Your data.
Your rights.

This notice explains the intended privacy arrangements for swarmalpha’s information service. Personal data are information relating to an identified or identifiable person. An IP address or an identifier that can be linked to a person may also be personal data.

The plain-language summary provides an introduction and complements this full notice. Separate services and external websites may have their own privacy notices. A link alone does not make an external operator our processor or automatically make us joint controllers.

RSQ Technology Ventures GmbH
Friedrich-Ebert-Straße 1
84164 Moosthenning
Germany

For privacy enquiries: privacy@rsq-technologies.com.

This is the central contact address for privacy questions and requests to exercise your rights.

Each processing activity needs a specific purpose and an appropriate legal basis. Technical delivery and the necessary security of the service rely on Article 6(1)(f) GDPR. The interests pursued are reliable operation, troubleshooting and the protection of our systems and users. Processing must be necessary, and the interests of the people concerned must be taken into account.

For enquiries, Article 6(1)(f) GDPR supports appropriate handling and communication. Where an enquiry concerns a contract with you or steps you request before entering into a contract, Article 6(1)(b) GDPR applies to processing necessary for that purpose.

Consent under Article 6(1)(a) GDPR covers only the specific purpose explained to you and chosen freely. Processing required by law relies on Article 6(1)(c) GDPR together with the relevant legal provision. Any proposed use for another purpose is assessed beforehand; where required, we provide separate information before that use begins.

Connecting to the website involves processing your IP address, the time of access, the address requested and technical request information. Depending on the server configuration, this may include browser and operating system information, response status and the referring page, where your browser sends it. These data arise from communication between your device and the technical infrastructure.

The purposes are to deliver the content requested, maintain availability and analyse technical faults. The legal basis is Article 6(1)(f) GDPR, pursuing the interests described in section 3. The connection data necessary to deliver a page must be transmitted; without them, the requested page cannot be provided.

Connection data are distinct from logs retained beyond the connection. Longer retention or linking them with other data requires a separate assessment of necessity.

If you contact us, we process the contact details you supply, your message and the communication data needed to handle it. These data come from you or from the communication you initiate. Please provide only information needed for your enquiry.

We use these details to handle and answer your request. General enquiries are covered by the legitimate interests described in section 3; Article 6(1)(b) GDPR may apply to specific contractual matters. Handling statutory data protection requests relies on Article 6(1)(c) GDPR in conjunction with Articles 12 to 22 GDPR.

Contacting us is voluntary. We may be unable to reply without a way to reach you or enough information about your request. You do not need to consent to advertising to receive a response. If there are reasonable doubts about your identity, we may request additional information necessary to handle a rights request. We do not routinely require an identity document.

Section 25 of Germany’s Telecommunications Digital Services Data Protection Act (TDDDG) applies to storing information on your device and accessing information already stored there. This includes cookies and comparable technologies. Your prior informed consent is generally required. An exception may apply, in particular, where the operation is strictly necessary to provide a digital service you have expressly requested.

The following settings are planned to minimise data use:

Scroll the table sideways if needed.

Any subsequent processing of personal data must also comply with the GDPR. Legitimate interests do not replace consent required under section 25 TDDDG. A cookie’s lifetime is also distinct from the retention period for server logs.

You can view and delete cookies in your browser. HttpOnly cookies cannot be read by ordinary page JavaScript. Deleting cookies may reset functions or settings and does not automatically withdraw consent previously given to a service.

Feedback and page ratings: If you submit feedback, the type of request selected, your message and a reference to the page concerned are sent to our server. A rating transmits the number of stars and the page reference. Technical connection data and necessary session data may accompany this.

The purpose is to handle your feedback and improve the service. Necessary processing of personal data relies on Article 6(1)(f) GDPR. Our interests are correcting errors and responding to specific user concerns. Providing input is voluntary. We cannot handle feedback you do not submit. Please avoid unnecessary personal or sensitive information.

The planned approach is to trigger personal rating retrieval and storage only when you use the feature. Results should be aggregated without a persistent user identifier wherever possible. Page references should not include unnecessary URL parameters or other personal identifiers. Section 6 also applies to device access requiring consent.

ONE.ID and external services: A link to ONE.ID at ayondo.one leads to a separate service. Any integrated sign-in or other additional service must explain its specific data flows before use. A link alone does not create a shared user account.

Images, logos and fonts: The planned approach is to serve these resources through our own documented infrastructure. This is intended to avoid additional automatic connections to external image or font providers.

Ordinary external links: Following such a link takes you away from our service. The external provider receives the connection data needed to load its website and any further information your browser sends. Its privacy notice applies to its own processing.

Embedded content: External charts, videos or scripts may transmit data to third parties as soon as they load. Additional external integrations must explain their purpose, recipients and legal basis before use and obtain any required consent. Server-side interfaces can also process personal data.

Cloudflare and our own security systems: We use Cloudflare and proprietary security solutions to prevent and counter misuse. Cloudflare is provided by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Security processing may include IP addresses, timestamps, technical request characteristics and security event data. The intended approach is to enable only necessary protection functions, minimise data categories and restrict access permissions. Our routine logs and incident evidence follow different retention rules; see section 12.

For more about the provider, see the Cloudflare privacy policy ↗.

Protection against unauthorised access, manipulation, malware and misuse helps keep the service secure and reliable. Where personal technical data are necessary for this, processing relies on Article 6(1)(f) GDPR. Its nature and scope must be proportionate to the specific risk. Security measures do not justify unlimited monitoring of users without cause.

Where there are specific indications of a security incident, the necessary technical logs may be analysed separately and retained temporarily as evidence. Analysis must be limited to the incident. Access is restricted to authorised people. Article 6(1)(f) GDPR may support processing necessary to establish, exercise or defend legal claims. Data are disclosed to authorities only on a valid legal basis in the particular case, such as a binding statutory obligation.

Data relating to criminal convictions and offences are also subject to Article 10 GDPR. A general security interest is not enough on its own. Special categories of personal data additionally require a condition under Article 9 GDPR. A technical anomaly does not, by itself, prove that a crime has occurred.

Absolute security cannot be guaranteed. Personal data breaches must be assessed and documented in accordance with the law. Where required, the competent authority and affected individuals are notified under Articles 33 and 34 GDPR.

Only authorised people and organisations that need personal data for the relevant purpose may access them. Technical service providers, for example for hosting or handling messages, may act as processors. Where Article 28 GDPR applies, an appropriate agreement is required.

Cloudflare is used as a security provider. Personal data processed by Cloudflare on our instructions must be distinguished from any independent network and security processing by the provider. See Cloudflare’s privacy information ↗ for details.

If several parties jointly determine the purposes and essential means of processing, Article 26 GDPR applies. Membership of a corporate group, network or project does not itself authorise data sharing.

Cloudflare may process data in the United States and other countries. We therefore do not make a blanket commitment to processing exclusively in Europe. Using a European data centre alone does not establish that all access and logs are confined to the European Economic Area (EEA).

Transfers of personal data outside the EEA must also meet the requirements of Articles 44 et seq. GDPR. Access from a third country may also be relevant.

Possible safeguards include an applicable adequacy decision by the European Commission or appropriate safeguards such as EU Standard Contractual Clauses. Where these clauses are used, the specific transfer circumstances and any necessary supplementary measures must be assessed. Simply naming contractual clauses does not establish an adequate level of protection.

You can ask our privacy contact for information and, where applicable, a copy of the relevant safeguards, subject to the rights of others.

The following deletion policy is planned for our own systems. These periods are upper limits for routine cases. If a purpose ends earlier, data should be deleted or effectively anonymised sooner.

Scroll the table sideways if needed.

Records subject to statutory retention duties and data needed to establish, exercise or defend specific legal claims must be handled separately. Only the data required for that purpose are retained. Such an exception does not extend the retention of all logs or messages.

These planned periods concern our own systems. They do not promise identical retention periods for every processing activity of external providers, particularly their independent processing. The relevant purposes, roles and privacy information apply to those activities.

Information about companies, events and markets may also include information about individuals, such as professional roles, authorship, quotations or publicly documented events. Publicly accessible personal data are not exempt from data protection requirements merely because they are public.

Collection from other sources must comply with Article 14 GDPR. This includes information about data categories, sources and any public availability, purpose, legal basis, recipients and retention. Statutory exceptions apply only where their conditions are met. A reference to a public source does not replace those conditions.

The intended approach is to disable optional tracking by default. Personal messages, inputs and security logs should be sent to external AI services only after a separate data protection assessment. Before such a service is used, its data flows must be explained and any required consent obtained.

Automated decisions under Article 22 GDPR are decisions based solely on automated processing that produce legal or similarly significant effects on a person. You generally have the right not to be subject to such a decision. Statutory exceptions exist. Where an exception based on a contract or your explicit consent lawfully applies, safeguards include at least human intervention on our part, the opportunity to express your point of view and the right to contest the decision.

Subject to the applicable legal conditions, you can exercise the following rights:

• Access (Article 15 GDPR): request information about processing and a copy of your personal data, taking account of the rights of others.
• Rectification (Article 16 GDPR): have inaccurate data corrected and incomplete data completed.
• Erasure (Article 17 GDPR): have data deleted unless a statutory exception applies, for example processing necessary to meet legal obligations or defend legal claims.
• Restriction (Article 18 GDPR): limit processing in the cases provided for by law.
• Data portability (Article 20 GDPR): receive data you have provided in a structured, commonly used, machine-readable format and, where applicable, have them transmitted directly. This applies where processing is automated and based on consent or a contract.
• Withdrawal of consent (Article 7(3) GDPR): withdraw consent at any time for the future. This does not affect the lawfulness of processing before withdrawal.

Contact privacy@rsq-technologies.com. We normally provide information about the action taken on your request within one month of receiving it. Where necessary because of the complexity or number of requests, that period may be extended by up to two further months. We will tell you about the extension and its reasons within the first month.

Exercising your rights is generally free of charge. Statutory exceptions, particularly for manifestly unfounded or excessive requests, remain applicable.

You can object to processing based on Article 6(1)(e) or (f) GDPR on grounds relating to your particular situation. This also applies to profiling based on those provisions.

We will then stop processing the data concerned unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

You can object to processing for direct marketing at any time without giving a reason. This also applies to profiling related to that marketing. The data concerned will no longer be processed for those purposes. This information does not mean that swarmalpha actually uses such advertising or profiling.

An informal message to privacy@rsq-technologies.com is sufficient.

If you believe that processing of your personal data infringes the GDPR, you can complain to a data protection supervisory authority under Article 77 GDPR. In particular, you may contact the authority where you habitually live, where you work or where the alleged infringement took place. You do not have to contact us first.

The authority generally responsible for private-sector organisations in Bavaria is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), the Bavarian State Office for Data Protection Supervision. Visitor address: Promenade 18, 91522 Ansbach, Germany. Postal address: Postfach 1349, 91504 Ansbach, Germany.

BayLDA complaint form (German) ↗
Contact details and secure communication options (German) ↗

This notice is updated when the service or legal requirements change. Where required by law, we provide information before processing data for a new purpose. Changing this notice or continuing to use the website does not replace any required consent.

Last updated: 5 November 2026. The summary reflects the same information.