Privacy Notice

Last updated: October 2026 · Covers the marketing site business-gym.ai and the app at app.business-gym.ai.

1. Controller

Archibo GmbH · Langen · represented by Managing Director Ziad Iqbal.
Email: info@archibo.de
Full contact: see Imprint.

2. Data Protection Officer

Under Sec. 38 BDSG and Art. 37 GDPR, Archibo GmbH is not required to appoint a Data Protection Officer. For any data-protection matter: info@archibo.de.

3. General principles

We process personal data of our users only insofar as it is necessary to provide a functional website, our content and our services. Processing is based on consent (Art. 6 (1)(a) GDPR), contract performance (Art. 6 (1)(b)), or legitimate interest (Art. 6 (1)(f)).

4. Hosting & data location

The marketing site is hosted and delivered by Hostinger International Limited (Larnaca, Cyprus) as our processor. App backend compute runs in the Germany West Central (Frankfurt) Azure region; application data is stored in the France Central (Paris) region.

5. Server logs

When the site is accessed, the server of our host Hostinger logs technically necessary data: time, IP address, page requested, device and browser (from the user agent), a country derived from the IP address, data size and response time (Art. 6 (1)(f) GDPR). Retention: Hostinger states no period for these logs; we are clarifying it and will state it here.

6. Cookies & tracking

Without your consent, the site stores only your cookie choice in your browser (in its local storage).

With your consent (Art. 6 (1)(a) GDPR, Sec. 25 (1) TDDDG) we load Google Tag Manager, which loads the following services:

Statistics: Google Analytics 4 by Google Ireland Limited to measure reach and Microsoft Clarity to analyse how the site is used.
Marketing: the Meta Pixel by Meta Platforms Ireland Limited for advertising and retargeting. We are joint controllers with Meta for collecting and transmitting data through the Pixel (Art. 26 GDPR).

Data may be transferred to the USA in the process; Google LLC and Microsoft Corporation are certified under the EU-U.S. Data Privacy Framework. You can withdraw your consent at any time via "Cookie settings" in the footer; the cookies of these services are then deleted.

7. Contact

If you contact us by email (e.g. hello@business-gym.ai), we process your details to handle the inquiry and any follow-up questions (Art. 6 (1)(b)/(f)). Retention: up to 6 months after closure, unless statutory retention applies.

7a. Analysis requests

If you request a 14-day analysis through our request form, the following applies to your details (including company, name and email address):

Controller: Archibo GmbH (see section 1); contact: info@archibo.de.
Purpose: handling and answering your request, preparing the analysis and contacting you about it.
Legal basis: Art. 6 (1)(b) GDPR (steps taken at your request before entering into a contract).
Recipients: Microsoft as processor for running the form and our CRM (Microsoft Dynamics 365); hosted in the EU.
Retention: will be set before the request form goes live, and stated here.
Your rights: access, rectification, erasure, restriction, objection and data portability (section 11), and a complaint to a supervisory authority (section 12).
Providing the data: it is not required by law or by contract. Without the required fields, however, we cannot answer your request or prepare the analysis; all other details are optional.

8. App use (app.business-gym.ai)

When you use the app, you, as the tenant, are the controller per GDPR. We act as processor per Art. 28 GDPR. We do not process your data to train any AI model.

9. Categories of personal data (app)

Account & tenant data (email, name, company info)
Content you enter or upload in the app (e.g. documents for the knowledge base, posts and offers); email, calendar and SharePoint only where a workspace connects these sources — customers cannot yet connect their own Microsoft 365
Usage and telemetry data (workflows, audit log, cost ledger)
Payment data (processed by Stripe Payments Europe Limited)

10. Processors and sub-processors

Provider	Purpose	Seat	Transfer outside the EEA
Microsoft Ireland Operations Ltd.	Running the app on Microsoft Azure (compute, database, search, embeddings via Azure OpenAI), CRM (Microsoft Dynamics 365)	IE	Processing in data centres in Germany and France (Dynamics 365: EU); Microsoft Corporation is certified under the EU-U.S. Data Privacy Framework
Anthropic Ireland, Limited	AI models (processing of inputs and outputs)	IE	To the USA possible; EU standard contractual clauses
OpenAI Ireland Ltd.	Image generation	IE	To the USA possible; EU standard contractual clauses
HeyGen Technology Inc.	Video generation	USA	EU-U.S. Data Privacy Framework
Zernio Software SL	Publishing posts to social networks for workspaces that connect Zernio; where a workspace brings its own Zernio account, Zernio processes the posts on that account	ES	To the USA possible through sub-processors; EU standard contractual clauses
Twilio Ireland Limited (SendGrid)	Transactional email	IE	To Twilio Inc. (USA)
Clerk, Inc.	Sign-in (authentication)	USA	EU-U.S. Data Privacy Framework
Stripe Payments Europe, Limited	Payment processing	IE	To Stripe, LLC (USA); EU-U.S. Data Privacy Framework
Hostinger International Limited	Hosting the website	CY	Where servers outside the EEA are used: EU standard contractual clauses

Current list available on request. Section 6 names the providers of the site's statistics and marketing services.

11. Your rights (Art. 12–23 GDPR)

Access (Art. 15)
Rectification (Art. 16)
Erasure ("right to be forgotten", Art. 17)
Restriction of processing (Art. 18)
Data portability (Art. 20)
Objection (Art. 21)
Withdraw consent at any time (Art. 7 (3))

Requests to info@archibo.de. We respond within 30 days.

12. Right to lodge a complaint

You have the right to lodge a complaint with the competent supervisory authority — e.g. the Hessian Commissioner for Data Protection and Freedom of Information (HBDI).

13. Changes to this notice

We update this notice when legal or technical changes require. See date above.