Privacy

1. Controllers and contact

Black Darter Consulting GmbH is responsible for website operation, security and the central enquiry inbox. Black Darter Investment GmbH independently processes necessary data for investment enquiries addressed to it and its own investment transactions. Both: Aachener Straße 223, 50931 Cologne, Germany; managing director Marc Alessandro Quoadt. Privacy contact: info@blackdarter.com, +49 221 292652 00. Registration and activity allocation are in the legal notice. Group membership does not permit unrestricted data sharing.

2. Visits and protected sign-in

Technical processing includes IP address, time, requested resources and browser details for delivery, troubleshooting, access control and abuse prevention. The basis is Article 6(1)(f) GDPR, our legitimate interest in a secure, functional site. Public visits require no sign-in. The internal administration area requires ChatGPT sign-in. The platform checks access; account ID and email transmitted for the internal administration area are used to verify authority. The platform’s separate account management is also governed by its privacy information.

3. Hosting and recipients

The site uses ChatGPT Sites with Cloudflare delivery and storage technology. OpenAI processes data collected through the site for hosting under the processing agreement applicable to the account. Its contractual framework distinguishes in particular OpenAI Ireland Ltd. and OpenAI OpCo, LLC according to the relevant customer location. OpenAI lists Cloudflare, Ltd. for web hosting; further technical subprocessors may be involved under the applicable agreement. Providers may also process data outside the EU, particularly in the United States. Storage exclusively in Germany or the EU is not promised.

4. Contact, procurement and uploads

We process company, contact person, business email, project or product description, message and technical enquiry ID; optional phone, quantity, destination, date and files. Purposes are assessing, answering and preparing the requested business. Article 6(1)(b) GDPR applies where the individual is a contracting party or requests pre-contractual steps for themselves; business communications with company representatives generally use Article 6(1)(f), our interest in handling business enquiries properly. Marked mandatory fields are required for form processing; other information and files are voluntary. No advertising or newsletter subscription results. The selected topic and service package may also be stored.

5. File storage and access

Form data is in a server-side database; attachments are in private file storage without public download links. Only authorised internal access can retrieve them. Up to five files, 10 MB each and 25 MB total, are supported. Type and signature checks do not replace malware screening. Do not submit health data, payment-card data, passwords or unnecessary personal information. Agree a suitable transmission channel before sending particularly confidential documents. Files cannot be downloaded until a confirmed security check is recorded in the private file store. No automated malware scanner is connected at present. An email notification service is prepared but not enabled; no enquiries are currently transmitted to it.

6. Cookies and local functions

Our own code loads no analytics or advertising trackers, remote fonts, maps or videos. Language is selected through the URL. Calculators and examples run locally without sending inputs to an AI service. “Close for this visit” stores bd_cookie_notice=v1 as a session cookie. The browser manages the session and may retain the state when restoring it. “Remember for 180 days” saves the same choice for up to 180 days. Our notice sets no cookie before either choice. It only remembers the requested notice state, contains no user ID and enables no extra services. Necessary storage relies on section 25(2)(2) TDDDG and, where personal data is processed, Article 6(1)(f) GDPR. Reset the choice on the cookie page. Platform sign-in and security may use their own necessary cookies, governed by platform controls rather than our notice.

7. Abuse prevention and retention

The server hashes the IP address with a 15-minute time slot to limit excessive form requests. This pseudonymous reference is not a visitor profile. Counters are valid for 15 minutes; expired records are removed with the next form processing. The basis is Article 6(1)(f), our interest in preventing automated abuse. Enquiries and files are deleted once handling and necessary follow-up are complete and no other lawful retention purpose remains. Only information needed for performance, statutory records or legal claims is kept longer. Commercial correspondence is generally retained six years and accounting vouchers eight years, subject to statutory starting points and exceptions. Inbox deletion removes the record and attachments; platform backups and operational logs have separate provider periods. Contact us for information about the scope of deletion.

8. Sharing and international projects

Recipients are authorised persons in the relevant company and necessary technical processors. Matters addressed to Investment may be forwarded to that company. Suppliers, technical partners and external advisers receive data only as necessary and lawful for the project; content and recipients are agreed for that project. Personal data is not routinely transferred to Asian suppliers. Transfers outside the EEA must additionally meet Articles 44 et seq. GDPR, for example through an applicable adequacy decision or valid standard contractual clauses with necessary safeguards. OpenAI’s DPA describes intended transfer mechanisms; the account-specific hosting contract documentation is still being completed. Contact us for details or copies of relevant safeguards.

9. Rights and objection

Subject to statutory conditions, request access, correction, deletion, restriction and portability. You may object to Article 6(1)(f) processing for reasons relating to your situation, and to direct marketing at any time. Consent may be withdrawn prospectively. Contact info@blackdarter.com; necessary identity evidence may be requested. You may complain to a supervisory authority, including the North Rhine-Westphalia authority, Kavalleriestraße 2–4, 40213 Düsseldorf, www.ldi.nrw.de.

10. Automation, links and changes

The site makes no automated decision with legal or similarly significant effects under Article 22 GDPR. The contact form starts no AI analysis. Linked company sites are visited only when you follow the link and have their own privacy rules. This statement reflects 8 November 2026. Information and required consent controls will be updated before introducing additional analytics, marketing, AI processing or external embeds.