Privacy policy

This policy applies to the website pickedfirst.ai (offer PickedFirst). For websites we build or run for clients, the respective client is the controller; their privacy policy and our data processing agreement (www.nxtlvl-corp.com/avv, German) apply there.

1. Controller

NEXTLEVEL CORPORATE SERVICE PROVIDER - FZCO, Building A1, IFZA Business Park, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates (DIEZ License No. 67837), represented by Tassilo Peter Seitz (General Manager).

Email for data protection questions and exercising your rights: [email protected], phone: +49 176 84294769
You can contact us directly with any data protection matter at any time.

Data protection officer: No data protection officer has been appointed at present. The contact is the controller at the address above.

2. Overview

We ourselves use no cookies, no advertising services, no social media plug-ins, no third-party content that loads without your action (e.g. videos, maps, chat windows) and no third-party fonts on the website. We do not build user profiles and do not track you across other websites. We serve all files of the site ourselves (fonts „Fraunces“ and „Geist“, images, scripts and film sequences) and do not embed any analytics or measurement scripts. Payment (Stripe), appointment booking (Cal.com) and WhatsApp are only reachable via links or buttons; data is only transferred to the respective provider when you click. We do not make automated decisions within the meaning of Art. 22 GDPR and do not sell data.

Obligation to provide data: You are not obliged to provide us with data. Without the technically necessary connection data (section 3), however, the website cannot be displayed; without your contact details we cannot reply to you, and without order and billing details we cannot perform a contract.

3. Hosting and server logs (Cloudflare)

The website is delivered via Cloudflare Pages (Cloudflare, Inc., USA; global network, delivery from the nearest location). When you access it, Cloudflare processes, as technically necessary, the IP address, date and time, the requested address, the referrer and browser and device information in order to deliver the page and fend off attacks (e.g. DDoS protection). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and fast operation.

Cloudflare processes this data as our processor (Cloudflare Data Processing Addendum). For transfers to the USA, the Standard Contractual Clauses (SCC) or the EU-US Data Privacy Framework (DPF) apply, where relevant; you can obtain a copy of the safeguard on request.

From these server logs, Cloudflare provides us with aggregated figures (e.g. number of requests, data volume, countries of origin); we cannot identify individual visitors there and do not combine these figures with other data.

Storage period: Server logs are stored briefly, usually for no longer than 30 days, unless they are needed longer to investigate a security incident.

4. Contact by email, phone and WhatsApp, intro call

Email: The website has no general contact form. It contains email links ([email protected]) that open your own email program; some links – for example for enquiring about a website package – suggest a subject and a text template that you can change freely. If you write to us, we process your message, your email address and the information you provide in order to answer your enquiry, arrange an intro call and, where applicable, prepare an offer (Art. 6(1)(b) GDPR for enquiries about a contract, otherwise (f); our legitimate interest is answering enquiries). Our mailbox is operated by an external email provider as our processor; we will name the provider on request.

As a rule, we delete the correspondence no later than 3 years after the enquiry has been completed if no contract is concluded. If a contract is concluded, we keep correspondence and documents for as long as is necessary for the contract and statutory retention obligations.

Phone: If you call us (+49 176 84294769), we process your phone number and the content of the conversation, insofar as we take notes, for the same purposes and with the same storage periods. We hold intro calls and meetings by phone or video conference. If we use a video conferencing service, we name it in the invitation; the provider processes connection and participant data as our processor. We do not record calls.

WhatsApp: You can also message us via WhatsApp (+49 176 84294769). This only happens if you contact us yourself – via the WhatsApp link on this website or by messaging our number; WhatsApp is not embedded on the website itself. Only when you click the link does your device call up WhatsApp’s address wa.me. For users in Europe, WhatsApp is operated by WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland; data may be transferred to Meta Platforms, Inc. in the USA (EU-US Data Privacy Framework). We process your phone number, profile name and messages including files you send in order to answer your enquiry (Art. 6(1)(b) GDPR for enquiries about a contract, otherwise (f)). WhatsApp’s own processing, for example of connection and usage data, is governed by WhatsApp’s privacy policy. Please do not send us confidential documents or sensitive data via WhatsApp; please use email for this. We confirm binding arrangements by email. We delete chat histories as soon as they are no longer needed, as a rule no later than 12 months after the enquiry has been completed, unless retention obligations apply.

We do not contact anyone unsolicited for advertising purposes.

5. Appointment booking via Cal.com

For intro calls and meetings you can book an appointment via our website with Cal.com, a service of Cal.com, Inc., USA. When you click an appointment button (e.g. “Book a call”), Cal.com’s booking page opens in a window on our website; without JavaScript it opens in a new tab. Before this click, our website does not load any content from Cal.com and does not transfer any data to Cal.com. When you click, your browser retrieves the booking page from Cal.com; in doing so, Cal.com receives, as technically necessary, your IP address and browser and device information.

When you book, we and Cal.com on our behalf process your name, email address, company, the chosen time slot and the information you enter in the booking form in order to arrange the appointment, send confirmations and reminders and prepare the call. The legal basis is Art. 6(1)(b) GDPR (steps prior to a contract), otherwise (f) (our legitimate interest in simple scheduling). Appointment data is matched with our calendar; we will name the calendar service on request.

Cal.com processes the data as our processor. Data may be transferred to the USA; the basis is the Standard Contractual Clauses or – insofar as Cal.com is certified under it – the EU-US Data Privacy Framework. Cookies and similar technology on the booking page itself are governed by Cal.com’s notices. As a rule, we delete appointment data no later than 12 months after the appointment if no contract is concluded.

6. Orders, payment and contracts (Stripe)

You order and pay for services such as the AI Visibility Check via Stripe. When you click a booking button, you switch to a Stripe payment page (buy.stripe.com or checkout.stripe.com); the payment page is not embedded in our website, and no data is transferred to Stripe before you click.

On the payment page, your company name, billing address, email address, your VAT identification number if you choose to provide it, the service ordered, any voucher code entered and your payment data are collected. Stripe does not pass payment data (e.g. card number, bank details) on to us in full; we only receive information such as payment method, amount, status and, where applicable, the last digits. We process the data to perform the contract, for invoicing and accounting (Art. 6(1)(b) GDPR), to comply with statutory retention obligations ((c)) and to prevent fraud and abuse ((f); our legitimate interest is secure payment processing).

Stripe processes data partly on our behalf and partly – for example for payment processing, fraud prevention and to comply with financial regulations – as an independent controller. The responsible company is the Stripe group company that Stripe names in its privacy policy for your region (for the European Economic Area usually Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Dublin 2, Ireland). Data may be transferred to Stripe, Inc. in the USA (EU-US Data Privacy Framework or Standard Contractual Clauses). Stripe’s privacy policy (stripe.com/privacy) also applies. On the payment page, Stripe may set its own cookies necessary for payment and fraud prevention; we have no influence on this.

Order form: An order form is also available at pickedfirst.ai/en/order/. If you submit it, you transmit your company name, website, industry, city, country, report language, up to three competitors, your business email address and your confirmation that you are ordering as a business to our order service, which we operate at Cloudflare (Cloudflare Workers, section 3); you are then forwarded to Stripe’s payment page. We use the information to carry out the order (Art. 6(1)(b) GDPR) and store it for as long as is necessary for the contract and statutory retention obligations.

If you become a client: For offer, contract, delivery and invoicing we process the contact details of your contact persons as well as company, billing, contract and payment data (Art. 6(1)(b) GDPR). We keep invoices and accounting records for as long as statutory retention obligations apply ((c)), usually up to 10 years. Our terms and conditions apply.

AI Visibility Check: For the check we only use publicly available information about your company and the competitors you name. We put the agreed questions to AI assistants via their programming interfaces; the questions contain company names, industry and region, but no contact details of your contact persons and no personal data of your clients.

7. Local storage in the browser

We do not set cookies and do not use localStorage or sessionStorage. Should Cloudflare, in individual cases, set a technically necessary security cookie to fend off attacks (for example during a browser check), it serves only this purpose (Section 25(2) no. 2 TDDDG; Art. 6(1)(f) GDPR); neither we nor Cloudflare on our behalf set cookies for analytics or advertising. Display, animation and smooth scrolling run entirely in your browser and do not transmit anything to us. On the pages of Stripe, Cal.com and WhatsApp that you reach via links or that open after your click, their own cookie notices apply.

8. Fonts, media and links

Fonts, images and program libraries are loaded from our own server; no data is transferred to font or media providers. The sample report is a page of this website and loads no external resources. Only when you click a link to another website does your browser open the third-party page; its operator then receives your IP address and, as referrer, only our domain (pickedfirst.ai), not the exact subpage. The privacy policy of the linked page applies there.

9. Recipients and third countries

United Arab Emirates: As the controller, we are established in the UAE. There is no adequacy decision of the European Commission for the UAE. We apply the GDPR insofar as it applies to our offering (Art. 3(2) GDPR) and access the data only via secured, encrypted connections. Where data from the EU reaches the UAE in this context, this happens in order to answer your enquiry, perform contracts or run the website.

10. Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Please contact [email protected]; we usually reply within one month.

11. Right to object (Art. 21 GDPR)

Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR) – in particular server logs, answering general enquiries, appointment booking and fraud prevention – you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. An informal note to [email protected] is sufficient.

You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR); the lawfulness of processing carried out until then remains unaffected. At present we do not base any processing on this website on consent.

12. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU/EEA member state of your habitual residence, place of work or the place of the alleged infringement; in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC).

13. Changes

We update this policy when the website, the services used or the legal situation change. The current version is available at pickedfirst.ai/en/privacy/.

As of: 24 October 2026