Privacy notice

1. Who is responsible and how to contact us

Breakout Labs UG (haftungsbeschränkt), trading as BreakoutAI, is responsible for the website and our own business communications. You can contact us using the details below.

2. Visiting the website

Our hosting provider, Vercel Inc., delivers the website and helps protect it against faults and misuse. Handling a request involves technical information such as your IP address, the requested URL, the date and time, browser and device information, response status and, where sent by your browser, the referring website. Technical logs can be used to diagnose errors and investigate security incidents.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are making the website available, maintaining its reliability and protecting it and its visitors against misuse. Technical request information is needed to deliver the pages to your device.

Images, videos and fonts on this website are delivered from our own website address. The site does not embed the Google Calendar booking interface or load advertising or visitor-analytics scripts. Information about Vercel’s processing is available in its data processing terms and privacy notice.

3. Cookies and information on your device

This website does not set advertising or analytics cookies and does not use browser local storage or session storage to track visitors. Your browser may keep ordinary cached copies of website files.

For the local video and page layout, the site reads screen size, your reduced-motion preference and, where supported, connection and data-saving settings. These are used in your browser to adapt presentation and avoid unnecessary video downloads; the website does not send these readings to us as an analytics record.

Necessary storage or access for transmission or a service you have expressly requested is covered by the exceptions in section 25(2) TDDDG. Any future optional technology requiring consent must be explained and enabled only after that consent is obtained.

4. Email, telephone and business enquiries

When you contact us, we process the information you provide, such as your name, work contact details, organisation, role, message and relevant correspondence. We use it to answer your questions, discuss a possible engagement and manage the business relationship. Our business email is handled through Google Workspace.

We also record contact details, correspondence, appointment information and follow-up notes in Breakout Hub, our internal customer relationship management system, so we can keep track of the enquiry and our replies. This includes copies of email and calendar information in a database on our own computer and associated local backups.

For people contacting us on behalf of a company, the legal basis is Article 6(1)(f) GDPR: our legitimate interest in responding to enquiries and communicating with business customers. Where you personally are the prospective or existing contracting party, Article 6(1)(b) GDPR applies to steps you request before a contract and to performing it. Statutory record-keeping obligations are based on Article 6(1)(c) GDPR.

Contacting us is voluntary. We need enough information to understand and answer your enquiry; without a usable reply channel, we cannot respond. Please send only information relevant to your enquiry.

5. Booking a demo with Google Calendar

Our booking buttons are ordinary links to an appointment page hosted by Google. Clicking a button opens Google Calendar in a new tab. Google then receives your connection information; your browser may also send this website’s origin as the referring site. Google’s own page and any Google account you use are subject to Google’s privacy information.

When you complete a booking, we receive your first name, last name, email address and appointment details, including the selected date, time and time zone. We use these to arrange the meeting, send appointment communications and respond to the business enquiry. Google Workspace provides the calendar and email services, and relevant details are also kept in Breakout Hub. The legal bases are the same as for business enquiries above.

You can contact us by email or telephone instead of using Google Calendar. Any fields marked as required by the booking form are needed to complete that booking; additional information is voluntary unless the form says otherwise.

6. Recipients and international processing

Information is available to the people handling your enquiry or request and to providers supporting website delivery, communications and business administration. Vercel provides website hosting; Google Workspace provides our business email and calendar. Professional advisers and authorities may receive information where necessary for an engagement, legal advice or a legal obligation.

Vercel and Google use international infrastructure and service providers, including in the United States. Processing is not limited to Germany or the European Economic Area. Their published processing terms provide for international-transfer safeguards, including the European Commission’s Standard Contractual Clauses, and reliance on applicable adequacy frameworks where the recipient and transfer are covered.

See the Vercel data processing terms and the Google Workspace data processing terms. You can contact us for information about the safeguards applicable to your information and how to obtain a copy.

7. How long information is kept

Our retention policy takes effect on 15 September 2026. We are introducing the corresponding review and cleanup process, including for existing records. The following rules distinguish ordinary enquiry data from information that must be kept for a specific legal reason:

• Website technical information: the hosting service’s applicable log and security retention settings determine how long technical records remain available. Records needed to investigate a specific fault or security incident may be retained until that investigation and any related legal requirements are resolved.
• Enquiries: ordinary enquiries that do not lead to an engagement have a six-month retention limit after the last meaningful contact. Automated synchronisation or an unanswered follow-up does not restart this period. Information needed for an ongoing business relationship is kept while that need continues. The same limits apply to matching Breakout Hub records, subject to the legal exceptions below.
• Appointment information: ordinary calendar booking entries have a 90-day limit after the meeting takes place or is cancelled. Information needed for an ongoing enquiry follows the enquiry period above. Specific appointment evidence is kept longer only where needed for a contract, legal obligation or identifiable claim.
• Business records: statutory retention applies to qualifying documents, rather than every enquiry. Under German commercial and tax law, this generally means six years for commercial correspondence, eight years for accounting vouchers and ten years for books and annual financial statements, calculated from the relevant statutory year-end. A legal hold or other applicable rule can require longer retention.
• Privacy requests: a minimal record of the request and our response is kept for up to three years after the end of the year in which the request is closed, where necessary to demonstrate compliance or address related claims. Additional identity-verification material is removed once verification is complete unless a specific legal reason requires its retention.

These are maximum periods, not a reason to keep information after it is no longer needed or to postpone a valid erasure request. The rules also apply to copies under our control. If a legal obligation or a specific unresolved claim requires continued retention, use is limited to that purpose. Provider recovery and backup copies follow the applicable provider deletion processes and may not disappear at the same time as an active record. You can ask us which retention criteria apply to your information.

8. Candidate-related requests

BreakoutAI carries out candidate research for individual client projects. The organisation responsible for a particular use of candidate information depends on who determines its purposes and essential means. This website notice is not a substitute for the information relating to that specific recruitment project.

If you have a question about a candidate profile or want to exercise your rights, contact kapil@breakoutai.de. Where you know it, include the client or project concerned so we can identify the relevant processing. Please do not send an identity document unless we explain why additional verification is necessary.

Where we process information on a client’s documented instructions, we assist that client with the request and route it to the responsible organisation where appropriate. We answer requests relating to processing for which we ourselves are responsible. Any request correspondence we handle is processed to respond to you and meet our legal obligations, under Article 6(1)(c) GDPR where those obligations apply, and otherwise under Article 6(1)(f) GDPR for our legitimate interest in handling the request.

9. Your rights

Depending on the applicable legal conditions, you can ask for access to your personal information, correction, deletion, restriction of processing and a portable copy of information processed by automated means on the basis of consent or a contract.

You can object to processing based on legitimate interests for reasons relating to your particular situation. You can object to processing for direct marketing at any time. Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal.

Contact us using the details above. We normally respond within one month. If the law permits an extension because of the complexity or number of requests, we will explain this within that first month. We may ask for proportionate information to verify your identity if we have reasonable doubts.

You can complain to a data protection supervisory authority, particularly in the country where you live or work or where the alleged infringement occurred. For our establishment in Baden-Württemberg, you can contact the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg.

10. Automated decisions and changes to this notice

Visiting this marketing website, contacting us or booking a demo does not involve a decision based solely on automated processing that produces legal or similarly significant effects on you. Information about candidate evaluation in a recruitment project belongs in that project’s applicable notice.

We update this notice when the website or the processing described here changes. The date at the top identifies this version.