Grunwald
EN
DE EN

Privacy Policy

Last updated: 19 July 2026

I. Controller

The controller for the purposes of the General Data Protection Regulation (GDPR) is:

1017 Research GmbH
Tal 44
80331 Munich
Germany
Email: privacy@1017.ai

Represented by Managing Director Felix Buschkotte. Registered with the commercial register of the Local Court (Amtsgericht) Munich under HRB 295988. For further details, see our Legal Notice.

II. Data Protection Officer

1017 Research GmbH is not required to appoint a data protection officer under § 38 BDSG. For all data-protection-related enquiries, please contact us at privacy@1017.ai.

III. Legal bases for processing

We process personal data on the following legal bases:

  • Article 6(1)(a) GDPR – consent;
  • Article 6(1)(b) GDPR – performance of a contract or pre-contractual measures;
  • Article 6(1)(c) GDPR – compliance with a legal obligation;
  • Article 6(1)(f) GDPR – legitimate interests, provided that the interests, fundamental rights and freedoms of the data subject do not override.

IV. Server log data

When you visit our website, your browser automatically transmits technical information to our hosting provider, including:

  • IP address,
  • date and time of the request,
  • URL requested,
  • referring URL,
  • browser type and version, operating system,
  • volume of data transferred and HTTP status code.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the technical operation, security and stability of the website.

Processing takes place in the Vercel function region Frankfurt am Main (eu-central-1) within the European Union. Server log data is automatically deleted after no more than 30 days.

V. AI-based valuation and buyer identification tools

If you use our free AI-based valuation tool or our strategic buyer identification tool, we process the personal contact data (name, email address, optionally phone number) you provide in order to respond to your request and, where applicable, to deliver the requested report or buyer list.

The legal basis is Article 6(1)(b) GDPR (performance of pre-contractual measures at your request). Retention periods are set out in Section XIII.

To generate the analysis we use the Claude AI service provided by Anthropic, PBC (see Section IX). Personal contact data is not transmitted to Anthropic.

Once a lead has been qualified by our team, we transfer the associated contact and business data to our customer relationship management (CRM) system provided by Attio Limited (see Section IX). The legal basis is Article 6(1)(f) GDPR (our legitimate interest in managing lead relationships).

VI. User accounts and transactional emails

If you create an account on our platform or request a valuation report, we process the data required for registration, authentication and communication (in particular email address, name, optionally phone number and password hash, plus login timestamps).

This data is stored in our database in the Ireland region (eu-west-1), provided by Supabase Pte. Ltd. (970 Toa Payoh North #07-04, Singapore 318992) as a processor.

For sending transactional emails (e.g. confirmation links, valuation reports, login links, internal notifications about new enquiries) we use Resend, Inc. (2261 Market Street #5039, San Francisco, CA 94114, USA) as a processor. Emails are sent from the Ireland region (eu-west-1). Your email address and the content of the respective message are transmitted.

The legal basis is Article 6(1)(b) GDPR. Account and enquiry data is stored for as long as your account exists or until your enquiry has been resolved; statutory retention obligations remain unaffected.

VII. Web analytics (only with your consent)

With your express consent (Article 6(1)(a) GDPR, § 25(1) TDDDG) we use the following analytics tools on our website:

  • Vercel Analytics and Vercel Speed Insights (Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA) – collection of anonymous usage statistics and performance data.

We additionally use our own first-party analytics feature which stores a random anonymous identifier in your browser's local storage (gw_anonymous_id) so that page views and tool usage can be evaluated in pseudonymous form across sessions.

You can withdraw your consent at any time with effect for the future by changing your cookie preferences via the banner on our website.

VIII. Marketing and conversion tracking (only with your consent)

With your express consent (Article 6(1)(a) GDPR, § 25(1) TDDDG) we use Meta Pixel, a service provided by Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland).

Meta Pixel allows us to measure the success of our advertising on Facebook and Instagram (conversion tracking) and to build custom audiences. The cookies _fbp and, where applicable, _fbc are set; your IP address and browser information are transmitted to Meta.

For processing within the Meta Pixel, we and Meta Platforms Ireland Limited are joint controllers within the meaning of Article 26 GDPR. The corresponding joint-controller arrangement is available at facebook.com/legal/controller_addendum.

You can withdraw your consent at any time with effect for the future by changing your cookie preferences.

IX. Recipients and processors

We use the following processors within the meaning of Article 28 GDPR:

  • Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA – website hosting and execution of server-side functions in the Frankfurt region.
  • Supabase Pte. Ltd., 970 Toa Payoh North #07-04, Singapore 318992 – database, authentication and file storage (Ireland region).
  • Anthropic, PBC, 548 Market St., PMB 90375, San Francisco, CA 94104, USA – AI language model for our valuation and research features.
  • Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA – sending transactional emails (sending region: Ireland, eu-west-1).
  • Attio Limited, United Kingdom – customer relationship management (CRM); we transmit contact and company data of qualified leads. EU representative pursuant to Article 27 GDPR: EU-REP.Global GmbH, Hopfenstr. 1d, 24114 Kiel, Germany.
  • Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland – Meta Pixel (only with your consent; joint controllership under Article 26 GDPR).

X. International transfers

Some of the providers listed in Section IX have their headquarters or parent companies outside the European Economic Area (EEA), in particular in the United States. Any transfer to such third countries only takes place with providers that ensure an adequate level of data protection.

The providers concerned typically rely on the EU Standard Contractual Clauses (SCCs) pursuant to Article 46(2)(c) GDPR and — where certified — additionally on the European Commission's adequacy decision regarding the EU-US Data Privacy Framework pursuant to Article 45 GDPR. The relevant safeguards form part of the providers' respective Data Processing Addenda; the current wording is available in the providers' privacy notices.

XI. Contact by email

If you contact us by email (e.g. at privacy@1017.ai), we process the transmitted data solely to respond to your enquiry. The legal basis is Article 6(1)(b) or (f) GDPR. Your enquiries and the related correspondence will be deleted once no longer required for further handling; statutory retention obligations remain unaffected.

XII. Cookies and comparable technologies

Our website uses the following cookies and comparable storage mechanisms:

Strictly necessary (without consent):

  • gw_locale – stores your language preference (lifetime: session); legal basis § 25(2) No. 2 TDDDG;
  • gw_cookie_consent – stores your cookie preferences (lifetime: 180 days);
  • sb-... – Supabase session and authentication cookies, only after login (lifetime: until end of session).

Analytics cookies and storage (only with consent):

  • gw_anonymous_id (Local Storage) – anonymous visitor identifier for our own usage analytics (persistent);

Advertising cookies (only with consent):

  • _fbp – Meta Pixel, browser identifier (lifetime: 90 days);
  • _fbc – Meta Pixel, click identifier when accessed via an advertisement (lifetime: 90 days).

You can adjust your consent at any time via the cookie banner or use your browser settings to block or delete cookies.

XIII. Retention periods

We only store personal data for as long as is necessary for the purposes described in this privacy policy:

  • Server log data: max. 30 days.
  • Requests via the valuation or buyer tool: for the duration of processing; thereafter in accordance with German commercial and tax retention obligations (generally 6 or 10 years under §§ 257 HGB, 147 AO), where applicable.
  • Account and communication data: for as long as your account exists or until your enquiry has been resolved.
  • Cookies and similar storage: see Section XII.

XIV. Your rights as a data subject

Where we process your personal data, you have the following rights:

  • Right of access (Article 15 GDPR);
  • Right to rectification (Article 16 GDPR);
  • Right to erasure (Article 17 GDPR);
  • Right to restriction of processing (Article 18 GDPR);
  • Right to data portability (Article 20 GDPR);
  • Right to object to processing (Article 21 GDPR);
  • Right to withdraw consent with effect for the future (Article 7(3) GDPR).

To exercise any of these rights, a plain email to privacy@1017.ai is sufficient.

XV. Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data infringes the GDPR (Article 77 GDPR). The competent authority for 1017 Research GmbH is:

Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach
Germany
www.lda.bayern.de

XVI. Data security

We implement technical and organisational measures to protect your data against loss, manipulation or unauthorised access. These include transport-layer encryption via TLS, encryption at rest in our databases and restrictive access controls for internal staff.

XVII. Currency of this privacy policy

We reserve the right to amend this privacy policy if the processing of your data or the legal framework changes. The current version is always available on this page.