Privacy Policy
With this Privacy Policy, we inform you about the scope of the processing of your personal data (hereinafter referred to as "data") when using our website, web portal and the apps we provide there.
1. Introduction
We care about your privacy and are committed to the security of your personal data. Cofinity-X will comply with all legal obligations regarding the handling of personal data and will ensure that the rights of data subjects are respected and timely addressed.
The following policy outlines the standards we follow when handling your data. You will find information on what data we collect, how we handle it and what rights you have. This Privacy Policy explains how personal data is processed when you visit our website and Portal, when we provide onboarding, identity, and operational support services and when you register for and use our products and services. Please read this Privacy Policy carefully.
2. Definitions
- Personal Data: Personal Data means any information relating to an identified or identifiable natural person (hereinafter data subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
- Data Subject: Data Subjects are persons identified or identifiable by data processing activities of Cofinity-X.
- Data Controller: Data Controller is the individual or organization that determined the purposes and the means for processing personal data, and has the responsibility for ensuring compliance with relevant data protection laws.
- Cooperation Partners: who provide services for you or in connection with xternal entity involved in processing personal data alongside a data controller to achieve a specific purpose that involves the processing of personal data.
3. Controller for data processing
The controller for data processing in accordance with the provisions of the General Data Protection Regulation (GDPR) is:
Cofinity-X GmbH
Breslauer Platz 4
50668 Cologne
Germany
Web: www.cofinity-x.com
Cofinity‑X acts as data controller (Art. 4(7) GDPR) for processing activities related to:
- registration and account management,
- provision of digital identities and credentials,
- access control, authentication, and authorization,
- portal and marketplace operation, logging, and security,
- contractual, billing, and compliance processes.
Cofinity‑X does not access, store, or control the business content exchanged between participants whithin the data space unless explicitly required for support or legal reasons. In those cases, the relevant Data Processing Addendum applies. Participating companies remain independent data controllers. Cofinity‑X does not determine the purposes of partner‑to‑partner data exchanges and therefore does not act as a joint controller under Art. 26 GDPR for such exchanges.
4. Contact for Data Protection Matters
You can reach our Data Protection Officer at privacy@cofinity-x.com
5. How we use your Personal Data
We process personal data to operate our website and portal, provide our services, manage customer relationships, communicate with users, fulfill contractual obligations, and improve our products and services.
Depending on how you interact with us, we may process:
- Identity data (e.g., name, job title, company affiliation)
- Contact data (e.g., email address, postal address, telephone number)
- Account data (e.g., account details and preferences)
- Contract and transaction data (e.g., subscriptions, contracts, invoices)
- Communication data (e.g., inquiries, support requests, survey responses)
- Technical and usage data (e.g., IP address, browser information, device information)
- Marketing and preference data (e.g., newsletter subscriptions and communication preferences)
You can find detailed information on our processing activities below.
a) Website Operation and Hosting
When you visit our website, we automatically process technical information such as your IP address, browser type, operating system, date and time of access, referrer URL, and visited pages. This information is required to ensure the functionality, security, and stability of our website.
Legal basis
We process this information based on our legitimate interests in providing a secure, reliable, and efficient website (Art. 6(1)(f) GDPR).
Service Provider: Webflow
We host our website using Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA.
Webflow processes technical information necessary for website hosting, operation, and security on our behalf. Personal data may be transferred to the United States. Webflow is certified under the EU-US Data Privacy Framework and is therefore covered by the EU adequacy decision for the USA.
b) Communication and Contact Requests
If you contact us by email, through forms on our website, or through other communication channels, we process your contact details and the content of your message to respond to your request.
Legal basis
- Performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR), where your request relates to our services.
- Legitimate interests in responding to inquiries and managing communications (Art. 6(1)(f) GDPR).
Service Provider: Intercom
We use Intercom, Inc., 55 2nd Street, 4th Floor, San Francisco, CA 94105, USA, to manage customer communications and support requests.
Personal data transmitted through Intercom may be processed in the United States. Intercom is certified under the EU-US Data Privacy Framework and is therefore covered by the EU adequacy decision for the USA and uses Standard Contractual Clauses where required.
Service Provider: HubSpot
We use HubSpot, Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141, USA, for customer relationship management, onboarding, communication management, and contract administration.
Personal data may be processed in the United States. HubSpot is certified under the EU-US Data Privacy Framework and is therefore covered by the EU adequacy decision for the USA.
Service Provider: SendGrid
We use Twilio SendGrid, Inc., 889 Winslow Street, Redwood City, California 94063, USA, to send transactional and service-related emails, including account notifications, onboarding communications, support messages, and appointment confirmations.
Personal data may be processed in the United States. SendGrid is certified under the EU-US Data Privacy Framework and is therefore covered by the EU adequacy decision for the USA.
c) Appointment Scheduling
You may book appointments with our employees through our online scheduling system.
We process your name, contact details, company information, appointment details, and any information voluntarily submitted in the booking form.
Legal basis
- Performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR), where the appointment relates to requested services.
- Legitimate interests in providing an efficient appointment scheduling process (Art. 6(1)(f) GDPR).
Service Provider: Microsoft Bookings
We use Microsoft Bookings, provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.
Personal data may be transferred to Microsoft entities outside the EEA, including the United States. Microsoft is certified under the EU-US Data Privacy Framework and is therefore covered by the EU adequacy decision for the USA.
Service Provider: HubSpot
We use HubSpot, Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141, USA, for customer relationship management, onboarding, communication management, and contract administration.
Personal data may be processed in the United States. HubSpot is certified under the EU-US Data Privacy Framework and is therefore covered by the EU adequacy decision for the USA.
d) User Accounts and Portal Access
When you register for and use our portal, we process personal data necessary to create and manage your account, authenticate your access, and provide portal functionality.
This may include your name, company email address, location information, IP address, account credentials, and user preferences.
Legal basis
Performance of a contract (Art. 6(1)(b) GDPR), to provide the contracted services.
e) Customer Relationship Management and Contract Administration
We process personal data to establish and manage customer relationships, provide our services, onboard customers, administer contracts, and maintain customer records.
Legal basis
- Performance of a contract (Art. 6(1)(b) GDPR)
- Compliance with legal obligations where applicable (Art. 6(1)(c) GDPR)
- Legitimate interests in managing customer relationships and business operations (Art. 6(1)(f) GDPR)
Service Provider: HubSpot
We use HubSpot, Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141, USA, for customer relationship management, onboarding, communication management, and contract administration.
Personal data may be processed in the United States. HubSpot is certified under the EU-US Data Privacy Framework and is therefore covered by the EU adequacy decision for the USA.
Service Provider: Airtable
We use Airtable, provided by Formagrid Inc. d/b/a Airtable, 799 Market Street, 8th Floor, San Francisco, CA 94103, USA, as a cloud-based platform for customer relationship management, project management and workflow administration.
Airtable data may be processed and stored on servers located in the United States. Where personal data is transferred outside the European Economic Area, appropriate safeguards, including EU Standard Contractual Clauses or other transfer mechanisms recognized under Chapter V GDPR, are implemented in accordance with applicable data protection laws.
Service Provider: DocuSign
We use DocuSign, Inc., 221 Main Street, Suite 1550, San Francisco, CA 94105, USA, for electronic signatures and contract management.
Personal data may be processed in the United States. DocuSign is certified under the EU-US Data Privacy Framework and is therefore covered by the EU adequacy decision for the USA.
f) Billing, Invoicing and Financial Administration
We process personal data to issue invoices, process payments, maintain accounting records, and comply with applicable tax and financial reporting obligations.
Legal basis
- Performance of a contract (Art. 6(1)(b) GDPR)
- Compliance with legal obligations (Art. 6(1)(c) GDPR)
Service Provider: easybill
We use easybill GmbH, Düsselstraße 21, 41564 Kaarst, Germany, to create and manage invoices and billing processes. easybill processes customer and billing information necessary for invoicing, payment administration, and accounting purposes.
Personal data is primarily processed within Germany and/or the European Union. To the extent personal data is transferred outside the European Economic Area, appropriate safeguards in accordance with Chapter V GDPR are implemented.
Service Provider: Flowers
We use Flowers Software GmbH, Hansastraße 10, 80686 Munich, Germany, for accounting and financial administration processes. Flowers may process customer and supplier information, accounting records, invoicing data, payment information, and other financial information required to manage our business operations and comply with statutory accounting obligations.
Personal data is primarily processed within Germany and/or the European Union. To the extent personal data is transferred outside the European Economic Area, appropriate safeguards in accordance with Chapter V GDPR are implemented.
g) Marketplace Services
When you request access to applications or services through our marketplace, we may process and share your name, email address, company information, and subscription request details with the relevant provider.
Legal basis
Performance of a contract (Art. 6(1)(b) GDPR).
Please note that third-party providers available through the marketplace may act as independent controllers for their own services and are responsible for their own privacy notices.
h) Customer Support
When you submit support tickets, we process your contact details, support requests, attachments, and related communications to provide assistance and resolve technical issues.
Legal basis
- Performance of a contract (Art. 6(1)(b) GDPR)
- Legitimate interests in providing effective customer support (Art. 6(1)(f) GDPR)
Service Provider: Jira (Atlassian)
We use the Jira ticket system from Atlassian, Inc. 350 Bush Street, Level 13, San Francisco, California 94104, USA., for support ticket management and incident handling.
Although we primarily use hosting locations within the European Union, data transfers outside the EEA, including to the United States, may occur. Atlassian is certified under the EU-US Data Privacy Framework and is therefore covered by the EU adequacy decision for the USA.
i) Newsletters and Marketing Communications
If you subscribe to our newsletter or otherwise consent to receive marketing communications, we process your contact information and communication preferences.
Legal basis
Consent (Art. 6(1)(a) GDPR).
You may withdraw your consent at any time with effect for the future.
Service Providers: HubSpot and SendGrid (as described above) may be used to manage subscriptions, distribute newsletters, deliver communications, and analyse delivery and engagement metrics.
j) Analytics, Website Optimization and User Experience
We process personal data to analyze the use of our website and services, understand user behavior, improve functionality and performance, measure the effectiveness of our content and services, and optimize the user experience.
Legal basis
Consent (Art. 6(1)(a) GDPR)
Where required by applicable law, analytics and tracking technologies are only activated after the user has provided consent through our consent management platform. Consent may be withdrawn at any time with effect for the future.
Service Provider: Google Analytics
We use Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics helps us understand how visitors use our website by collecting information such as page views, interactions, device and browser information, approximate location data, and usage patterns.
Google is certified under the EU-US Data Privacy Framework and is therefore covered by the EU adequacy decision for the USA. Insofar as Google also processes your data in a third country without adequate data protection, the standard contractual clauses updated by the European Commission will apply in this respect, which can be accessed at Google Ads & Measurement: Standard Contractual Clauses (Module 3: Processor-to-Processor).
Service Provider: PostHog
We use PostHog, provided by PostHog, Inc., for product analytics, feature usage analysis, performance monitoring, and improvement of our digital services. PostHog may process information relating to user interactions, events, usage data, technical device information, browser information, and other analytics data necessary to understand and improve the functionality and user experience of our services.
PostHog stores data on servers within the EU (Frankfurt am Main) by default. In exceptional cases, data may be transferred to the USA. PostHog Inc. is certified under the EU-US Data Privacy Framework and is therefore covered by the EU adequacy decision for the USA. We have also concluded a Data Processing Agreement with PostHog, which ensures compliance with data protection requirements. Further information on data protection at PostHog can be found in PostHog's privacy policy: PostHog & GDPR compliance - Docs - PostHog
Service Provider: Hotjar
We use Hotjar, provided by Hotjar Ltd., to better understand how users interact with our website and services. Hotjar may process information relating to user behavior, including page interactions, clicks, scrolling activity, session recordings, heatmaps, and feedback submissions. This information helps us identify usability issues, improve website functionality, and optimize the overall user experience.
Where personal data is transferred outside the European Economic Area, appropriate safeguards, including EU Standard Contractual Clauses or other transfer mechanisms recognized under Chapter V GDPR, are implemented in accordance with applicable data protection laws.
k) Customer Experience Surveys and User Research
We may invite customers and users to participate in surveys, interviews, usability tests, and other research activities designed to improve our products and services.
Participation is voluntary.
Depending on the activity, we may process contact information, survey responses, product feedback, interview notes, and, where consent has been obtained, audio or video recordings.
Legal basis
- Legitimate interests in improving our onboarding, products, services, and user experience (Art. 6(1)(f) GDPR)
- Consent (Art. 6(1)(a) GDPR) where recordings or specific research activities require it
Research findings are generally analysed and reported in aggregated or anonymised form whenever possible.
Service Providers: HubSpot and SendGrid (as described above) may be used to manage and analyze surveys.
l) Legal Compliance and Record Keeping
We may process personal data where necessary to comply with legal obligations, maintain business records, establish, exercise, or defend legal claims, and respond to requests from regulatory authorities.
Legal basis
- Compliance with legal obligations (Art. 6(1)(c) GDPR)
- Legitimate interests (Art. 6(1)(f) GDPR) where necessary to protect our legal rights
6. Duration of data storage
We only store personal data for as long as necessary for the purposes for which it is processed, or until the data subjects withdraw their consent. To the extent that certain legal retention obligations must be complied with, the storage period for some data may be up to 10 years, regardless of the purposes of the processing.
7. International Data Transfers
This also includes disclosure by transmission to third parties and, if applicable, to so-called third countries outside the European Union ("EU") and the European Economic Area ("EEA"). Insofar as we transfer data outside the EU or the EEA, we have marked this accordingly above.
8. Use of Cookies
9. How We Store and Safeguard Personal Data
For Cofinity-X confidentiality, availability and integrity of information have great value. We have taken extensive measures on protection of sensitive and confidential Information.
Cofinity-X operates within the Catena-X ecosystem and provides products and services supporting secure, interoperable, and trusted data exchange across automotive and manufacturing value chains. As an operational platform and service provider within this ecosystem, Cofinity-X maintains a comprehensive security and compliance program aligned with both general cybersecurity best practices and Catena-X specific requirements.
While Catena-X defines common ecosystem standards, interoperability requirements, and conformity frameworks for trusted dataspace participation, Cofinity-X additionally subjects its organization, operational processes, and platform services to independent external assessments and industry-recognized security evaluations..
10. Your rights as a data subject
Data subjects have specific rights regarding the personal data that an organization collects and processes and they may exercise these rights at any time. Any and all requests will be handled within the specified time frame of 30 days.
In addition to the general information obligations under Arts. 12-14 of the General Data Protection Regulation (GDPR), data subjects have the following rights:
Right to Access (Art. 15 GDPR)
Data subjects have the right to request access to the personal data an organization holds about them. This includes information on the purposes of processing, the categories of data, and recipients of the data. If no personal data of the data subject has been processed, the data subject will be informed accordingly.
Right to Rectification (Art. 16 GDPR)
Data subjects have the right to request rectification, completion or updating of their personal data when it is inaccurate, incomplete or outdated.
Right to Erasure (Art. 17 GDPR)
Data subjects have the right to request the deletion of their personal data, as long as the respective requisites are met and no exceptions to the deletion obligation are in place. For example, when the personal data is no longer necessary for the purposes for which it was collected consent has been withdrawn, personal data has been processed unlawfully and/or the data subject objects the processing of their personal data and there are no overriding legitimate grounds for further processing.
Right to Restriction of Processing (Art. 18 GDPR)
Data subjects have the right to request the restriction of processing of their personal data if they believe the data is inaccurate, the processing is unlawful, or they object to the processing.
Right to Data Portability (Art. 20 GDPR)
Data subjects have the right to receive their personal data in a structured, commonly used and machine-readable format and to have their data transmitted to another data controller.
Right to Object (Art. 21 GDPR)
Data subjects have the right to object to the processing of their data. Data subjects must provide a particular situation that warrants the objection.
Right not to be subject to automated individual decision-making (Art. 22 (3) GDPR)
Data subjects have the right to not be subject to decisions based solely on automated processing, including profiling.
Right to Withdraw Consent (Art. 7 (3) GDPR)
Data subjects have the right to withdraw the consent given for personal data processing at any time. This shall not affect the lawfulness of any processing that took place with the consent up until its withdrawal. The processing of personal data will be discontinued immediately once consent has been withdrawn.
11. Contacting us, exercising your rights and lodging a complaint
If you have any questions regarding the processing of your personal data, information, rectification, blocking, objection or deletion of data or if you wish to transfer the data to another enterprise, please contact our Data Protection Officer at privacy@cofinity-x.com.
In case of data protection breaches or misconduct, you have the option of raising an anonymous complaint through our Whistleblowing Hotline.
You may also complain to a supervisory authority about your rights as a data subject, in particular in the Member State where you have your habitual residence or place of work or where the alleged infringement took place.
Our local authority:
State Commissioner for Data Protection and Freedom of Information Nordrhein-Westfalen
Kavalleriestr. 2-4
40213 Düsseldorf
Last updated on 01.09.2026