DE Book a callBook a call

Privacy policy

This is a translation of the German privacy policy. In case of doubt, the German version applies.

Preamble

With this privacy policy we would like to inform you which types of your personal data (hereinafter also referred to as "data") we process, for which purposes and to what extent. The privacy policy applies to all processing of personal data carried out by us, both in the course of providing our services and, in particular, on our website and within external online presences, such as our social media profiles (hereinafter collectively referred to as "online offering").

The terms used are not gender-specific.

Last updated: 7 October 2026

Table of contents

Controller

OTA Precision Consulting LLC
75 E 3rd St
Sheridan, WY 82801
USA

Authorised representative: Leon Sternel
Email address: mail@vectrforce.com
Website: https://vectrforce.com/

Representative in the European Union (Art. 27 GDPR)

Because the controller is established outside the European Union but processes personal data of persons in the EU, a representative in the European Union has been designated in accordance with Art. 27 GDPR:

Sternel, Am Iderfenngraben 12, 13156 Berlin
Email address: mail@vectrforce.com

Data subjects can contact the EU representative directly to exercise their rights and for all data protection enquiries.

Note on the dual role (controller / processor)

We process personal data in two different roles:

  1. As controller (Art. 4(7) GDPR): for the data we collect in the course of our own business activities – in particular data of website visitors, prospects and our own customers. This privacy policy describes these processing operations.
  2. As processor (Art. 4(8) GDPR): for the data we process on behalf of our customers in the context of the software and automation solutions we provide (in particular VECTR). For this purpose we conclude a separate data processing agreement (DPA) with our customers. This privacy policy does not apply to such processing on behalf of customers.

Overview of processing operations

The following overview summarises the types of data processed and the purposes of their processing, and refers to the data subjects concerned.

Types of data processed

  • Master data
  • Payment data
  • Contact data
  • Content data
  • Contract data
  • Usage data
  • Meta, communication and procedural data
  • Image and/or video recordings
  • Audio recordings
  • Log data

Categories of data subjects

  • Service recipients and clients
  • Prospects
  • Communication partners
  • Users
  • Business and contractual partners
  • Persons depicted

Purposes of processing

  • Provision of contractual services and fulfilment of contractual obligations
  • Communication
  • Security measures
  • Office and organisational procedures
  • Appointment scheduling and management
  • Provision of the online offering and user-friendliness
  • Information technology infrastructure
  • Public relations
  • Business processes and management procedures

Relevant legal bases under the GDPR: The following is an overview of the legal bases of the GDPR on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection rules may apply in your country of residence or in ours. Where more specific legal bases are relevant in an individual case, we will inform you of them in the privacy policy.

  • Consent (Art. 6(1)(1)(a) GDPR): The data subject has given consent to the processing of personal data concerning them for a specific purpose or several specific purposes.
  • Performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR): The processing is necessary for the performance of a contract to which the data subject is a party, or for taking steps prior to entering into a contract at the request of the data subject.
  • Legal obligation (Art. 6(1)(1)(c) GDPR): The processing is necessary for compliance with a legal obligation to which the controller is subject.
  • Legitimate interests (Art. 6(1)(1)(f) GDPR): The processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests, fundamental rights and freedoms of the data subject which require protection of personal data.

National data protection rules in Germany: In addition to the data protection rules of the GDPR, national rules on data protection apply in Germany. These include in particular the Federal Data Protection Act (BDSG) and, for telecommunications and digital services, the Telecommunications Digital Services Data Protection Act (TDDDG).

Security measures

In accordance with legal requirements, and taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

These measures include in particular safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as access to, input, disclosure and availability of the data and their separation. We have also established procedures to ensure the exercise of data subject rights, the deletion of data and responses to data compromises. Furthermore, we take the protection of personal data into account already during the development or selection of hardware, software and procedures, in accordance with the principle of data protection by design and by default.

Securing online connections by TLS/SSL encryption (HTTPS): To protect the data of users transmitted via our online services against unauthorised access, we use TLS/SSL encryption. A website secured by an SSL/TLS certificate is indicated by HTTPS in the URL.

Transfer of personal data

In the course of processing personal data, it may happen that data is transmitted to or disclosed to other bodies, companies, legally independent organisational units or persons. Recipients of this data may include, for example, service providers commissioned with IT tasks. In such cases we comply with the legal requirements and in particular conclude corresponding contracts or agreements with the recipients of your data that serve to protect your data.

International data transfers

Data processing in third countries: As the controller itself is based in the USA, your data is regularly also processed in the USA. Where we transfer data to a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or where this happens in the context of the use of third-party services, this always takes place in accordance with legal requirements.

For data transfers to the USA we primarily rely on the EU-U.S. Data Privacy Framework (DPF), which was recognised as a secure legal framework by an adequacy decision of the EU Commission of 10 July 2023. In addition, we have concluded standard contractual clauses (SCCs) with the respective providers – insofar as they are not themselves DPF-certified, or as additional safeguards – which comply with the requirements of the EU Commission.

For each service provider, we inform you whether it is certified under the DPF and whether standard contractual clauses are in place. Further information on the DPF and a list of certified companies can be found on the website of the US Department of Commerce at https://www.dataprivacyframework.gov/ (in English).

General information on data storage and deletion

We delete personal data that we process in accordance with the statutory provisions as soon as the underlying consents are withdrawn or no further legal basis for the processing exists. This applies in cases where the original purpose of processing ceases to apply or the data is no longer needed. Exceptions apply where statutory obligations or special interests require longer retention or archiving of the data.

In particular, data that must be retained for commercial or tax law reasons, or whose storage is necessary for the pursuit of legal claims or to protect the rights of other natural or legal persons, must be archived accordingly.

Retention periods under German law (for business relationships with a connection to Germany):

  • 10 years – retention period for books and records, annual financial statements, inventories, management reports, opening balance sheets and the work instructions and other organisational documents necessary for understanding them (Section 147(1) no. 1 in conjunction with (3) of the German Fiscal Code (AO), Section 14b(1) of the German VAT Act (UStG), Section 257(1) no. 1 in conjunction with (4) of the German Commercial Code (HGB)).
  • 8 years – accounting vouchers, such as invoices and expense receipts (Section 147(1) nos. 4 and 4a in conjunction with (3) sentence 1 AO and Section 257(1) no. 4 in conjunction with (4) HGB).
  • 6 years – other business documents: received commercial or business letters and other documents relevant for taxation (Section 147(1) nos. 2, 3, 5 in conjunction with (3) AO, Section 257(1) nos. 2 and 3 in conjunction with (4) HGB).
  • 3 years – data for taking into account potential warranty and damage claims (Sections 195, 199 of the German Civil Code (BGB)).

Rights of data subjects

As a data subject, you have various rights under the GDPR, which arise in particular from Art. 15 to 21 GDPR:

  • Right to object: You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions. Where personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing.
  • Right to withdraw consent: You have the right to withdraw consent you have given at any time.
  • Right of access: You have the right to obtain confirmation as to whether data concerning you is being processed, and to obtain access to this data and further information and a copy of the data in accordance with the legal requirements.
  • Right to rectification: You have the right to have data concerning you completed or inaccurate data concerning you rectified.
  • Right to erasure and restriction of processing: You have the right to demand that data concerning you be deleted without undue delay or, alternatively, to demand restriction of the processing of the data.
  • Right to data portability: You have the right to receive data concerning you which you have provided to us in a structured, commonly used and machine-readable format, or to request its transmission to another controller.
  • Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, the supervisory authority of your place of work or of the place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR.

Business services

We process data of our contractual and business partners, e.g. customers and prospects (collectively referred to as "contractual partners"), in the context of contractual and comparable legal relationships and related measures, and with regard to communication with the contractual partners (or pre-contractually), for example to respond to enquiries.

We use this data to fulfil our contractual obligations. These include in particular the obligations to provide the agreed services (analysis, set-up, operation and support of software and automation solutions), any update obligations and remedies in the event of warranty and other performance disruptions.

  • Types of data processed: Master data (e.g. full name, address, contact information, customer number); payment data (e.g. bank details, invoices, payment history); contact data (e.g. postal and email addresses or telephone numbers); contract data (e.g. subject matter of the contract, term, customer category).
  • Data subjects: Service recipients and clients; prospects; business and contractual partners.
  • Purposes of processing: Provision of contractual services and fulfilment of contractual obligations; communication; office and organisational procedures; business processes and management procedures.
  • Retention and deletion: Deletion in accordance with the information in the section "General information on data storage and deletion".
  • Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR); legal obligation (Art. 6(1)(1)(c) GDPR); legitimate interests (Art. 6(1)(1)(f) GDPR).

Provision of the online offering and web hosting

We process users' data in order to be able to provide our online services to them. For this purpose we process the user's IP address, which is necessary to transmit the content and functions of our online services to the user's browser or device.

  • Types of data processed: Usage data; meta, communication and procedural data; log data.
  • Data subjects: Users (e.g. website visitors).
  • Purposes of processing: Provision of the online offering and user-friendliness; information technology infrastructure; security measures.
  • Legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR).

Further information on processing operations, procedures and services:

  • Vercel (web hosting): Our website is provided via the Vercel platform. When our website is accessed, technically necessary data (in particular the IP address, date and time, browser, operating system, referrer URL) is processed. Vercel delivers the content via a worldwide network of servers; processing may therefore also take place in the USA. Service provider: Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA; legal bases: legitimate interests (Art. 6(1)(1)(f) GDPR); website: https://vercel.com; privacy policy: https://vercel.com/legal/privacy-policy; data processing agreement: https://vercel.com/legal/dpa; basis for third-country transfers: EU-U.S. Data Privacy Framework (DPF) and standard contractual clauses (SCCs).
  • Collection of access data and log files: Access to our online offering is logged in the form of so-called "server log files". Server log files may include the address and name of the pages and files accessed, date and time of access, data volumes transferred, notification of successful access, browser type and version, the user's operating system, referrer URL (the previously visited page) and, as a rule, IP addresses and the requesting provider. The log files serve the security and stability of the offering; we do not evaluate them for analysis or marketing purposes. Legal bases: legitimate interests (Art. 6(1)(1)(f) GDPR); deletion of data: the runtime log files available to us are deleted automatically after 24 hours at most, depending on the plan. In addition, Vercel as the provider may process access data in accordance with its own privacy policy to ensure security and stability.
  • Fonts: The fonts used on our website are hosted locally on our server. No connection to the servers of font providers is established when the website is accessed.

No cookies, no web analytics, no tracking

Our website (vectrforce.com) uses no cookies and no comparable technologies that require consent. We use no web analytics services, no advertising or tracking pixels (e.g. from Google or Meta) and no remarketing. No user profiles are created. This also applies to the appointment booking, which takes place directly on our website.

If you choose a language or an appearance (light/dark) on our website, your browser may store this choice locally on your device so that it is retained the next time you visit. This information is not transmitted to us. The storage is strictly necessary for the service you have expressly requested (Section 25(2) no. 2 TDDDG) and can be deleted at any time via your browser settings.

Appointment booking, contact and inquiry management

When you contact us (e.g. via appointment booking, email, telephone or social media), and in the context of existing user and business relationships, the information provided by the enquiring persons is processed to the extent necessary to respond to the contact enquiries and any measures requested.

  • Types of data processed: Master data; contact data; content data; usage data; meta, communication and procedural data.
  • Data subjects: Communication partners; prospects; users.
  • Purposes of processing: Communication; appointment scheduling and management; organisational and administrative procedures; office and organisational procedures.
  • Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR); legitimate interests (Art. 6(1)(1)(f) GDPR).

Further information on processing operations, procedures and services:

  • Appointment booking on our website: If you arrange a call via our website, you first answer a few questions about your business (e.g. company size, way of working, role), choose a free time slot and enter your name, email address and company. Your answers are held only in your browser until you submit and are not stored; if you cancel beforehand, nothing is transmitted to us. To show free time slots, your browser queries the available times via our website; no personal data is transmitted in the process. When you submit, your details are transmitted via a server function of our host Vercel (see "Provision of the online offering and web hosting") to our CRM GoHighLevel; there we create a contact with your answers and book the appointment. We process these details to schedule the appointment, send you confirmations and reminders, generate the link to the video conference (Google Meet) and prepare the call. The details about your company are required for preparation; the information about what your business does is voluntary. No cookies are set on our website during booking and no third-party services are loaded in the browser. Legal bases: performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR); legitimate interests (Art. 6(1)(1)(f) GDPR) in efficient preparation of the call. Service provider and third-country transfer: see section "Customer relationship management (CRM)".
  • Email and telephone: When you contact us by email or telephone, we process the personal data transmitted to us in order to respond to and handle the respective enquiry.

Customer relationship management (CRM)

We use the GoHighLevel platform (HighLevel Inc., USA) to manage customer relationships and enquiries, to schedule appointments and to send appointment emails. In this context, personal data of prospects and customers is processed centrally, stored and linked to our business processes.

The data processed includes in particular: name, email address, telephone number, company, address, communication history (email, SMS, telephone calls where applicable), appointment and booking data as well as form entries.

  • Types of data processed: Master data; contact data; content data; contract data; meta, communication and procedural data.
  • Data subjects: Prospects; service recipients and clients; communication partners.
  • Purposes of processing: Provision of contractual services; communication; appointment scheduling and management; office and organisational procedures.
  • Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR); legitimate interests (Art. 6(1)(1)(f) GDPR); consent (Art. 6(1)(1)(a) GDPR), where required.

Service provider and third-country transfer:

Video conferences and online meetings

For calls arranged via our website we use platforms of other providers (hereinafter "conference platforms") to conduct video and audio conferences.

As part of participation, the conference platforms typically process the following data: name, contact information (email address, telephone number), access data, profile pictures, information on professional position/function, IP address, device information, content of the communication (chat, audio, video) and use of further functions.

Logging and recordings: Conversations are only recorded or logged if we inform the participants transparently in advance and – where required – obtain their consent.

  • Types of data processed: Master data; contact data; content data; usage data; image and/or video recordings; audio recordings; log data.
  • Data subjects: Communication partners; users; persons depicted.
  • Purposes of processing: Provision of contractual services; communication; office and organisational procedures.
  • Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1)(1)(b) GDPR); legitimate interests (Art. 6(1)(1)(f) GDPR); where applicable, consent (Art. 6(1)(1)(a) GDPR).

Service used:

Presences in social networks (social media)

We maintain online presences within social networks and process user data in this context in order to communicate with the users active there or to offer information about us. Our website contains only simple links to these presences; no data is transmitted to the networks when our website is accessed.

We point out that user data may be processed outside the European Union. This may result in risks for users because, for example, the enforcement of users' rights could be made more difficult. Furthermore, user data within social networks is generally processed for market research and advertising purposes.

  • Types of data processed: Contact data; content data; usage data.
  • Data subjects: Users.
  • Purposes of processing: Communication; feedback; public relations.
  • Legal bases: Legitimate interests (Art. 6(1)(1)(f) GDPR).

Further information on processing operations, procedures and services:

Changes and updates

We ask you to inform yourself regularly about the content of our privacy policy. We adapt the privacy policy as soon as changes to the data processing we carry out make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g. consent) or other individual notification.

Where we provide addresses and contact information of companies and organisations in this privacy policy, please note that addresses may change over time, and we ask you to check the information before making contact.

Definitions

This section provides an overview of the terms used in this privacy policy. Where the terms are defined by law, the legal definitions apply.

  • Personal data: Any information relating to an identified or identifiable natural person (Art. 4(1) GDPR).
  • Master data: Essential information necessary for the identification and management of contractual partners, user accounts, profiles and similar assignments (e.g. name, address, contact information, user IDs).
  • Content data: Information generated in the course of creating, editing and publishing content (texts, images, videos, audio files, metadata).
  • Contact data: Information that enables communication with persons or organisations (telephone numbers, postal addresses, email addresses, social media handles).
  • Meta, communication and procedural data: Information on the manner of data processing (e.g. IP addresses, timestamps, identification numbers, communication channels).
  • Usage data: Information that records how users interact with digital products or services (e.g. page views, functions used).
  • Log data: Information about events or activities logged in a system or network (timestamps, IP addresses, user actions, error messages).
  • Controller: The natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data (Art. 4(7) GDPR).
  • Processing: Any operation or set of operations performed on personal data, whether or not by automated means (Art. 4(2) GDPR).
  • Contract data: Information relating to the formalisation of an agreement between two or more parties (subject matter, term, conditions).
  • Payment data: Information for the processing of payment transactions (bank details, credit card numbers, payment amounts, transaction data).