Privacy Policy

Privacy Policy

Last updated: 12 October 2026

1. Data protection at a glance

The following notes give you a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally.

2. Controller

The controller responsible for data processing on this website and for the offerings at evnxt.de described in section 10 is:

Wojcik Beratungs und Beteiligungs UG (haftungsbeschränkt)
represented by the managing director Dominik Wojcik
Schönhauser Allee 169a
10435 Berlin
Phone: +49 160 5 29 27 25
Email: dominik [at] wojcik [punkt] de

3. Data collection on this website

Server log files: The provider of the pages automatically collects and stores information in so-called server log files, which your browser transmits to us automatically (browser type and version, operating system used, referrer URL, host name of the accessing computer, time of the server request, IP address). This data is not merged with other data sources. The collection is based on Art. 6 (1)(f) GDPR.

Contact form: If you send us inquiries via the contact form, the details from the form, including the contact details you provide there, are stored by us for the purpose of processing the inquiry and in case of follow-up questions. We do not pass this data on without your consent (Art. 6 (1)(b) GDPR).

4. Embedded third-party content

Spotify: The Spotify player is embedded on the podcast page. When the player loads, data (including your IP address) is transmitted to Spotify AB, Sweden. You can find more information in the Spotify privacy policy.

YouTube: Video previews are loaded on the server side; you only reach YouTube (Google Ireland Limited) when you click on a video. Google's privacy policy applies.

5. Your rights

You have the right at any time to receive information free of charge about your stored personal data, its origin and recipients, and the purpose of the processing (Art. 15 GDPR), as well as the right to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent you have given at any time with effect for the future (Art. 7 (3)).

Right to object: If the processing is based on Art. 6 (1)(f) GDPR, you can object to it at any time on grounds relating to your particular situation (Art. 21 (1) GDPR). We will then no longer process the data, unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defense of legal claims. If your data is processed for direct marketing, you can object to this at any time (Art. 21 (2) GDPR).

To exercise your rights and for questions about data protection, please contact dominik [at] wojcik [punkt] de. You also have the right to lodge a complaint with a data protection supervisory authority; the authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin.

6. SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, this site uses SSL/TLS encryption.

7. Newsletter (double opt-in)

To send our newsletter, we use the so-called double opt-in procedure: after you sign up, you receive an email with a confirmation link. You are only added to the mailing list after you click this link. The legal basis for the processing is your consent (Art. 6 (1)(a) GDPR).

We store your email address, the time of sign-up and confirmation, and the IP addresses used for both (as proof of consent). The newsletter is sent via the sender's mail server (newsletter@wojcik.de); it is not passed on to third parties.

You can unsubscribe from the newsletter at any time via the unsubscribe link at the end of each issue; this withdraws your consent. After you unsubscribe, your data is no longer used for sending the newsletter. On request, we will delete your data completely. Simply contact us for this.

8. Webinars: registration, participation and recording

Registration: To take part in a webinar, we store your email address, your display name, and the time of your registration and of your consent. You receive access through a personal access link by email; an account and a password are not required. The legal basis is Art. 6 (1)(b) GDPR (carrying out the event for which you registered).

During the event: You see and hear the presentation; your own camera and microphone are not transmitted. If you write in the chat, your display name and your message are visible to all participants. Chat messages are deleted 30 days after the end of the event.

Recording and presentation materials: After a webinar ends, we may provide a recording of the event and the presentation shown as a file. For this purpose, a video file of the event and a PDF file of the presentation are stored on a server of Hetzner Online GmbH in Germany. The recording is a capture of the event; it may contain spoken contributions, questions and chat messages from participants, including the display names shown with them. Only what was visible or audible to all participants during the event anyway is recorded; individual participants (camera, microphone) are not recorded. The recording is not made automatically: we record the event with our own program, review the file, and only then upload it.

Who can see the recording: only people who registered for this webinar, after logging in via their personal access link. There is no public address and no disclosure to third parties; the files are not published on video platforms. The recording can be watched on one device at a time; if the personal access is used on a second device, playback on the first device ends.

Storage period: The files are deleted automatically 365 days after upload. The personal access link from the notification email is valid for 30 days and can be used once; after that, or after it has been used, you can request a new link informally at any time, as long as the files are still stored. Your login on the server ends no later than 48 hours after you redeem the link.

Participation in the event: For each webinar, we record whether and for how long a registered person was present in the event room (first and last point in time and the total presence). We use this information exclusively internally to evaluate the event. It is not published, not passed on and not used for advertising, and it is deleted automatically 90 days after the event.

Emails about the event: For registration, reminders and the provision of the recording, you receive emails that relate exclusively to this event and contain no advertising. They are sent via the sender's mail server.

Objection: If you do not want your contribution to appear in the recording, please contact dominik [at] wojcik [punkt] de informally; the relevant section will be removed or the recording will be deleted. The same applies to the information about your participation.

9. Video conferences (meetings)

For meetings, we operate our own video conferencing system at wojcik.de/webinar/m/…. The video server runs on our own machine; no video conference provider is involved.

What is processed: your name in the form you enter yourself when joining, and your email address if we invited you; video and audio during the conversation, as long as the meeting is running; your chat messages, if you write any; technical connection data (time of joining, connection quality, IP address as seen by the server); and your audio track as a recording, only if you expressly agreed before joining.

Your video image is never recorded. The software is not capable of it: only microphone audio tracks are recorded; video tracks, and also the audio of a shared screen, are excluded.

Transcription and minutes: If you consent, your audio track is recorded separately from the others and converted to text. From this text, minutes are created with a summary, decisions, tasks, questions and facts. The conversion of audio to text takes place on our own server; your audio recording is not sent to anyone for this. The summary is created by a language model from Anthropic, operated via Amazon Bedrock in the Frankfurt am Main region. The text of the conversation is transmitted there, not the audio recording. Before every transmission, the software checks that the processing takes place in the EU, and it does not create the summary if this cannot be ensured. The data is not used there to train models.

Without consent, you take part as normal. Your audio track is then not recorded, and your name does not appear in the minutes. Taking part does not depend on your consent. The legal basis for recording, transcription and summary is Art. 6 (1)(a) GDPR (your consent); for carrying out the meeting itself, it is Art. 6 (1)(b) GDPR within the framework of a contract or its initiation, otherwise Art. 6 (1)(f) GDPR.

Withdrawal of consent: You can withdraw your consent at any time with effect for the future. The lawfulness of the processing carried out until then remains unaffected. Withdrawal is as easy as giving consent: in the meeting window via the "is being transcribed" notice in the header, or by message to dominik [at] wojcik [punkt] de. The ongoing recording of your voice then ends within a few seconds; you continue to take part in the conversation as normal.

Blurring the background: You can have your background blurred. This is voluntary and initially switched off. The calculation takes place exclusively in your browser: a model there detects in every camera frame where you can be seen and blurs the rest. For this detection, your camera image is not sent to anyone, not even to us. The program files and the model required for it load from our own server, and only when you switch blurring on; no connection to Google or other providers is made in the process. Your browser remembers your choice in its local storage so that it still applies at the next meeting; this entry is not transmitted to us and can be deleted in the browser settings. If blurring does not start or fails, the software switches your camera off instead of sending your image unfiltered. Blurring is not a guaranteed privacy screen, because background can remain recognizable around the edges of your body, with objects in your hand, with other people in the image or in poor lighting.

Who gets to see the data: Hetzner Online GmbH (Germany) operates the server on which the software runs and on which all data is stored. Amazon Web Services EMEA SARL creates the summary from the conversation text (Amazon Bedrock, Frankfurt am Main). ALL-INKL.COM - Neue Medien Münnich (Germany) sends the invitations and the minutes emails; with the latter, the transcript is attached as a file. All of them process exclusively on our behalf and within the European Union. No recipient is added for the blurring. Sharing the minutes: After the meeting, the host can send the summary and transcript to recipients named by the host, for example to all participants; they then receive the full transcript of the conversation.

How long data is stored: The audio recording is deleted one hour after successful conversion, and after 24 hours at the latest, even if the conversion fails. Transcript, summary, chat history and participant details are deleted 90 days after the meeting. If the host has expressly switched on an audio recording for a meeting, the same period of 90 days applies to it; even then, no video is recorded. Sent emails in the outbox, including attached transcripts, are deleted after 30 days, database backups after 7 days, and the log of administrative access after 180 days. If we delete data at your request, it may remain in the backups for up to seven more days until they are overwritten as scheduled.

What does not happen: No video image is recorded. Your data is not used to train AI models. No automated decision-making within the meaning of Art. 22 GDPR takes place: the summary is a reading aid, the transcript is authoritative, and every summary expressly points this out in its header. No data is transmitted to advertising networks or analytics services.

10. evnxt.de: application, inquiries, spam protection, cookies, sign-in with Google and Google connections

At evnxt.de we offer SEO services supported by AI agents. This section applies to the public pages of evnxt.de, the forms on those pages, sign-in with Google, and the connections to Google and other services in the evnxt application. The controller is the party named in section 2.

Application for beta access and inquiry about SEO support: On evnxt.de you can apply for beta access or make a non-binding inquiry about SEO support. For this we process your name and email address (required), and, if you provide them, your website and your message; on some forms also your company. In addition, we record the type of request (beta application or SEO support), the time of submission and your IP address. The information is stored in our database. We also send ourselves an email with your details (without the IP address), which we use to handle your request; we reply to you by email. This does not create an account or a newsletter subscription. The legal basis is Art. 6 (1)(b) GDPR (pre-contractual measures at your request or application). The IP address is stored on the basis of Art. 6 (1)(f) GDPR (our interest in tracing and preventing misuse of the forms).

Review of suspicious requests: If a message contains an unusually large number of links, the software flags the request for manual review and does not trigger an automatic notification; we look at it by hand. Nothing is rejected automatically as a result. No automated decision within the meaning of Art. 22 GDPR takes place.

Registration as a publisher, inquiry as an advertiser, portal preview and domain check: On evnxt.de you can also register as a publisher, make an inquiry as an advertiser, request a preview of your own topic portal, or check your domain. When you register as a publisher, we process your domain, your name, your email address, your topics and your interest (collaborations, topic portal or both) and, if you provide them, your price expectation and a message; if you want a topic portal, we create a draft for it and show you a link for setting it up. When you make an inquiry as an advertiser, we process your domain, your company, your name, your email address, your topics and goals and, if you provide them, your budget range and a message. For the portal preview, we process your domain and your email address and send you the link to the preview by email; the link is valid for 48 hours. We store this information in our customer management system and record the process in an activity log. For the domain check, we process only the domain you enter, retrieve its pages and keep the result in the cache for up to ten minutes. To protect against misuse, we limit the number of attempts per IP address on these forms; your IP address is kept in the cache for this purpose for one hour at most and is not stored together with your information. The legal basis is Art. 6 (1)(b) GDPR (pre-contractual measures at your request), and for the limit on attempts Art. 6 (1)(f) GDPR (our interest in preventing misuse).

Spam protection with Cloudflare Turnstile: The forms for the beta access application and the inquiry about SEO support are protected against automated access with Cloudflare Turnstile. Merely opening a page with a form does not load anything from Cloudflare. Your browser loads the Turnstile element from servers of Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA) only when you click into a form field or type something there, or when you submit a form without having used it beforehand. In doing so, Cloudflare receives your IP address, information about your browser (e.g. user agent) and the address of the page in which the element is embedded, and uses them to check whether a human is operating the form. When you submit the form, our server asks Cloudflare for the result of the check; we transmit only the verification token, neither your form entries nor your IP address. According to Cloudflare, it processes the data partly on our behalf and partly for its own purposes, in order to improve the detection of automated access. The transfer to the USA is based on the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework, under which Cloudflare is certified. The legal basis is Art. 6 (1)(f) GDPR (our interest in protecting the forms against spam and misuse). Without this element, neither of these two forms can be submitted; you can write to us instead at dominik [at] wojcik [dot] de.

Cookies and local storage: When you visit evnxt.de, we set two technically necessary cookies: a session cookie (ai-outreach-session) and a security cookie against forged form requests (XSRF-TOKEN). They contain only a random identifier, no information about you personally, and expire after 2 hours. We store your choice in the cookie banner in a cookie and in your browser's local storage (evnxt_consent, about six months); it consists only of yes/no values, not an identifier. The legal basis is Art. 6 (1)(f) GDPR in conjunction with Section 25 (2) no. 2 TDDDG (strictly necessary).

Advertising and conversion measurement (only with your consent): In the cookie banner you can allow “Advertising and conversion measurement” and “Personalized advertising”. Each is set to “off” by default. As long as you do not allow anything, your browser does not load any script from Google. If you allow “Advertising and conversion measurement”, we load the Google tag from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). It measures whether a Google ad has led to a registration on evnxt.de. In the process, Google cookies or entries in your browser's local storage may be created (e.g. _gcl_au), and Google receives, among other things, your IP address, information about your device and browser, the page visited and the measurement event. Our server itself does not transmit any data to Google in the process. The data may also be transferred to Google LLC in the USA; the transfer is based on the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework, under which Google LLC is certified. With “Personalized advertising” you additionally allow Google to tailor ads to you. We do not use any audience measurement or analytics tool. The legal basis is your consent, Art. 6 (1)(a) GDPR in conjunction with Section 25 (1) TDDDG. You can withdraw it at any time with effect for the future via “Cookie settings” at the bottom of every page; the lawfulness of the processing carried out until then remains unaffected. You can delete cookies that have already been set in your browser. Your application and your inquiry do not depend on this consent.

Sign-in with Google (optional): At evnxt.de you can also register and sign in with your Google account instead of an email address and password. If you click “Sign in with Google”, we redirect you to Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland); there you sign in to Google and confirm that the data may be passed on. Google then transmits to us your Google account identifier (a number), your email address, whether Google has verified it, and your name; for accounts of an organization (Google Workspace), also its domain, which we use as a suggestion for the name of your workspace. We do not retrieve or store a profile picture, contacts or other data from your Google account. We store the account identifier, the email address and the times of linking and of the last sign-in together with your evnxt account. If you register via Google, we use your name and email address from the Google account for your evnxt account. If an evnxt account with the same email address already exists, we link it to your Google account. We record linking and unlinking, together with the Google email address, in an activity log, which we delete after 12 months. The purpose is registration and sign-in; the legal basis is Art. 6 (1)(b) GDPR (contract or pre-contractual measures). For the sign-in at Google itself, Google is an independent controller; Google's privacy policy applies (policies.google.com/privacy). Data may also be transferred to Google LLC in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework. You can remove the link at any time in your profile, provided you can still sign in with a password afterwards; we then delete the stored account identifier. If we delete your evnxt account, for example at your request, we delete it as well. Sign-in with Google is optional; an account with a password is possible without Google.

Connection of Google Search Console and Google Analytics (optional): In the evnxt application you can connect Google Search Console and Google Analytics 4 for your websites. To do so, we redirect you to Google; there you grant evnxt the requested permissions. Google then transmits to us access keys (tokens) and the email address of the Google account used. We store the access keys in encrypted form; evnxt uses them to retrieve the data from Google. From Search Console, we read the performance data of the property you choose (clicks, impressions, click-through rate and position per day, page, search query, country, device and search type) and the list of your properties and sitemaps; at your request, and if you wish also on a regular basis, we check individual addresses with Google's URL Inspection tool. If you have additionally granted evnxt management permission at Google, evnxt submits XML sitemaps of your website to Google on your instruction or that of your connected AI applications; evnxt does not change properties, users or settings. We store the performance data and inspection results so that you can see trends beyond the 16 months that Google itself keeps available. From Google Analytics 4, we read only aggregated reports of the property you choose, such as sessions, interactions, key events and revenue per landing page, source and day, as well as the number of active users in the last 30 minutes; we do not receive raw data on individual visits, and we do not store the reports permanently. The purpose is to show you the figures of your own websites in evnxt, to combine them with the other data in evnxt (such as the crawl of your website) and to derive recommendations from them. The legal basis is Art. 6 (1)(b) GDPR (contract). For your Google account and the data at Google, Google is an independent controller; Google's privacy policy applies. Data may also be transferred to Google LLC in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework. You can disconnect any connection in evnxt; we then delete the access keys, and for Google Analytics we also revoke the access at Google. Independently of this, you can revoke the access at any time in your Google account (myaccount.google.com/permissions). The use and transfer of information that evnxt receives from Google APIs is governed by the Google API Services User Data Policy, including the Limited Use requirements.

AI applications via the MCP server (optional): If you connect an AI application (such as Claude or ChatGPT) to your workspace via the evnxt MCP server, that application retrieves data about your websites from evnxt on your instruction, including the data from Google Search Console and Google Analytics mentioned above. You determine which data this is through the permissions of the connection. You can revoke the connection at any time under “API & MCP”. The terms of the AI application's provider apply to the processing in the AI application.

Load times from the Chrome UX Report and PageSpeed Insights: For the metrics on load time and usability (Core Web Vitals), evnxt queries Google's Chrome UX Report (chromeuxreport.googleapis.com); for lab tests of individual pages, evnxt uses Google's PageSpeed Insights (www.googleapis.com/pagespeedonline), which retrieves the page itself for this purpose. Only the public address of your website or of individual pages is transmitted, no personal data. The responses are aggregated measurements from Chrome users or results of the lab test; we keep the measurements in the cache for twelve hours at most and the test results for 24 hours at most.

Page archive: For websites on which the Onpage module is active, the evnxt crawler (identifier “evnxtAuditBot”) retrieves the publicly accessible pages, usually once a month. So that you can see what changed and when, evnxt stores a copy of the HTML source code of each page that is new or has changed since the last copy. The copies may contain personal data that is published on your website, such as names in author lines or on team pages. They are stored on our server in Nuremberg and are not publicly accessible. We delete each copy 36 months after retrieval at the latest, all copies of a website as soon as we remove the website from evnxt, and, on request, also the copies of individual pages. The legal basis is Art. 6 (1)(b) GDPR (contract); where the copies contain data of other persons, Art. 6 (1)(f) GDPR (the legitimate interest in being able to trace changes to one's own website).

Crawl data: When your website is crawled (Onpage module, crawler “evnxtAuditBot”, usually once a month), evnxt stores what it finds on the publicly accessible pages, including address, status code and load time, title, description, headings, word count, links including link text, images and embedded files, and structured data; for up to 500 pages per crawl, it also stores the HTML source code. If you have connected Search Console, your figures per page (clicks, impressions, click-through rate, position) and the most frequent search queries are added. From this, the audit with the findings and the comparison with the previous crawl are produced. To classify the pages, write the texts of the findings and run the chat with the AI agents, we transmit parts of this data, above all page texts, titles and findings, to AI providers: Anthropic PBC and OpenAI (both USA). The terms of the respective provider apply to their processing. This data may also contain personal data that is published on your website or appears in search queries. It is stored on our server in Nuremberg and is not publicly accessible. We delete the data of a crawl 13 months after it starts, and all crawl data of a website as soon as we remove the website from evnxt. The legal basis is Art. 6 (1)(b) GDPR (contract); where the data concerns other persons, Art. 6 (1)(f) GDPR (the legitimate interest in being able to technically check and improve one's own website).

Faster indexing with IndexNow: On your instruction, evnxt reports new or changed public addresses of your website via IndexNow (api.indexnow.org) to the participating search engines, such as Microsoft Bing, Yandex, Seznam and Naver. Only these addresses and the IndexNow key of your website are transmitted, no personal data.

Notices about Google updates: To put changes in traffic to your website into context, evnxt reads Google's public notices about updates and disruptions to Google Search (status.search.google.com). In doing so, we do not transmit any data about you.

Who has access to the data: Hetzner Online GmbH operates the server in Nuremberg (Germany) on which the platform runs and your information is stored. ALL-INKL.COM – Neue Medien Münnich (Germany) sends our notification email and the email with the link to the portal preview and hosts our mailboxes. Both process data exclusively on our behalf. Cloudflare (spam protection) and Google (advertising only with consent, sign-in and connections only at your request) are described above, as are IndexNow and the AI applications that you connect yourself. Beyond that, we do not pass on your information from the forms; it is not added to a newsletter mailing list and is not used for advertising.

How long data is stored: We keep applications and inquiries until they have been handled. If no access or contract results, we delete them automatically six months after handling. We delete your IP address automatically 30 days after submission. Requests that were flagged for manual review are deleted automatically 30 days after receipt. Information from the registration as a publisher, the inquiry as an advertiser and the portal preview is deleted automatically six months after receipt, provided that no account, no portal in use and no collaboration has come about by then; unused portal previews are deleted as early as 14 days after creation. Entries in the activity log are deleted automatically after 12 months. The check values created to prevent misuse (hash values of email address, IP address and content of the request, used to detect repeated submissions) are kept in the cache for 24 hours at most. We delete the notification email in our mailbox by hand within the same periods. The session and security cookies expire after 2 hours, the stored cookie choice after about six months (183 days). The data from the Search Console connection (performance data, inspection results and the email address of the connected Google account) remains stored until you delete it in evnxt or we delete the website or your evnxt account; we delete the access keys as soon as you disconnect. We delete the connection to Google Analytics completely when you disconnect; we keep reports from Google Analytics in the cache for ten minutes at most. Deleted data may still be contained in the database backups for up to 14 days until they are overwritten as scheduled.

Your rights regarding this offering: You have the rights named in section 5. Right to object: Where we process data on the basis of Art. 6 (1)(f) GDPR (IP address, spam protection, necessary cookies), you can object to the processing at any time on grounds relating to your particular situation (Art. 21 GDPR). You can withdraw a consent you have given (cookie banner) at any time. To do so, contact dominik [at] wojcik [dot] de.

What does not happen: Your information from the forms is not sold, not transmitted to advertising services and not used for profiling or automated decisions.