Skip to main content

Privacy Policy

Privacy, terms of service and legal information for using the Kopexa platform.

Privacy Policy

Effective since October 16, 2026

Kopexa GmbH ("Kopexa") understands that privacy matters to you and is committed to protecting your personal data. This Privacy Policy explains how we collect, use and share information when you use our website, services or other Kopexa content. By accessing the Kopexa website or using our services, you agree to the practices described in this Privacy Policy.

What does this Privacy Policy cover?

This Privacy Policy applies to the collection and processing of personal data when you use the Kopexa website or our services. It does not apply to companies we do not own or control, or to individuals we do not manage.

Kopexa acts as a data processor for its customers, who act as data controllers. We process personal data only in accordance with our customers' instructions and implement technical and organizational measures to ensure compliance with the General Data Protection Regulation (GDPR).

Privacy rights for California residents

Under the California Consumer Privacy Act (CCPA), California residents may request information about the categories of personal data shared with third parties for marketing purposes. To exercise your rights, contact us at [email protected].

Cooperation with data protection authorities

Kopexa works with the European Union Data Protection Authorities (DPAs) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) to resolve unresolved complaints related to the transfer of data from the EU and Switzerland.

Collection of personal data

Kopexa may collect the following personal data:

  • When registering for Kopexa services: name, email address and IP address.
  • When visiting our website: IP address, browser type and interaction logs.
  • When using Kopexa services: login data, account activity and customer-submitted content.

We may also receive personal data from third parties, including our customers, service providers and publicly available sources.

Use of personal data

We process personal data for the following purposes:

  • Providing, maintaining and improving our services.
  • Authenticating and managing user accounts.
  • Ensuring security and protection against fraud.
  • Sending relevant product updates and marketing communications, subject to user preferences.

Marketing communications

A contact or demo request does not constitute consent to newsletters or other marketing emails. We obtain separate consent for such communications. You may withdraw that consent at any time using the unsubscribe link in our emails or by contacting us directly.

Download offers and email series

On our website you can request templates and checklists, for example the GRC requirements catalogue.

Purpose. We use your details to provide the download you requested and to then send you a series of five emails over 14 days with guidance on selecting GRC software and on the offerings of Kopexa GmbH. After this series you will receive no further emails unless you consent again.

Data processed. First name, last name, company, email address, your role in the company, the company size and the decision period you stated, and voluntarily your phone number. As evidence of your consent we also store the time, IP address and browser identification (user agent) of the signup and of the confirmation.

Double opt-in. After you submit the form you receive an email with a confirmation link. Your signup is complete only once you click that link. Only then do we send you the download link and the email series. Without confirmation your signup stays inactive, no further emails are sent to you, and we delete the signup after 30 days.

Legal basis. Your consent under Art. 6(1)(a) GDPR. We store the evidence of your consent to meet our accountability obligation on the basis of Art. 6(1)(c) GDPR.

Recipients. For sending the emails and managing your consent we use CleverReach GmbH & Co. KG, Rastede, Germany, as a processor. After your confirmation we also transfer your details into our self-hosted CRM system Twenty in order to handle your enquiry in sales. We also use the reporting integration described below for internal opportunity analysis.

Retention. We store your details until you withdraw your consent. If you do not withdraw it, we delete them at the latest 24 months after our last contact with you. Separately from this, we keep the evidence of your consent until three years have passed after the end of the year in which you gave or withdrew your consent. It serves solely to demonstrate that consent.

Withdrawal. You can withdraw your consent at any time, with one click via the unsubscribe link in every email or by message to [email protected]. This does not affect the lawfulness of the processing carried out up to the withdrawal.

Sharing of personal data

Kopexa does not sell personal data. However, we share data with:

  • Service providers (sub-processors) that support necessary business processes.
  • Business partners where required for the provision of services.
  • Authorities where we are legally required to do so.
  • Meta Platforms Ireland Limited (with possible onward processing by Meta Platforms, Inc., USA) for advertising measurement and retargeting through the browser pixel, only after your marketing consent. We do not use a server-side Meta Conversions API for this integration. Details and legal bases are provided in the "Cookies and tracking technologies" section.
  • CleverReach GmbH & Co. KG, Rastede, for sending requested downloads and the associated email series. Details are in the "Download offers and email series" section.

A list of our sub-processors is available upon request.

Data transfers and security measures

Personal data may be processed outside the European Economic Area (EEA). In such cases, we ensure adequate protection through the following measures:

  • Standard Contractual Clauses (SCCs) approved by the European Commission.
  • Participation in the EU-U.S. Data Privacy Framework (DPF) for applicable data transfers.

All data is encrypted during transfer and storage. We use AES-256 encryption for stored data and TLS 1.2+ for secure transfers. Our infrastructure includes firewall protection, intrusion detection systems and access controls.

Cookies and tracking technologies

Kopexa uses the following categories of cookies and tracking technologies on our website, aligned with our cookie consent banner (c15t):

  • Necessary: Technically required for the website to function (for example, storing your cookie preferences). No consent required.
  • Analytics/Measurement: Only active with your consent. Used to analyze website usage and detect errors.
  • Marketing: Only active with your consent. Used to measure and optimize the performance of our advertising.

Specifically, we use the following services:

  • Matomo (web analytics): Self-hosted at stats.kopexa.com. Matomo runs server-side via the HTTP Tracking API, sets no cookies and does not load client-side JavaScript in the browser. Visits are recognized via a pseudonymous visitor ID derived from the IP address and user agent. Purpose: reach and usage statistics. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Because Matomo runs exclusively on our own infrastructure in the EU, no data is transferred to third countries. Consent is not required for Matomo.

  • PostHog (product analytics and error tracking): Provided by PostHog Inc. (USA), but processed in the EU data region (eu.posthog.com). Purpose: usage analysis, error/exception tracking and conversion measurement. Legal basis: your consent (Art. 6(1)(a) GDPR) via the "Analytics/Measurement" category. Without consent, PostHog runs cookieless and anonymized; with consent, PostHog sets cookies and local storage entries (including ones prefixed "ph_"). Because the provider is based in the USA, transfers rely on Standard Contractual Clauses (SCCs).

  • Meta Pixel (Facebook/Instagram advertising): With your consent to “Marketing”, we load the Meta Pixel on selected public product, catalog, pricing, comparison, landing and contact pages. The provider is Meta Platforms Ireland Limited; onward processing by Meta Platforms, Inc. in the United States is possible. The pixel processes technical connection data such as IP address and browser information, together with page address, event type, time and pseudonymous cookie or advertisement-click identifiers. Visits may be matched to a Meta account to measure advertisements and retarget visitors.

    A Lead is reported only after a successfully submitted request; it does not confirm an appointment. We do not pass names, email addresses, telephone numbers or message contents to the pixel. Automatic advanced matching and automatic page/product information enrichment are disabled. Unknown URL query parameters, internal tests, local development, previews, tools and legal pages are excluded from this integration. Allowed advertisement and campaign parameters may form part of the page address collected by Meta’s SDK.

    We do not use a server-side Meta Conversions API for this integration. The previous server-side transmission of lead contact data and page views has been removed. Without marketing consent, the pixel is not loaded. The legal bases are your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. _fbp and, where applicable, _fbc support recognition and advertisement-click attribution and may persist for up to 90 days. You can withdraw consent for the future using “Cookie settings” in the footer. Further information on processing and international transfers: Meta Privacy Policy and Meta Cookie Policy.

You can withdraw your consent to the "Analytics/Measurement" and "Marketing" categories at any time, with effect for the future, via the cookie settings in the website footer. For more information, see our Cookie Policy.

Google Ads: performance measurement and retargeting

With your consent to the “Marketing” category, we load the Google tag for Google Ads. Without this consent, this integration is not loaded. The tag may process ad-click information and cookie identifiers to attribute a successfully submitted request to an advertisement. Google receives technical information such as the visited page, browser information and IP address. The provider is Google Ireland Limited; onward processing by Google outside the EEA is possible.

On our demo landing pages, the conversion is triggered only after the request has been successfully submitted on the server. A random event ID prevents duplicate counting. Internal tests and experiment previews are excluded. This integration does not send form contents, email addresses or phone numbers to Google as “Enhanced Conversions”. With renewed marketing consent, we also use visits to public product, catalog, comparison, pricing and contact pages to build audiences for personalized advertising and retargeting. Explicitly transmitted page URLs exclude query parameters and fragments. Tests, previews, legal pages and excluded tools remain excluded. Contact requests remain available without marketing consent.

The legal basis is your consent under Article 6(1)(a) GDPR and, for device storage access, section 25(1) of the German TDDDG. You can withdraw consent at any time in the cookie settings. Attribution may use Google's _gcl_* cookie family; Google describes applicable lifetimes by feature in its cookie overview. Further details about processing and transfers are available in Google's privacy policy and its information about partner sites.

OpenAI Ads: advertising measurement

With your consent to the “Marketing” category, we use the OpenAI Ads Pixel and OpenAI Conversions API to measure the effectiveness of our advertisements in ChatGPT. The browser pixel is loaded only after this consent. Following successful delivery of a contact request, we also send a server-side conversion event. Browser and server use the same event ID to avoid double counting. The technical event name is appointment_scheduled; in this integration it indicates a submitted contact request and does not confirm a booked appointment.

The data processed includes event type, event ID, time and page address. Our server removes query parameters and URL fragments from that address. If available, the advertisement click identifier oppref and pseudonymous browser identifier obref are also transmitted. Our server integration does not transmit names, email addresses, telephone numbers or message contents to OpenAI. Loading the browser SDK involves connection data such as IP address and browser information. OpenAI's processing is additionally governed by its privacy notices and the advertising account settings.

The pixel may use the first-party cookies __oppref (up to 30 days) and __obref (up to 365 days). The legal bases are your consent under Art. 6(1)(a) GDPR and, for storage access, Section 25(1) TDDDG. Contact requests remain available without marketing consent. You may withdraw consent at any time through cookie settings with effect for the future; this integration then sends no further events.

OpenAI Ireland Limited is the recipient for processing EEA data. Under the Conversion Terms, Kopexa and OpenAI generally act as independent controllers. Where OpenAI processes data outside the EEA, the transfer mechanisms provided by its Ad Tools Data Processing Addendum apply. The cookie lifetimes above do not specify retention of event data already transmitted to OpenAI; the provider's purposes and retention rules apply to that data.

Further information: OpenAI Privacy Policy, Conversion Terms and Ad Tools Data Processing Addendum.

Retention of personal data

Personal data is retained only as long as necessary for the purposes described in this Privacy Policy. Retention periods are determined by:

  • Legal requirements and compliance obligations.
  • The duration of the customer relationship.
  • Technical and operational considerations.

Data that is no longer needed is securely deleted in accordance with industry-standard security practices.

Rights to restrict the processing of personal data

If Kopexa processes your personal data on behalf of a customer, you should first contact that customer.

However, you may withdraw your consent to the processing of your data at any time by emailing [email protected]. Upon receipt of your request, Kopexa will delete your data unless there are legal or billing-related reasons for retention.

If your data is incorrect, you may request a correction at [email protected].

Right to information about data protection measures for international data transfers

Kopexa ensures that adequate data protection measures are in place for the transfer of personal data outside the EEA. For countries without an adequacy decision by the European Commission, Kopexa relies on contractual safeguards in accordance with the GDPR.

Reporting data breaches

In the event of a data breach, Kopexa will:

  • Analyze the incident and assess its scope.
  • Notify affected individuals and relevant authorities without undue delay.
  • Implement corrective measures to prevent future incidents.

Questions or concerns about the Privacy Policy

If you have questions or concerns about our privacy practices, you can contact us at [email protected]. We will process your request as quickly as possible.

Changes to this Privacy Policy

Kopexa continuously improves its website and services. Therefore, this Privacy Policy may be updated from time to time.

Changes will be communicated through an updated version on our website, an email notification or other appropriate communication channels. Continued use of our services after updates constitutes acceptance of the revised policy.

Contact and demo requests in our CRM

When you submit a contact or demo request, we transfer your details into our self-hosted CRM system Twenty. This includes your name, business email address, company, optional phone number, role, requirements and message, together with the form source, page path and submission time. We use these details to handle your request, assign a responsible team member and document follow-ups, scheduled demos and subsequent sales progress. Your request can be handled without measurement or marketing consent.

Only with measurement consent do we also store the submitted campaign parameters (UTM) and, where applicable, the landing-page experiment variant alongside your request. Advertising click identifiers are not transferred through this CRM integration. This CRM integration does not send contact details or sales outcomes to advertising platforms.

For internal sales and campaign reporting, we transfer selected opportunity data to Airtable (Formagrid Inc.). This includes the opportunity name and company, sales stage, deal value and currency, relevant dates, form source and landing page. Campaign and variant information is included only where it was collected with measurement consent. The automated reporting integration does not transfer contact email addresses, phone numbers or form messages. Provider information: Airtable Privacy Policy.

Contact

For privacy inquiries or data requests, contact us at:

Kopexa GmbH
Data Privacy Office
Schauenburgerstraße 116
24118 Kiel
Email: [email protected]

LinkedIn Insight Tag

We use the LinkedIn Insight Tag for retargeting on LinkedIn. It loads only with your consent to the “Marketing” category on the designated public pages. The provider is LinkedIn Ireland Unlimited Company, Dublin, Ireland. LinkedIn may process technical visit data such as page URL, browser information, IP address, time and cookie identifiers and match visits to a LinkedIn member account to build audiences and measure advertising performance. Processing outside the EEA is possible. We do not transmit form contents or contact lists through this integration. You can withdraw consent for the future using “Cookie settings” in the footer.

Further information: LinkedIn Privacy Policy and LinkedIn Cookie Policy.

Reddit Pixel: advertising measurement and retargeting

With your consent to the “Marketing” category, we load the Reddit Pixel on selected public product and landing pages. It reports page visits and successfully submitted requests to measure advertisements, retarget visitors and exclude confirmed requests from the relevant audiences. A reported lead means a submitted request, not a confirmed appointment. Without marketing consent, this pixel is not loaded.

Reddit receives technical data such as IP address, browser information, time, page address, event type and pseudonymous cookie and advertising-click identifiers. Our integration does not transmit names, email addresses, telephone numbers or form contents. Automated advanced matching and additional page metadata are disabled. Explicit page addresses contain no visitor-supplied query parameters or fragments.

The provider is Reddit. For users in the EEA and Switzerland, Reddit identifies Reddit Netherlands B.V., Looiersgracht 43, 1016 VR Amsterdam, Netherlands, as controller. Processing by Reddit, Inc. in the United States is possible. Reddit explains international transfers and its safeguards in its Privacy Policy.

The legal basis is your consent under Article 6(1)(a) GDPR and, for access to your device, Section 25(1) TDDDG. The pixel may set _rdt_uuid (browser identifier) and _rdt_cid (advertisement-click attribution) for up to 90 days. Cookie lifetimes do not specify retention of data already transmitted to Reddit. You can withdraw consent for the future using “Cookie settings” in the footer. Further information: Reddit Pixel and Reddit Cookie Notice.