Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws as well as other data protection provisions is:

io mates GmbH
Spinnereiinsel 3b
83059 Kolbermoor
Germany
Phone: +49 8031 9005770
E-mail: info@abomate.io

Managing Directors: Andreas Huber, Marcus Thaller

2. General information and mandatory information

The protection of your personal data is important to us. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy. Personal data is any data with which you can be personally identified. This privacy policy explains what data we collect and what we use it for.

We point out that data transmission over the internet (e.g. when communicating by e-mail) may have security gaps. Complete protection of data against access by third parties is not possible.

3. Hosting

We host the content of our website with Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (hereinafter "Hetzner"). The servers are located in Germany. Hetzner collects and processes data in server log files that your browser automatically transmits. The use of Hetzner is in the interest of a secure, fast, and reliable provision of our online services (Art. 6 (1) (f) GDPR).

We have concluded a data processing agreement (DPA) with Hetzner pursuant to Art. 28 GDPR, which ensures that Hetzner processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

4. Server log files and server-side reach measurement

When you access our website, technically necessary information is processed. In addition, for the statistical evaluation of the use of our website, we collect the following data on the server side:

  • page accessed (path) and domain
  • referring page (referrer)
  • device type (mobile/tablet/desktop), browser, and operating system
  • screen resolution and browser language setting
  • campaign parameters (UTM parameters), if contained in the URL accessed
  • time spent on page and scroll depth
  • a pseudonymized identifier of your IP address

Important: Your IP address is never stored in plain text. It is processed exclusively as a cryptographic hash value (SHA-256) that is re-salted daily, does not allow any conclusions to be drawn about your person, and serves solely to detect multiple accesses and to protect against abuse. This analysis is cookie-free.

The legal basis is our legitimate interest in the technical provision and statistical optimization of our services (Art. 6 (1) (f) GDPR).

5. Cookies and consent management

Our website uses cookies. Cookies are small text files that are stored on your device. Some cookies are technically necessary; others are used for analysis or marketing and are only set after your explicit consent.

To manage your consent, we use a consent management tool (CookieConsent) in conjunction with Google Consent Mode V2. When the site is first accessed, no consent-requiring services are loaded by default – with the exception of technically necessary cookies. Only when you agree via the cookie banner are the corresponding analysis and marketing services (Google Analytics, Google Ads, Meta Pixel, LinkedIn Insight Tag, Microsoft Advertising UET) activated. You can withdraw or adjust your consent at any time via the cookie settings.

The following cookies and storage technologies are used:

  • cc_cookie (technically necessary) – stores your cookie settings, lifetime approx. 182 days
  • PHPSESSID (technically necessary) – session cookie, deleted when the browser is closed
  • _ga, _ga_*, _gid (statistics, consent required) – Google Analytics, lifetime up to 2 years
  • _gcl_au, _gcl_aw (marketing, consent required) – Google Ads, lifetime approx. 90 days
  • _fbp, _fbc (marketing, consent required) – Meta Pixel, lifetime approx. 90 days
  • ln_or (marketing, consent required) – LinkedIn Insight Tag, lifetime 1 day
  • li_sugr, bcookie, lidc, UserMatchHistory, AnalyticsSyncHistory (marketing, consent required) – LinkedIn, set on the linkedin.com domain, lifetime between 24 hours and 1 year
  • _uetsid, _uetvid (marketing, consent required) – Microsoft Advertising UET, lifetime 1 day and 13 months respectively
  • MUID (marketing, consent required) – Microsoft, set on the bing.com domain, lifetime 13 months

The legal basis for technically necessary cookies is Art. 6 (1) (f) GDPR or § 25 (2) TDDDG. Consent-requiring cookies are stored on the basis of your consent (§ 25 (1) TDDDG in conjunction with Art. 6 (1) (a) GDPR).

6. Google Tag Manager

We use Google Tag Manager provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager is a tool that allows us to integrate and manage tracking or statistics tools and other technologies on our website. Google Tag Manager itself does not create user profiles, does not store cookies, and does not carry out any independent analyses. It merely serves to manage and deploy the tools integrated through it, which in turn are only loaded after your consent.

7. Google Analytics 4

Following your consent, this website uses functions of the web analytics service Google Analytics. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables us to analyze the behavior of website visitors and thus improve our services. For this purpose, cookies are used and information about your use of the website is processed. IP anonymization is activated.

Use takes place on the basis of your consent pursuant to Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. Consent can be revoked at any time.

The transfer of data to the USA is based on the standard contractual clauses of the EU Commission and the EU-US Data Privacy Framework. You can also prevent collection by Google Analytics using the following browser add-on: https://tools.google.com/dlpage/gaoptout.

8. Google Ads and conversion tracking

Following your consent, we use Google Ads, an online advertising program of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Within Google Ads, we use what is known as conversion tracking and remarketing. If you click on an ad placed by Google, a cookie for conversion tracking is set. This allows us to understand whether users perform certain actions (e.g. a registration) after clicking on an ad, and to serve our advertising in a targeted manner.

The legal basis is your consent pursuant to Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. Data may also be transferred to the USA here, based on the standard contractual clauses and the EU-US Data Privacy Framework.

9. Meta Pixel (Facebook Pixel)

Following your consent, we use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. With the help of the Meta Pixel, we can evaluate the effectiveness of our advertisements on Facebook and Instagram for statistical and market research purposes and record visitors to our website as a target audience for displaying advertising (custom audiences). Cookies may be set and information transmitted to Meta in this process.

The legal basis is your consent pursuant to Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. Insofar as data is transferred to the USA with the help of the Meta Pixel, this is based on the standard contractual clauses and the EU-US Data Privacy Framework. Further information can be found in Meta's privacy policy: https://www.facebook.com/privacy/policy/.

10. LinkedIn Insight Tag and conversion tracking

Following your consent, we use the LinkedIn Insight Tag. The provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (hereinafter "LinkedIn"). The Insight Tag is a piece of JavaScript code that allows us to measure the effectiveness of our LinkedIn advertising campaigns (conversion tracking), to re-engage visitors of our website on LinkedIn (retargeting), and to receive aggregated, anonymized statistics about website visitors, such as industry, company size, or job title.

If you have given your consent, a connection to LinkedIn servers is established when you access our pages. Data transmitted includes the URL accessed, the referrer URL, your IP address, device and browser information, and a timestamp. LinkedIn also sets the cookies listed under point 5 in your browser. Certain actions on our website – such as submitting the contact form, requesting the whitepaper, signing up for early access, starting the checkout, or completing the registration – are reported to LinkedIn as conversions. If you are logged in to LinkedIn at the same time, LinkedIn may associate the visit with your member account. We only receive aggregated reports from LinkedIn and no personal data of individual visitors.

LinkedIn truncates or hashes the IP address and removes direct member identifiers within seven days. The remaining pseudonymized data is deleted after 180 days.

The legal basis is your consent pursuant to Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. The Insight Tag is only loaded once you have accepted the "Marketing" category in the cookie banner. Without this consent, no data is transmitted to LinkedIn. You can withdraw your consent at any time with effect for the future via the cookie settings.

Data may be transferred to the USA. LinkedIn is certified under the EU-US Data Privacy Framework; in addition, the standard contractual clauses of the EU Commission apply. Further information can be found in LinkedIn's privacy policy: https://www.linkedin.com/legal/privacy-policy. You can opt out of personalized advertising by LinkedIn here: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

11. Microsoft Advertising (UET tag) and conversion tracking

Following your consent, we use Universal Event Tracking (UET) from Microsoft Advertising, a service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. The UET tag allows us to determine whether visitors reached our website via an ad in Microsoft Search (Bing) or the Microsoft Audience Network and which actions they perform there (e.g. contact request, registration). Visitors to our website may also be recorded as an audience for remarketing. In this process, cookies are set (including _uetsid, _uetvid, MUID) and information such as the page visited, the Microsoft click ID (msclkid), browser and device information and the IP address is transmitted to Microsoft.

The UET tag is loaded only if you consent to the "Marketing" category in the cookie banner. The legal basis is your consent pursuant to Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. Insofar as data is transferred to the USA, this is based on the standard contractual clauses and the EU-US Data Privacy Framework, of which Microsoft is a member. Further information can be found in Microsoft's privacy statement: https://privacy.microsoft.com/en-us/privacystatement. You can also opt out of personalised advertising from Microsoft at https://account.microsoft.com/privacy/ad-settings.

12. Contact form and contact by e-mail

If you send us inquiries via the contact form or by e-mail, your details from the inquiry form (name, e-mail address, company if applicable, and your message) will be processed by us for the purpose of handling the inquiry and in case of follow-up questions. The dispatch is carried out via the Microsoft 365 service (Microsoft Ireland Operations Limited). We do not pass on this data without your consent.

The processing of this data is based on Art. 6 (1) (b) GDPR, provided that your inquiry is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective handling of inquiries directed to us (Art. 6 (1) (f) GDPR) or on your consent (Art. 6 (1) (a) GDPR).

The data you enter in the contact form will remain with us until you ask us to delete it, withdraw your consent to its storage, or the purpose for storing the data no longer applies. Mandatory legal provisions – in particular retention periods – remain unaffected.

13. Newsletter, whitepaper download, and early access

On our website we offer you the option of registering for our newsletter, the download of our whitepaper, or the early access list. For this we require your e-mail address and optionally your name and company.

For registration we use the so-called double opt-in procedure: after your registration, you will receive an e-mail asking you to confirm. Only after your confirmation will your e-mail address be activated for dispatch. To document your registration, we store the time of registration and confirmation as well as a pseudonymized (hashed) identifier of your IP address.

The processing is based on your consent (Art. 6 (1) (a) GDPR). You can withdraw your consent at any time with effect for the future, for example via the unsubscribe link in every e-mail. The lawfulness of the data processing operations already carried out remains unaffected by the withdrawal. After you unsubscribe, the associated data will be deleted, provided there are no statutory retention obligations.

14. Registration and payment processing (Stripe)

If you register for our service or conclude a paid subscription, the data required for this (in particular company and contact data) will be processed. Payment processing is carried out via the payment service provider Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). The payment data collected during payment is processed exclusively by Stripe; we ourselves do not store any complete payment means data.

The legal basis is the performance of the contract or the implementation of pre-contractual measures (Art. 6 (1) (b) GDPR). Further information on how your data is handled can be found in Stripe's privacy policy: https://stripe.com/privacy.

15. Local fonts

This website uses so-called web fonts for the uniform display of fonts. The fonts used are integrated locally on our server (self-hosted). No connection to third-party servers (e.g. Google Fonts) takes place; in particular, no data is transferred to Google.

16. SSL / TLS encryption

For security reasons and to protect the transmission of confidential content, this site uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line.

17. Storage period

Unless a more specific storage period has been stated within this privacy policy, your personal data will remain with us until the purpose for data processing no longer applies. If you assert a justified request for deletion or revoke your consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g. tax or commercial retention periods); in the latter case, deletion takes place after these reasons cease to apply.

18. Your rights as a data subject

Within the framework of the applicable statutory provisions, you have the following rights:

  • right to information about the data stored about you (Art. 15 GDPR)
  • right to rectification of incorrect data (Art. 16 GDPR)
  • right to erasure (Art. 17 GDPR)
  • right to restriction of processing (Art. 18 GDPR)
  • right to data portability (Art. 20 GDPR)
  • right to object to processing (Art. 21 GDPR)
  • right to withdraw consent given, with effect for the future (Art. 7 (3) GDPR)

To exercise your rights, an informal message to the contact details listed under point 1 above is sufficient.

19. Right to object to direct advertising and legitimate interests

If personal data is processed on the basis of Art. 6 (1) (f) GDPR, you have the right to object to this processing at any time for reasons arising from your particular situation. If your data is processed for the purpose of direct advertising, you have the right to object to the processing at any time; thereafter your data will no longer be used for these purposes.

20. Right to lodge a complaint with a supervisory authority

In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority. The supervisory authority responsible for us is:

Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18, 91522 Ansbach, Germany
www.lda.bayern.de

This right to lodge a complaint is without prejudice to any other administrative or judicial remedies.

Last updated: September 2026