Privacy Policy
This policy informs you about the type, scope, and purpose of the processing of personal data within our online offering.
Version: August 2, 2026 — revised edition for the new website.
How does Open Experience handle your data?
The controller responsible for data processing is Open Experience GmbH, Amalienstraße 1, 76133 Karlsruhe, Germany. This website is static and loads no third-party content: fonts, images, and videos are hosted on our own servers in Germany. Without your consent, we process only the technically required access data (server log files, deleted or anonymized after 14 days at the latest). Everything else — audience measurement, contact inquiries, Experience ID, newsletter — is described below with purpose, legal basis, recipients, and retention period.
Scope and controller
This privacy policy applies to our entire online offering: the Open Experience website, the Open Experience services, the Open Experience apps, and the Open Experience social media profiles.
- ControllerThe controller within the meaning of data protection law, in particular the EU General Data Protection Regulation (GDPR), is: Open Experience GmbH, Managing Director Konstantin Krahtov, Amalienstraße 1, 76133 Karlsruhe, Germany, email info@openexperience.de.
- Questions about data protectionIf you have questions about data protection, please email us at info@openexperience.de or call +49 721 486995-20.
What data we process
- Categories of data processedMaster data (e.g. names, addresses), contact data (e.g. email), content data (e.g. text input), usage data (e.g. pages visited, interest in content, access times), and meta and communication data (e.g. device information, IP addresses).
- Data subjectsCustomers, prospects, and suppliers, as well as visitors and users of the online offering.
- Purpose of processingProvision of the online offering, its content, and functions; responding to contact inquiries and communicating with users; marketing, advertising, and market research; security measures.
- Special categories of dataNo special categories of data within the meaning of Art. 9 (1) GDPR are processed.
Your rights
You can exercise your rights at any time using the contact details given above.
- Access, rectification, erasureAccess to the data we store about you and its processing (Art. 15 GDPR), rectification of inaccurate personal data (Art. 16 GDPR), and erasure of the data we store about you (Art. 17 GDPR).
- Restriction, objection, portabilityRestriction of data processing where we are not yet permitted to delete your data due to legal obligations (Art. 18 GDPR), objection to the processing of your data (Art. 21 GDPR), and data portability where you have consented to the data processing or have concluded a contract with us (Art. 20 GDPR).
- Withdrawal of consentWhere you have given us your consent, you can withdraw it at any time with effect for the future.
- Complaint to a supervisory authorityYou can lodge a complaint with a supervisory authority at any time, e.g. with the supervisory authority of the German federal state where you reside or with the authority responsible for us. A list of the supervisory authorities with their addresses is available on the website of the German Federal Commissioner for Data Protection and Freedom of Information (bfdi.bund.de).
Access data when visiting this website
When you access our online offering or our services without registering or otherwise submitting information, information of a general nature is collected automatically (server log files): for example, the type of web browser, the operating system used, the domain name of your internet service provider, and your IP address.
- PurposeEnsuring a trouble-free connection and smooth use, evaluating system security and stability, and optimizing our online offering. We do not use this data to draw conclusions about you as a person.
- Legal basisProcessing is carried out in accordance with Art. 6 (1) (f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website.
- RecipientsRecipients of the data may be technical service providers acting as processors for the operation and maintenance of our online offering.
- Retention periodThe data is deleted as soon as it is no longer required for the purpose for which it was collected — for log files, after 14 days at the latest. Storage beyond this period is possible; in that case, the IP addresses are anonymized so that the requesting client can no longer be identified.
- Is provision required?Provision is required neither by law nor by contract. However, without the IP address, the functioning of the website cannot be guaranteed; for this reason, an objection is excluded.
Cookies
Cookies are small text files that are stored on your device when you visit our online offering. You can delete individual cookies or the entire cookie inventory via your browser settings and block their storage in advance.
- Technically necessary cookiesSome elements of our online offering require that the requesting browser can be identified even after a page change — for example, the authentication token of the services (ox.auth.token) and the session identifier (JSESSIONID); both expire at the end of the browser session. The legal basis is Art. 6 (1) (f) GDPR (user-friendly design).
- Cookies that are not technically necessaryCookies that serve to tailor content to our visitors' interests or for statistical analysis are set only with your consent (Art. 6 (1) (a) GDPR). You can also use our online offering without these cookies.
- Withdrawal of consentYou can withdraw your consent at any time via our cookie consent tool; your choice then applies from your next visit.
- ProfilingWe do not create pseudonymized user profiles to analyze the behavior of website visitors beyond the audience measurement described in the next section.
The static pages of this website do not set any cookies themselves; the cookies mentioned originate from the Services/MyAccount applications.
Audience measurement
We want to know which content is being read — without tracking you.
- Statistics without personal profilesFor audience measurement, we use a self-hosted analytics solution (Plausible Community Edition on our own servers). It works without cookies, without cross-device identifiers, and without transfers to third countries; only aggregated metrics are evaluated. The legal basis is Art. 6 (1) (f) GDPR.
- Marketing measurement only with consentWe load Google services (Google Analytics 4, Google Ads conversion tracking) only if you have consented in the consent tool (Art. 6 (1) (a) GDPR, Consent Mode v2). The operator is Google Ireland Limited or Google LLC; data may be transferred to the USA in the process. You can withdraw your consent at any time with effect for the future.
Fonts, images, and external content
- No third-party script librariesThis website does not load any fonts, scripts, or styles from external servers. We serve the Inter font ourselves; no connection to Google Fonts or comparable services is established.
- Images and videosAll images and videos are hosted on our own servers. We do not embed any video platforms, map services, or social media widgets that would transfer data to third parties when a page is loaded.
- Linked offeringsLinks to external offerings (e.g. app stores, our appointment booking, the application portal) are recognizable from their context. Only when you click such a link does the respective provider receive data from you — at that point, its privacy policy applies.
Hosting and data location
- Servers in GermanyWe operate the website, services, and hosting in Germany. The data center and infrastructure providers we use act as processors pursuant to Art. 28 GDPR.
- Delivery of static filesImages, fonts, and styles may be delivered via our own delivery domain. The same access data is generated as when visiting the website.
Contact inquiries, demo appointments, and callbacks
- Type and purposeThe data you enter is stored for the purpose of individual communication with you. A valid email address and your name are required — they serve to assign the inquiry and to respond to it. Further information is optional.
- Legal basisProcessing is based on a legitimate interest (Art. 6 (1) (f) GDPR). If you request a quote, processing is carried out to perform pre-contractual measures (Art. 6 (1) (b) GDPR).
- Retention periodData is deleted no later than 6 months after the inquiry has been processed. If a contractual relationship is established, we are subject to the statutory retention periods under the German Commercial Code (HGB) and delete the data once these periods have expired.
- Appointment bookingFor booking a demo appointment, we use our own booking system under the domain oxprozesse.de. There you provide your name, email address, and preferred date; the data is used exclusively to conduct the appointment.
Experience ID, registration, and paid services
- RegistrationFor registration, we require some personal data, which is submitted to us via an input form; in addition, a timestamp and IP address are collected. Registration is required for providing certain content and services. The legal basis is your consent (Art. 6 (1) (a) GDPR); the data is processed only as long as the consent is in place.
- Paid servicesTo provide paid services, we request additional data, such as payment details, in order to process your order. The legal basis is Art. 6 (1) (b) GDPR. We store this data until the statutory retention periods have expired — generally 6 or 10 years for reasons of proper accounting and tax law requirements.
- RecipientsRecipients of the data may be processors acting for the operation and maintenance of the services.
Newsletter and product information
- Double opt-inFor the delivery of product and service information, we collect a valid email address. To verify that the sign-up was actually made by the owner of the address, we use the double opt-in procedure: we log the sign-up, the dispatch of the confirmation email, and the receipt of the reply. No further data is collected.
- Legal basis and withdrawalThe basis is your explicitly given consent (Art. 6 (1) (a) GDPR). You can withdraw it at any time with effect for the future — via the link in every email or via the contact details given above. The data is then deleted.
Job applications
Applications reach us via the portal of Workwise GmbH or directly by email.
- Workwise application portalRecruitment on behalf of job seekers or employers is not processing on behalf of a controller, but the use of an external specialist service provided by an independent controller (Bavarian Data Protection Authority (LDA Bayern), FAQ list of July 20, 2018). The Workwise privacy policy applies to processing on the platform.
- Application by emailIf you send us your documents directly, we process them exclusively to conduct the application procedure (Section 26 of the German Federal Data Protection Act (BDSG), Art. 6 (1) (b) GDPR) and delete them no later than six months after the procedure has been completed, unless you have consented to longer storage.
Encryption
To protect the security of your data during transmission, we use state-of-the-art encryption methods (TLS/SSL) over HTTPS.
Information about your right to object under Art. 21 GDPR
- Right to object in individual casesYou have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you that is carried out on the basis of Art. 6 (1) (f) GDPR; this also applies to profiling based on this provision within the meaning of Art. 4 (4) GDPR.
- Consequence of an objectionIf you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defense of legal claims.
- Recipient of an objectionOpen Experience GmbH, Amalienstraße 1, 76133 Karlsruhe, Germany, email info@openexperience.de, phone +49 721 486995-20.
Changes to this privacy policy
We reserve the right to adapt this privacy policy so that it always meets current legal requirements or to implement changes to our services, for example when introducing new services. The new privacy policy will then apply to your next visit.
The original version of this privacy policy was created with the help of activeMind AG (version #2020-09-30) and revised for the new website.
Questions about data protection?
Write to info@openexperience.de or call +49 721 486995-20. For inquiries about your rights, a short message is all it takes.