Snapshot 249996
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Privacy policy We are very delighted that you have shown interest in our enterprise. Data protection is of a particularly high priority for the management of the deepset GmbH. Updated 23 October 2026 This privacy policy (“Policy”) explains how deepset GmbH (“deepset”, “we”, or “us”) handles personal data about you when you visit our website at deepset.ai, when you contact us or receive marketing from us, and when you hold an account for deepset’s Haystack Enterprise Platform. Where this Policy says “you”, we mean the individual whose personal data we process; the GDPR refers to this person as the “data subject”. This Policy does not cover personal data processed within a customer’s own deployment of the Haystack Enterprise Platform, where deepset acts as a processor on that customer’s instructions rather than as the controller. In circumstances when the processing of personal data is necessary and there is no statutory basis for such processing, we will ask for your consent. The processing of personal data, such as your name, address, email address, or telephone number, shall always be in line with the General Data Protection Regulation (GDPR), and in accordance with the country-specific data protection regulations applicable to deepset. By means of this Policy, we would like to inform the general public of the nature, scope, and purpose of the personal data we collect, use and process. Furthermore, this Policy informs you of the rights to which you are entitled. As the controller, deepset has implemented numerous technical and organisational measures to ensure the most complete protection of personal data processed through this website. However, Internet-based data transmissions may in principle have security gaps, so absolute protection may not be guaranteed. For this reason, you are free to transfer personal data to us via alternative means, for example by telephone. 1. Definitions This Policy is based on the terms used by the European legislator for the adoption of the General Data Protection Regulation (GDPR). This Policy should be legible and understandable for the general public, as well as our customers and business partners. To ensure this, we would like to first explain the terminology used. In this Policy, we use, inter alia, the following terms: a) Personal data Personal data means any information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. b) Data subject Data subject is any identified or identifiable natural person, whose personal data is processed by the controller responsible for the processing. c) Processing Processing is any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. d) Restriction of processing Restriction of processing is the marking of stored personal data with the aim of limiting their processing in the future. e) Profiling Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements. f) Pseudonymisation Pseudonymisation is the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person. g) Controller or controller responsible for the processing Controller or controller responsible for the processing is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law. h) Processor Processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller. i) Recipient Recipient is a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing. j) Third party Third party is a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data. k) Consent Consent of the data subject is any freely given, specific, informed and unambiguous indication of the data subject's wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them. 2. Name and address of the controller Controller for the purposes of the General Data Protection Regulation (GDPR), other data protection laws applicable in Member states of the European Union and other provisions related to data protection is: deepset GmbH Zinnowitzer Str. 1, 3rd Floor 10115 Berlin Email: privacy@deepset.ai Website: www.deepset.ai 3. Data Protection Officer contact details Data Protection Officer contact email: dpo@deepset.ai You may contact our Data Protection Officer at any time with any questions or suggestions concerning data protection. 4. Cookies and similar technologies Our website uses cookies. Cookies are text files that are stored on a device by a browser. Many websites and applications use cookies. Many cookies contain a so-called cookie ID. A cookie ID is a unique identifier consisting of a character string that lets websites and servers associate the cookie with the specific browser that stored it. This allows a website to tell one visitor's browser apart from another, since each browser stores its own separate cookies. Which cookies we use We manage cookies and similar technologies through a consent management tool (the “consent tool”). The consent tool appears as a banner on your first visit to our website (the “consent banner”) and can be reopened at any time via the “Privacy settings” link on our website (the “privacy settings”). The consent tool groups cookies and similar technologies into the four categories below. These are the same categories shown in the consent banner, so you can match what you see there to the descriptions here. For each category we set out the purpose. The legal bases we rely on are set out in Section 9 below. The consent tool itself lists the specific technologies and providers currently in use in each category, and is the authoritative and most up-to-date source for that detail. Essential Purpose: These technologies are required to provide the core functionality of our website and services, for example maintaining a session, enabling secure log-in, balancing load, and remembering your consent choices. Without them the website cannot be provided as intended. Functional Purpose: These technologies enable additional features that are not strictly necessary, for example embedded content, support chat, or remembering display preferences, in order to improve how the website works for you. Statistics Purpose: These technologies help us understand how visitors find and use our website, which pages are visited and for how long, so that we can measure and improve it. The information is analysed in aggregate for reporting purposes, though the underlying identifiers may still relate to you. Marketing Purpose: These technologies are used to measure the effectiveness of our campaigns and to show content and advertising that is relevant to your interests, including on third-party platforms. Managing your consent Except for essential technologies, we only set cookies after you have given consent through the consent banner shown on your first visit to our website. You can review, change, or withdraw your consent at any time using the privacy settings link on our website, where you can also see the storage duration of each technology in use. As an additional measure, you can, at any time, prevent cookies from being set through our website by changing the setting of the browser used, and can thus permanently refuse cookies. Furthermore, already set cookies may be deleted at any time via a browser or other software. This is possible in all popular browsers. If you disable cookies in the browser used, not all functions of our website may be entirely usable. 5. Collection of general data and information Our website collects a series of general data and information when you or an automated system call up the website. This general data and information are stored in the server log files. Collected may be (1) the browser types and versions used, (2) the operating system used by the accessing system, (3) the website from which an accessing system reaches our website (so-called referrers), (4) the sub-websites, (5) the date and time of access to the website, (6) an Internet protocol address (IP address), (7) the Internet service provider of the accessing system, and (8) any other similar data and information that may be used in the event of attacks on our IT systems. When using these general data and information, we do not draw any conclusions about you. Rather, this information is needed to (1) deliver the content of our website correctly, (2) optimise the content of our website as well as its advertisement, (3) ensure the long-term viability of our IT systems and website technology, and (4) provide law enforcement authorities with the information necessary for criminal prosecution in case of a cyber-attack. Therefore, we analyse this data and information statistically, with the aim of increasing our data protection and data security, and to ensure an optimal level of protection for the personal data we process. Server log file data, including the IP address, is stored separately from other personal data you provide to us directly. The legal basis for this processing is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and stable operation of our website and IT systems. Server log files are deleted after 60 days, unless longer retention is required to investigate a specific security incident. 6. Contact forms and email Our website includes an email address and contact forms so you can reach us directly. If you contact us by email or through a contact form, we store the personal data you send us in order to process your enquiry or respond to you. This data may be shared with processors that support our contact and marketing operations, for example our CRM provider, acting on our instructions and bound by data processing agreements. We use Salesforce as our CRM provider. The data is hosted in the European Union. Where access from outside the EEA cannot be ruled out, for example for support purposes, it is safeguarded by Salesforce's Binding Corporate Rules for processors (Art. 47 GDPR) and Standard Contractual Clauses (Art. 46(2)(c) GDPR). 7. Haystack Enterprise Platform accounts If you hold an account for the Haystack Enterprise Platform, we process the personal data required to create and manage your account and to provide the platform, in particular your name, business email address, company and login credentials, as well as usage and log data generated when you use the platform (for example login times and IP address) for security purposes. The legal basis is Art. 6(1)(b) GDPR where you are our contractual partner, and otherwise Art. 6(1)(f) GDPR, based on our legitimate interest in providing the platform to the organisation that has given you access and in keeping it secure. We store account data for as long as your account exists and delete it after the account has been closed, unless statutory retention obligations apply. Platform log data is deleted after 60 days. 8. Marketing communications If you subscribe to our newsletter or other marketing emails, we process your email address and, where provided, your name and company in order to send you these communications. We use the double opt-in procedure and log the time of registration and confirmation so that we can prove your consent. The legal basis is your consent under Art. 6(1)(a) GDPR. You can unsubscribe or withdraw your consent at any time via the link in each email or by contacting us. Withdrawal does not affect the lawfulness of processing carried out before it. We store your data until you unsubscribe. 9. Legal basis for the processing Art. 6(1)(a) GDPR serves as the legal basis for processing operations for which we obtain consent for a specific processing purpose. If the processing of personal data is necessary for the performance of a contract to which you are party, as is the case, for example, when processing operations are necessary for the supply of goods or to provide any other service, the processing is based on Art. 6(1)(b) GDPR. The same applies to such processing operations which are necessary for carrying out pre-contractual measures, for example in the case of enquiries concerning our products or services. Where we are subject to a legal obligation by which processing of personal data is required, such as for the fulfilment of tax obligations, the processing is based on Art. 6(1)(c) GDPR. In rare cases, the processing of personal data may be necessary to protect your vital interests or those of another natural person. This would be the case, for example, if a visitor were injured on our premises and their name, age, health insurance data or other vital information would have to be passed on to a doctor, hospital or other third party. Then the processing would be based on Art. 6(1)(d) GDPR. Finally, processing operations could be based on Art. 6(1)(f) GDPR. This legal basis is used for processing operations which are not covered by any of the above mentioned legal grounds, if processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms which require protection of personal data. Such processing operations are particularly permissible because they have been specifically mentioned by the European legislator, which considered that a legitimate interest could be assumed if you are a client of the controller (Recital 47 Sentence 2 GDPR). In practice, this means: consent (Art. 6(1)(a) GDPR) is the basis for non-essential cookies and any opt-in marketing communications; contract (Art. 6(1)(b) GDPR) is the basis for account provisioning and providing services requested by a customer or prospect; legal obligation (Art. 6(1)(c) GDPR) is the basis for tax and commercial record-keeping; and legitimate interests (Art. 6(1)(f) GDPR) is the basis for website security, fraud prevention, and the statistical evaluation of server log files described in Section 5. Cookie-based analytics (the Statistics category in Section 4) always relies on your consent. Cookies and similar technologies. Where we use cookies or similar technologies that are not strictly necessary to provide our website (the Functional, Statistics, and Marketing categories described in Section 4), we rely on your consent under Art. 6(1)(a) GDPR. Storing information on, or accessing information already stored on, your device additionally requires consent under § 25(1) TDDDG, which we obtain through the consent banner described in Section 4. Essential technologies are exempt from that consent requirement under § 25(2) No. 2 TDDDG, because they are strictly necessary to provide the service you have requested; the associated processing is based on Art. 6(1)(b) or Art. 6(1)(f) GDPR. You may withdraw your consent at any time as described in Section 4. Withdrawal does not affect the lawfulness of processing carried out before it. 10. The legitimate interests pursued by the controller or by a third party Where the processing of personal data is based on Art. 6(1)(f) GDPR, our legitimate interests include maintaining the security and proper functioning of our website, IT systems and the Haystack Enterprise Platform, preventing fraud and misuse, the statistical evaluation of server log files (Section 5), and providing the Haystack Enterprise Platform to the organisation that has given you access (Section 7), each balanced against your interests and fundamental rights. We do not rely on legitimate interests for cookie-based analytics, which requires your consent (see Section 4). 11. Third-party recipients and international transfers Some of the services we use to operate our website and run our business process personal data outside the European Economic Area. Where that happens, we rely on a transfer mechanism recognised under Chapter V GDPR. The position for each relevant provider is set out below. Google Analytics We use Google Analytics to understand how visitors use our website, as described under the Statistics category in Section 4 above. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (or Google LLC, as applicable). We use Google Analytics 4 (GA4). Google processes this data to provide us with reports on how our website is used. Data collected through Google Analytics, including your IP address, may be transmitted to and stored by Google in the United States. Google LLC is certified under the EU-US Data Privacy Framework, so the transfer is based on the European Commission's adequacy decision of 10 July 2023 (Art. 45(1) GDPR). In addition, Google has agreed to Standard Contractual Clauses (Art. 46(2)(c) GDPR), which apply if the adequacy decision no longer covers the transfer. Google may share this data with its own sub-processors as described in Google's privacy policy, linked below. You can withdraw your consent to Google Analytics at any time using the privacy settings described in Section 4 above. Further information and the applicable data protection provisions of Google may be retrieved under https://www.google.com/intl/en/policies/privacy/ and under https://www.google.com/analytics/terms/us.html. Google Analytics is further explained under the following link https://www.google.com/analytics/. Other services managed through our consent tool Some of the services in the Functional, Statistics and Marketing categories (see Section 4) may transfer personal data to countries outside the EEA. For each of these services, our consent tool shows the provider, the country of processing and the safeguard used for the transfer, i.e. an adequacy decision of the European Commission (Art. 45 GDPR), for example under the EU-US Data Privacy Framework, or Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can display these services under “Data Transfer to Third Countries” in the privacy settings, which you can open at any time via the link on our website. We only use such services where an appropriate safeguard is in place. You can obtain a copy of the Standard Contractual Clauses from our Data Protection Officer. Video conferencing and call recording We use Google Meet (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) for video calls and Fathom (Fathom Video Inc., 2261 Market Street #4156, San Francisco, CA 94114, USA) to record and transcribe calls with customers, prospects and business partners. We only record or transcribe a call if all participants have been informed in advance and have agreed. If you would prefer not to be recorded, please let us know before the call, or say so at any time during it, and we will stop or delete the recording accordingly. The legal basis for the recording and transcription is your consent under Art. 6(1)(a) GDPR. The call itself is based on Art. 6(1)(b) GDPR where it relates to a contract with you or to steps prior to entering into a contract, and otherwise on Art. 6(1)(f) GDPR, based on our legitimate interest in communicating efficiently with our business contacts. Data may be transferred to the United States. Google LLC is certified under the EU-US Data Privacy Framework (Art. 45(1) GDPR). For Fathom, the transfer is based on the EU-US Data Privacy Framework (Art. 45(1) GDPR) / Standard Contractual Clauses (Art. 46(2)(c) GDPR). 12. Period for which the personal data will be stored We store personal data only for as long as necessary for the purposes for which it was collected, and thereafter only for any period required or permitted by law. The criteria we use to determine that period include: how long the data is needed to provide the service or respond to the request for which it was collected; whether you have an ongoing account or business relationship with us; whether we are subject to a statutory retention obligation, in particular under German commercial and tax law (§ 257 HGB and § 147 AO, which require certain records to be kept for six, eight or ten years, depending on the type of record); whether the data may be needed to establish, exercise, or defend legal claims, having regard to the applicable limitation periods; and, for processing based on consent, whether that consent has been withdrawn. Where none of these apply, the data is deleted or anonymised. 13. Obligation to provide personal data We clarify that the provision of personal data is partly required by law (e.g. tax regulations) or can also result from contractual provisions (e.g. information on the contractual partner). Sometimes, in order to conclude a contract, you may need to provide us with personal data, which we must then process. You are, for example, obliged to provide us with personal data when we sign a contract with you. If you do not provide that data, the contract could not be concluded. Before providing personal data, you should contact us. We will clarify whether the provision of the personal data is required by law or contract or is necessary for the conclusion of the contract, whether there is an obligation to provide the personal data and the consequences of non-provision of the personal data. 14. Existence of automated decision-making We do not use automated decision-making within the meaning of Art. 22 GDPR. Profiling for marketing purposes only takes place with your consent (see the Marketing category in Section 4). 15. Your rights To exercise any of the rights described below, you may contact our Data Protection Officer at any time, using the contact details in Section 3. Right to object (Art. 21 GDPR): Where we process your personal data on the basis of Art. 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation. Where we process your personal data for direct marketing purposes, you can object at any time without giving reasons, and we will then no longer process your data for that purpose. Details are set out under g) below. a) Right of confirmation You have the right to obtain confirmation from us as to whether or not personal data concerning you are being processed. b) Right of access You have the right to obtain from us at any time, free of charge, information about the personal data we store about you and a copy of that data. You also have the right to the following information: the categories of personal data concerned; the purposes of the processing; the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; the existence of the right to request from the controller rectification or erasure of personal data, or restriction of processing of personal data concerning you, or to object to such processing; the existence of the right to lodge a complaint with a supervisory authority; where the personal data are not collected from you, any available information as to their source; the existence of automated decision-making, including profiling, referred to in Art. 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for you. You also have the right to be informed whether personal data are transferred to a third country or to an international organisation and, where this is the case, of the appropriate safeguards relating to the transfer. c) Right to rectification You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement. d) Right to erasure (Right to be forgotten) You have the right to obtain from us the erasure of personal data concerning you without undue delay, and we are obliged to erase personal data without undue delay where one of the following grounds applies, unless the processing is necessary for one of the reasons set out in Art. 17(3) GDPR: The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; You withdraw the consent on which the processing is based under Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, and there is no other legal ground for the processing; You object to the processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21(2) GDPR; The personal data have been unlawfully processed; The personal data must be erased for compliance with a legal obligation in Union or Member State law to which we are subject; The personal data have been collected in relation to the offer of information society services referred to in Art. 8(1) GDPR. Where one of the above grounds applies and you request erasure of personal data stored by us, we will comply with the request without undue delay. Where we have made personal data public and are obliged pursuant to Art. 17(1) GDPR to erase it, we will, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform other controllers processing the personal data that you have requested the erasure by such controllers of any links to, or copy or replication of, those personal data, as far as processing is not required. e) Right of restriction of processing You have the right to obtain from us restriction of processing where one of the following applies: You contest the accuracy of the personal data, for a period enabling us to verify the accuracy of the personal data; The processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead; We no longer need the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims; You have objected to processing pursuant to Art. 21(1) GDPR, pending verification of whether our legitimate grounds override yours. Where one of the above conditions is met and you request restriction of processing of personal data stored by us, we will arrange the restriction. f) Right to data portability You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, and to transmit those data to another controller without hindrance from us, where the processing is based on consent under Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, or on a contract under Art. 6(1)(b) GDPR, and the processing is carried out by automated means. This does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us. In exercising your right to data portability pursuant to Art. 20(1) GDPR, you also have the right to have the personal data transmitted directly from us to another controller, where technically feasible and where doing so does not adversely affect the rights and freedoms of others. g) Right to object You have the right to object at any time, on grounds relating to your particular situation, to processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR. This also applies to profiling based on these provisions. If you object, we will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. If we process personal data for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing. This also applies to profiling to the extent that it is related to such direct marketing. If you object to processing for direct marketing purposes, we will no longer process the personal data for these purposes. In addition, you have the right, on grounds relating to your particular situation, to object to processing of personal data concerning you by us for scientific or historical research purposes, or for statistical purposes pursuant to Art. 89(1) GDPR, unless the processing is necessary for the performance of a task carried out for reasons of public interest. In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications. h) Automated individual decision-making, including profiling You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless the decision (1) is necessary for entering into, or the performance of, a contract between you and a controller, (2) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests, or (3) is based on your explicit consent. If the decision (1) is necessary for entering into, or the performance of, a contract between you and a controller, or (2) is based on your explicit consent, we will implement suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention on our part, to express your point of view and to contest the decision. i) Right to withdraw data protection consent You have the right to withdraw your consent to the processing of your personal data at any time. Withdrawal does not affect the lawfulness of processing carried out before it. j) Right to lodge a complaint with a supervisory authority Without prejudice to any other remedy, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular in the EU Member State of your habitual residence, place of work or place of the alleged infringement. The supervisory authority responsible for deepset is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI), Alt-Moabit 59-61, 10555 Berlin, telephone +49 30 13889-0, mailbox@datenschutz-berlin.de, www.datenschutz-berlin.de. Get In-Depth Learning & News in Your Inbox Resources Blog Webinars Reports & Guides Success Stories News Platform Haystack Enterprise Platform Documentation OPEN SOURCE Haystack Documentation ABOUT About Us Partners Careers OFFICES HQ Berlin Zinnowitzer Str. 1, 3rd Floor 10115 Berlin Germany HQ New York 165 Broadway One Liberty Plaza 23rd Floor New York City, NY 10006 Contact Contact Us SOLUTIONS Enterprise Public Sector Defense deepset on Linkedin deepset on X deepset on discord deepset on Youtube Trust CenterPrivacyImprintTerms and Conditions