Privacy Notice
This English translation is provided for convenience only. The German Datenschutzinformation is the legally authoritative version.
1. Controller
The controller within the meaning of the GDPR and other data protection provisions is:
Caserock AI GmbH
Rudolf-Diesel-Ring 10
82266 Inning am Ammersee
Germany
Represented by its managing director Dr. Andreas Minkoff.
Phone: +49 8143 9928882
Email: info@caserock.ai
2. Data protection officer
Baker Tilly Data Privacy GmbH
Nymphenburger Straße 3b
80335 Munich
Germany
Email: datenschutz_caserockai@bakertilly.de
3. General information on data processing on this website
When you visit this website, we process personal data only to the extent necessary to provide the website and to ensure its security and functionality, or where you provide data to us voluntarily, for example when contacting us.
Personal data means any information relating to an identified or identifiable natural person. This may include, in particular, name, contact details, IP address, communication content and technical usage data.
4. Visiting the website and server log files
When this website is accessed, technically necessary data is processed in order to deliver the website to your device, to ensure technical stability and to safeguard the security of our systems. This may include, in particular, the following data:
IP address, date and time of access, page or file accessed, referrer URL, browser type and version, operating system used, host name of the accessing device, volume of data transferred, and access status or HTTP status code.
This processing is based on Art. 6 (1) (f) GDPR. Our legitimate interest lies in the secure, stable and efficient provision of our website and in detecting and defending against attacks or other disruptions.
Server log files are generally deleted after no more than 30 days, unless security-relevant events, statutory retention obligations or the establishment, exercise or defence of legal claims require longer storage.
5. Hosting and technical provision of the website
This website is provided via Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, and delivered through its global content delivery network. To technically deliver the website, Cloudflare processes in particular connection and access data required for the operation and security of the website. A data processing agreement pursuant to Art. 28 GDPR is in place with Cloudflare.
In the course of this, personal data, in particular IP addresses and technical access data, may also be processed outside the European Union or the European Economic Area. Transfers to the USA take place on the basis of the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework, under which Cloudflare is certified; in addition, standard contractual clauses pursuant to Art. 46 (2) (c) GDPR have been agreed.
6. Domain administration and DNS
The domain caserock.ai is administered via IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. IONOS provides services in particular in connection with domain registration; DNS resolution is handled via Cloudflare's name servers (see section 5).
In the course of mere domain and DNS administration, IONOS does not generally process any content data arising from the use of this website. Where IONOS processes personal data in the course of domain administration, this is done for the technical and administrative provision of the domain and to fulfil statutory or contractual obligations.
7. Contact by email and via forms
You can reach us by email at the address provided. In addition, we provide forms on the contact page to request a product demonstration and to join the waiting list for CASEROCK AI, and a project enquiry form on the CASEROCK INVESTIGATIONS page. In the forms we collect your name, your email address and, optionally, your firm or company; the project enquiry form also contains an optional free-text field for a brief description of your matter. No other free-text fields are offered. When you submit a form, your entries are transmitted to our mailbox as an email via a server function of our hosting provider (see section 5). The entries are not stored on the web server beyond that.
If you contact us by email or submit a form, we process the data you provide. This may include, in particular, name, email address, telephone number, organisation, role, the content of your enquiry and any further information you provide voluntarily.
We process this data to handle your enquiry and to communicate with you. The legal basis is Art. 6 (1) (b) GDPR where your enquiry is directed at the conclusion or performance of a contract. In all other cases, the legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in the proper handling of and response to enquiries.
Joining the waiting list is based on your consent (Art. 6 (1) (a) GDPR). In that case we use your details exclusively to inform you about the development and launch of CASEROCK AI. You may withdraw your consent at any time with effect for the future, for example by email to info@caserock.ai; we will then delete your entry without delay.
Transfer to Caserock Investigations GmbH & Co. KG. If your demo request or project enquiry concerns the CASEROCK INVESTIGATIONS services (eDiscovery, Interview Suite, Storage), we pass your details on to the provider of those services, Caserock Investigations GmbH & Co. KG, Rudolf-Diesel-Ring 10, 82266 Inning am Ammersee, Germany. It handles your request under its own responsibility; the legal basis there is likewise Art. 6 (1) (b) GDPR. The data protection officer of Caserock Investigations GmbH & Co. KG is Baker Tilly Data Privacy GmbH, reachable at datenschutz-caserock@bakertilly.de. Your details are not passed on to any other third party. The waiting list concerns CASEROCK AI only; those details are not shared.
Applications. For applications for advertised positions we provide the address join@caserock.ai. We process the details and documents you send us with your application (in particular name, contact details, CV, references and any further information you provide voluntarily) exclusively to conduct the application procedure. The legal basis is Section 26 (1) of the German Federal Data Protection Act (BDSG) in conjunction with Art. 6 (1) (b) GDPR. If your application concerns a position at Caserock Investigations GmbH & Co. KG, we pass your documents on to that company; it conducts the procedure under its own responsibility. After the procedure has ended, we delete your documents no later than six months later, unless you have consented to longer storage or statutory retention obligations require otherwise.
We use Microsoft 365 to process incoming correspondence. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Microsoft processes personal data as a processor. Processing generally takes place within the Microsoft EU Data Boundary. Where data is processed outside the European Union or the European Economic Area, this is done in accordance with Art. 44 et seq. GDPR.
Protecting our forms against automated requests. To protect our forms against misuse by automated programs, we use Cloudflare Turnstile, a service of Cloudflare, Inc. (see section 5). On pages with a form, Turnstile checks, when the page is loaded and when the form is submitted, whether the request comes from a human, using technical characteristics of your connection and your browser, in particular your IP address and browser and device information. If the check is not passed, the form is not sent. Turnstile does not set cookies for advertising or analytics purposes. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in protection against spam and misuse. The access to information on your terminal device required for this is strictly necessary for sending the form you have requested (§ 25 (2) no. 2 TDDDG). For this purpose, Cloudflare processes the data on our behalf (Art. 28 GDPR). According to its own information, Cloudflare also uses the data as an independent controller to improve Turnstile's bot detection. For transfers to the USA, the information in section 5 applies. Further information: https://www.cloudflare.com/turnstile-privacy-policy/
We delete data from contact enquiries as soon as it is no longer required to handle the enquiry, unless statutory retention obligations apply or longer storage is required for the establishment, exercise or defence of legal claims. If the enquiry results in a contractual or mandate relationship, the retention periods applicable to that relationship apply. We delete waiting list entries no later than six months after the launch of CASEROCK AI unless you have withdrawn your consent before then.
8. Cookies, tracking and comparable technologies
We do not use any tracking cookies, marketing pixels or technologies for creating user profiles on this website.
For audience measurement, we use Cloudflare Web Analytics. Measurement takes place without cookies, without storing or accessing information on your terminal device and without device-based recognition; only aggregated information such as page views, referrers, country of origin and device type is collected. This processing is based on Art. 6 (1) (f) GDPR. Our legitimate interest lies in the statistical analysis and improvement of our website.
Where technically necessary access to information on your terminal device or technically necessary storage takes place, this serves exclusively to provide the website. The legal basis for accessing or storing information on your device is § 25 (2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG), where such access or storage is strictly necessary for us to provide the website you have expressly requested. Any subsequent processing of personal data is based on Art. 6 (1) (f) GDPR. This also applies to the check by Cloudflare Turnstile on pages with a form (see section 7).
Should cookies that are not technically necessary, consent-based analytics or marketing technologies, or comparable services be used in the future, we will update this privacy notice accordingly and, where required, obtain your prior consent.
9. External links and social media references
This website may contain links to external websites or to Caserock profiles on third-party platforms, in particular professional networks such as LinkedIn. As long as you do not click on such links, no personal data is generally transferred to the respective third-party providers through the mere presence of the link.
If you follow an external link, you leave our website. The respective provider is responsible for any subsequent data processing. Please note the privacy information of the respective provider.
10. Recipients of personal data
Within Caserock, only those persons who need personal data to perform their tasks are given access to it. In addition, personal data may be transferred to external service providers where this is necessary for the operation of the website, communication, IT security or administrative purposes.
These include, in particular, hosting and website service providers, domain and DNS service providers, IT and communication service providers and external advisors. Where service providers process personal data on our behalf, we conclude data processing agreements with them pursuant to Art. 28 GDPR.
11. Third-country transfers
Processing of personal data outside the European Union or the European Economic Area cannot be entirely ruled out, in particular in connection with technical infrastructure services, support services or cloud-based services.
Where personal data is transferred to a third country, this only takes place if the requirements of Art. 44 et seq. GDPR are met. This may be the case, in particular, where an adequacy decision of the European Commission exists for the third country concerned, where appropriate safeguards such as standard contractual clauses have been agreed, or where another legal basis for the transfer exists.
12. Storage period
We store personal data only for as long as necessary for the respective purposes. The data is then deleted, unless statutory retention obligations apply or longer storage is required for the establishment, exercise or defence of legal claims.
Specific storage periods are set out in the respective sections of this privacy notice. Server log files are generally deleted after no more than 30 days. Data from contact enquiries is deleted once the enquiry has been conclusively handled, unless statutory retention obligations or legitimate grounds for longer storage exist.
13. Your rights
Subject to the statutory requirements, you have the following rights:
You have the right of access to the personal data concerning you pursuant to Art. 15 GDPR. You have the right to rectification of inaccurate personal data pursuant to Art. 16 GDPR. You have the right to erasure of personal data pursuant to Art. 17 GDPR. You have the right to restriction of processing pursuant to Art. 18 GDPR. You have the right to data portability pursuant to Art. 20 GDPR. You have the right to object to the processing of personal data pursuant to Art. 21 GDPR.
Where processing is based on your consent, you have the right to withdraw your consent at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.
14. Right to object under Art. 21 GDPR
Where we process personal data on the basis of Art. 6 (1) (f) GDPR, you have the right to object to such processing at any time on grounds relating to your particular situation.
We will then no longer process the personal data concerned, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
15. Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of personal data concerning you infringes data protection law.
The supervisory authority responsible for Caserock is:
Bayerisches Landesamt für Datenschutzaufsicht (Bavarian State Office for Data Protection Supervision)
Promenade 18
91522 Ansbach
Germany
https://www.lda.bayern.de
16. No automated decision-making
No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place when you visit this website.
17. Status and updates of this privacy notice
We reserve the right to amend this privacy notice if legal, technical or factual circumstances change. The current version is available on this website at any time.
Status: October 2026