Privacy policy

Responsible party
GENERATOR.EU UG (limited liability)
Edisonstr. 8, 85716 Unterschleißheim, Germany
E-mail: info@generator.eu
Phone: +49 89 20175987

Contact for data protection
If you have any questions about the processing of your personal data and your rights, please contact: info@generator.eu.
(A company data protection officer is currently not appointed)

Status: 02/09/2025

---

1. hosting & server logs

We host our website at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany.

Processing takes place exclusively in data centres within the EU/EEA. There is an order processing contract with Hetzner in accordance with Art. 28 GDPR.

When the website is accessed, we automatically process server log data (URL/file accessed, date/time, amount of data transferred, referrer, browser/OS, IP address, provider).

Purpose/legal basis: Stability, security and presentation of the website (Art. 6 para. 1 lit. f GDPR).

Storage period: maximum 7 days, then deletion.

---

2. data categories, purposes and legal bases (overview)

Retell AI, Inc, 548 Market St, PMB 30534, San Francisco, CA 94104-5401, USA

---

3. processors & recipients

Hosting/CDN: Hetzner Online GmbH (AV contract; EU/EEA).

Shipping/forwarding: DPD Deutschland GmbH, DHL Paket GmbH, UPS, as well as contracted forwarding agents (delivery/schedule notification).

Dropshipping: Manufacturers/wholesalers ship on our behalf; legal claims (e.g. warranty, cancellation) continue to exist against us.

Payment service provider:

• PayPal (Europe) S.à r.l. & Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg - Data protection information: https://www.paypal.com/de/webapps/mpp/ua/privacy-full

• [enter another card acquirer/PSP here]

  Credit agency (only purchase on account): Tesch mediafinanz GmbH, Weiße Breite 5, 49084 Osnabrück.

Telecommunications/AI voice agent (processor):

• ElevenLabs, Inc, 2261 Market Street #4008, San Francisco, CA 94114, USA - Text-to-Speech/Speech-to-Text.

• Retell AI, Inc [add address], USA - voice routing/agent logic.
  AV contracts within the meaning of Art. 28 GDPR exist with all of the aforementioned service providers.

Third country transfers: Where services process data in third countries (in particular the USA), this is done on the basis of EU standard contractual clauses (SCCs); where the provider is certified under the EU-U.S. Data Privacy Framework (DPF), we also base transfers on this. Additional technical/organisational measures are taken (e.g. encryption/pseudonymisation) where necessary.

---

4 AI voice agent: Special features of voice processing

We optionally use an AI-supported voice assistant for telephone advice/support.

What data?

• Real-time audio data for speech recognition (streaming),
• Transcripts (text of the conversation),
• Metadata (timestamp, duration, session ID),
• if applicable, order/customer data that you provide during the conversation.

Purposes: efficient processing of enquiries, pre-qualification/recording of order requests, quality control, training of the system.

Legal basis:

• Art. 6 para. 1 lit. b GDPR (pre-contractual/contractual communication),
• Art. 6 para. 1 lit. f GDPR (legitimate interest in efficient support).
• Audio recordings (if offered) will only be made with your prior consent (Art. 6 para. 1 lit. a GDPR). Without consent, no storage of the raw audio takes place; at most, fleeting real-time processing takes place.
• Voice analyses (e.g. quality measurement, intent training) also only with consent; otherwise only earmarked live processing.

Storage duration:

• Raw audio (if recorded with consent): [e.g. 30 days], then deletion or anonymisation.

• Transcripts: [e.g. 180 days] for proof of interactions/service quality; then deletion/anonymisation.

• Metadata (technical logs): [e.g. 90 days].
  Exact periods may vary depending on the legal obligation to retain data (e.g. for evidence purposes). You can revoke your consent at any time (see "Your rights"); after revocation, no further recordings will be made and existing data will be deleted in accordance with the legal situation.

No automated individual decisions with legal effect (Art. 22 GDPR) - the voice agent does not make any legally binding decisions; orders only become effective with your express confirmation in the checkout or our order confirmation.

5. communication & dispatch notification

If you contact us by e-mail/telephone/contact form, we will process your details to process the enquiry (Art. 6 para. 1 lit. b/f GDPR).

For delivery announcements/appointment arrangements (shipping company), we will only pass on your e-mail/telephone to the shipping service provider with your consent (Art. 6 para. 1 lit. a GDPR). You can revoke this consent at any time.

6. payment & credit check

Depending on the payment method, we transmit payment data to the commissioned institution/the selected payment service (Art. 6 para. 1 lit. b GDPR).

In the case of purchase on account, we reserve the right to carry out a credit check with Tesch mediafinanz GmbH(Art. 6 para. 1 lit. f GDPR - avoidance of payment defaults). The decision is not exclusively automated; you can state your position and contest the decision.

---

7. cookies, consent banner (CMP) & web analytics

Legal basis according to TDDDG/DSGVO

• We only usenon-technically necessary cookies/technologies (e.g. statistics, marketing) with your consent: § 25 para. 1 TDDDG in conjunction with Art. 6 para. 1 lit. a GDPR.
• Technically necessary technologies: § 25 para. 2 TDDDG in conjunction with Art. 6 para. 1 lit. f GDPR (operation, IT security).

You can change/revoke your consent at any time via the "Cookie settings" link in the footer.

Google Analytics 4 (only with consent)

Provider: Google Ireland Limited (transmission to Google LLC/USA if necessary). IP anonymisation is activated. Transfers to the USA are based on SCCs and - where applicable - DPF certification of the provider.

Opt-out: via cookie settings or https://tools.google.com/dlpage/gaoptout.

Storage duration/cookie runtimes: see our cookie policy.

Google Ads Remarketing (only with consent)

Provider: Google Ireland Limited; transmission to Google LLC/USA (SCCs/DPF) if necessary. Opt-out: Cookie settings or Google ad settings.

---

8. social plugins (2-click solution)

Social plugins (e.g. Meta/Facebook, Instagram, YouTube) are deactivated until you actively load them (consent, Art. 6 para. 1 lit. a GDPR). Only then will a connection to the provider be established.

Data protection information of the providers:

• Meta/Facebook: https://www.facebook.com/policy.php
• Instagram (Meta): https://privacycenter.instagram.com/policy
• YouTube/Google: https://policies.google.com/privacy?hl=de

(Only list providers actually used).

---

9. storage periods (brief overview)

• Server logs: max. 7 days.
• Contract/invoice data: up to 10 years (statutory retention period).
• Customer account: until deletion.
• Contact enquiries: generally up to 3 years (evidence/claims).
• AI voice agent: as above (audio/transcript/metadata).

After expiry: deletion or anonymisation.

---

10. your rights

You have rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21) and withdrawal of consent (Art. 7 (3)).

To exercise these rights, please write to info@generator.eu.

Right to lodge a complaint:

Bavarian State Office for Data Protection Supervision (BayLDA)

Promenade 18, 91522 Ansbach, Germany - https://www.lda.bayern.de/

---

11. obligation to provide

The provision of data is sometimes necessary for the conclusion of a contract/delivery (e.g. address/payment data). No order can be processed without this information. For voluntary consents (analytics/remarketing/recorded voice), there are no disadvantages in the event of non-provision.

---

12. changes to this declaration

We will amend this declaration if the legal situation, services or processes change. The current version can be accessed at any time on this page.