tenac.io logo

Privacy Policy

This English version is provided for convenience. In case of doubt, the German version prevails.

1. Controller and Data Protection Officer

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

tenac.io GmbH
Kolonnenstrasse 8
10827 Berlin, Germany
Managing Director: Dr. Georg van Husen
Email: info@tenac.io
Phone: +1 (212) 252-2168
Commercial register: Amtsgericht Berlin-Charlottenburg, HRB 212146 B

External Data Protection Officer: Mathias Ottitsch, reachable at mathias.ottitsch@tenac.io or at the address above, marked “Data Protection Officer”.

2. General Information on Data Processing

We process personal data only where this is necessary to provide a functioning website, our content and services, or where you have given your consent.

Legal bases. Depending on the purpose, we rely on:

  • Art. 6(1)(a) GDPR (consent): statistics (Jetpack Stats). You can withdraw your consent at any time with effect for the future.
  • Art. 6(1)(b) GDPR (contract or pre-contractual measures): demo requests and enquiries about our services.
  • Art. 6(1)(c) GDPR (legal obligation): statutory retention obligations, e.g. under commercial and tax law.
  • Art. 6(1)(f) GDPR (legitimate interest): secure and stable operation of the website, general enquiries.
  • Section 25 TDDDG (German Telecommunications Digital Services Data Protection Act): storing and accessing information on your device with your consent (para. 1) or where technically necessary (para. 2).

Retention. We delete data as soon as the purpose no longer applies and no statutory retention periods prevent deletion. Specific periods are stated for each service below.

Recipients. We only share data with service providers who process it on our behalf (processors under Art. 28 GDPR) or where we are legally required to do so. We do not sell data.

Transfers to third countries. Some services (Jetpack/WordPress.com, see section 5) also process data in the USA. Such transfers are based on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR), where the provider is certified, and additionally on Standard Contractual Clauses (Art. 46 GDPR).

3. Hosting and Server Log Files

This website is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. IONOS processes data on our behalf on servers in the EU; a data processing agreement is in place with IONOS.

Each time the website is accessed, the server automatically stores information transmitted by your browser:

  • IP address
  • date and time of access
  • page or file requested and amount of data transferred
  • referrer URL (the previously visited page)
  • browser type, browser version and operating system

We need this data to deliver the website, ensure its security and fend off attacks. The legal basis is Art. 6(1)(f) GDPR. Log files are deleted after no more than 7 days unless they are needed longer to investigate a security incident.

To speed up delivery, we use the IONOS page cache (IONOS Performance). No additional personal data is collected in the process.

4. Cookies and Consent Management (CookieYes)

Cookies and similar technologies (e.g. your browser’s local storage) store small amounts of data on your device. We set technically necessary ones without consent (Section 25(2) TDDDG); all others only if you agree in the cookie banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).

Technically necessary are:

  • cookieyes-consent (1 year): stores your choice in the cookie banner so that it does not reappear on every visit.
  • elementor (local storage): used by the Elementor page builder to display the website correctly.
  • wpEmojiSettingsSupports (session storage): used by WordPress to check whether your browser can display emojis.

We provide the cookie banner with the WordPress plugin CookieYes. Your choice is stored on our server; the plugin is not connected to the CookieYes online service. The legal basis for documenting your consent is Art. 6(1)(c) GDPR in conjunction with Section 25 TDDDG.

You can change or withdraw your consent at any time via the icon at the bottom left of every page. You can also delete or block cookies in your browser settings; some features of the website may then be limited.

5. Jetpack / WordPress.com

We use the Jetpack plugin provided by Aut O’Mattic A8C Ireland Ltd., Business Centre, No.1 Lower Mayor Street, International Financial Services Centre, Dublin 1, Ireland, whose parent company is Automattic Inc. in the USA. Data may be transferred to the USA in the process (see section 2). Provider’s privacy policy: automattic.com/privacy.

  • Statistics (Jetpack Stats): Only if you consent to the “Analytics” category in the cookie banner is a tracking pixel loaded from stats.wp.com. It processes your IP address (truncated or hashed), the page viewed, referrer, browser and time, from which anonymous visitor statistics are created. Legal basis: consent, Art. 6(1)(a) GDPR. Automattic retains this data in personally identifiable form for up to 28 days and only in aggregated form thereafter.
  • Image and file CDN (Site Accelerator): Images, scripts and stylesheets are delivered via the servers i0.wp.com and c0.wp.com, which transmits your IP address to Automattic. Legal basis: legitimate interest in fast loading times, Art. 6(1)(f) GDPR.
  • Brute-force protection: For login attempts to the administration area, the IP address is checked and blocked after repeated failed attempts. Legal basis: legitimate interest in security, Art. 6(1)(f) GDPR.

6. Fonts, Forms and Contact

Fonts. The “Montserrat” font is stored locally on our server. No connection to Google or other font providers is established when you visit the website.

Contact form. If you write to us via the contact form, we process your name, email address and message in order to answer your enquiry. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in responding) or Art. 6(1)(b) GDPR if your enquiry relates to a contract.

Demo request. Via the “Request demo” form we process your name, email address, institution and message in order to arrange a product demonstration. The legal basis is Art. 6(1)(b) GDPR.

Form submissions are forwarded to us by email and additionally stored in our website’s database. The IP address recorded with a submission is anonymised after 30 days. We delete submissions once your enquiry has been fully dealt with, and at the latest after 12 months, unless statutory retention obligations apply.

Contact by email or phone. If you contact us directly, we process your details to handle your enquiry (Art. 6(1)(b) or (f) GDPR).

7. Further Information and Your Rights

External links. Our website links to third-party sites, e.g. the American Heart Association or scientific publications. Data is only transferred to the respective provider when you click a link; that provider is responsible for its own processing.

Job applications. We process applications sent to us by email in order to carry out the application process (Section 26 BDSG, Art. 6(1)(b) GDPR). We delete application documents 6 months after the process has ended unless you have agreed to longer storage.

Your rights. You have the right at any time to:

  • access the data we hold about you (Art. 15 GDPR)
  • rectification of inaccurate data (Art. 16 GDPR)
  • erasure (Art. 17 GDPR)
  • restriction of processing (Art. 18 GDPR)
  • data portability (Art. 20 GDPR)
  • withdraw consent with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR). Where we process data on the basis of a legitimate interest, you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we demonstrate compelling legitimate grounds.

To exercise your rights, simply send an email to info@tenac.io or to our Data Protection Officer.

Right to lodge a complaint. You may lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, Germany.

Changes. We update this privacy policy when our website or the legal situation changes. The version published here applies.

Last updated: October 2026