other bodies, insofar as there is a legal obligation to disclose

We do not sell personal data to data brokers.

Insofar as external service providers process personal data on our behalf, this is done on the basis of the data protection agreements required in each case.

When certain external service providers are used, in particular internationally operating technology providers, personal data may be processed outside the European Union or the European Economic Area.

Such a transfer only takes place if the requirements of Art. 44 et seq. GDPR are met.

These may include in particular adequacy decisions of the European Commission, where applicable, or appropriate contractual safeguards.

The relevant transfer mechanisms in each case depend on the specific service provider, the agreed contractual terms and the actual technical processing.

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration and unlawful disclosure.

Depending on the system and processing, these include in particular:

• encrypted data transmission
• access restrictions and authorisation concepts
• protected user login
• secure storage of password hashes
• network and attack protection
• data backups
• technical maintenance and security updates

The protective measures are reviewed and adapted in line with technical requirements and existing risks.

Subject to the statutory requirements, you have in particular the following rights:

• access to the data processed about you pursuant to Art. 15 GDPR
• rectification of inaccurate data pursuant to Art. 16 GDPR
• erasure of personal data pursuant to Art. 17 GDPR
• restriction of processing pursuant to Art. 18 GDPR
• data portability pursuant to Art. 20 GDPR
• objection to certain processing pursuant to Art. 21 GDPR
• withdrawal of consent with effect for the future pursuant to Art. 7(3) GDPR

If personal data is processed on the basis of Art. 6(1)(f) GDPR, you may object to this processing on grounds relating to your particular situation.

If personal data is processed for direct marketing purposes, you may object to this processing at any time.

To exercise your rights, you can contact us:

info@mosaicconnect.io

A request for erasure may, insofar as technically and legally possible, relate to the data of a single user account or to several services operated by us.

Statutory retention obligations and other legally permissible restrictions remain unaffected.

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes the GDPR.

For the controller's registered office in North Rhine-Westphalia, the following authority in particular is competent:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)

Website: https://www.ldi.nrw.de/

Insofar as we use AI-supported systems, they serve in particular to process information, support users or prepare human decisions.

Exclusively automated decision-making within the meaning of Art. 22 GDPR that produces legal effects concerning data subjects or similarly significantly affects them is not provided for in the procedures described here.

In particular, decisions on hiring applicants are not made exclusively by an AI system.

We reserve the right to amend this Privacy Policy if our technical systems, services, legal obligations or data processing operations change.

The current version is published on mosaicconnect.io.

In the event of material changes to the processing of personal data, we will provide the necessary information in accordance with the statutory provisions.