Privacy Policy

This privacy policy describes how PAICON Holding GmbH processes personal data in connection with the website paicon.com. It covers the processing described below. Our other products and services are covered by their own information, which we publish as each is documented. Where we handle clinical data on behalf of a hospital or other provider, that provider informs the people concerned.

1. Who is responsible

The controller for this website is PAICON Holding GmbH, Am Taubenfeld 21/2, 69123 Heidelberg, Germany. Our data protection officer can be reached at privacy@paicon.com.

Where we ask for data you must provide, for example to answer an enquiry, we say so at the point of collection and tell you what happens if you do not provide it.

2. Data collected automatically

When you open the website, our servers record information your browser or device sends: IP address, browser and device type and version, operating system, language preferences, referring page, pages visited, time spent and access times. These logs are stored for 14 days on Amazon Web Services in Frankfurt and then deleted.

We use this data to keep the site available and secure and to detect abuse. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in keeping the website available, secure and free of abuse. Where the same data is used to measure how the site is used, the basis is your consent, described under Cookies below.

3. Purposes, legal bases and retention

We process personal data for the purposes below.

Purpose	Data	Legal basis	Retention
Operating and securing the website	Server log data (section 2)	Art. 6(1)(f), our interest in keeping the website available, secure and free of abuse	14 days
Responding to enquiries you send to info@paicon.com	Contact details, content of your message	Art. 6(1)(f), our interest in answering you; Art. 6(1)(b) where your enquiry precedes a contract	12 months after the matter is closed, unless a contract or demo follows, in which case that retention applies
Newsletter	Email address, name, opens and clicks	Art. 6(1)(a), your consent	Until you unsubscribe; afterwards only a suppression record so we do not email you again, which we keep for as long as we send newsletters at all
Website analytics	Cookie and usage data (section 6)	Art. 6(1)(a) consent, with § 25(1) TDDDG for storage on your device	Cookie lifetimes are in section 6; the usage records themselves are kept for 6 months
Booking a demo call	Contact details, organisation, chosen time, what you tell us about your interest	Art. 6(1)(f), our interest in responding to an expression of interest in our services and arranging the call you asked for; Art. 6(1)(b) where you are yourself the prospective customer	12 months after the call, unless a business relationship follows
Business contact and outreach	Name, role, organisation, business email and phone, source and date obtained	Art. 6(1)(f), our interest in informing organisations that may use our services about them and in building business relationships	12 months after first contact if there is no response; otherwise for the duration of the relationship and 12 months after the last exchange
Job applications	See section 9	§ 26(1) BDSG with Art. 88 GDPR	6 months after rejection or withdrawal of the vacancy
Cookie consent record	Cookie consent related data (section 6)	Art. 6(1)(c) with § 25(1) TDDDG	6 months, matching the cookie whose consent it records

4. Recipients

We disclose personal data to service providers acting on our instructions as processors, and to public authorities where the law requires it. Our processors for this website are:

• Hosting and infrastructure: Amazon Web Services (Frankfurt region)
• Marketing, forms, analytics, consent management and newsletter: HubSpot, including its content delivery provider Cloudflare, which serves those components and provides bot protection

If our business or part of it is sold or reorganised, personal data may transfer to the acquirer. The basis for that disclosure is Art. 6(1)(f), and the acquirer becomes responsible for the data as controller from that point, including for informing you under Art. 14.

5. International transfers

Both of our processors store website data in the European Union. Both are US companies and may access data from the United States for support and sub-processing. The safeguards are:

Recipient	Where data is stored	Where it may be accessed	Safeguard
HubSpot	EU data centre (Germany)	United States and other countries listed in the sub-processor list HubSpot publishes with its data processing agreement.	EU-U.S. Data Privacy Framework certification of HubSpot, Inc.; the standard contractual clauses under Art. 46(2)(c) in the HubSpot Data Processing Agreement apply as a fallback
Amazon Web Services	Frankfurt, Germany	United States, for support and as necessary to provide the service	The standard contractual clauses under Art. 46(2)(c), incorporated in the AWS Data Processing Addendum. Amazon Web Services, Inc. is additionally covered by the EU-U.S. Data Privacy Framework certification held by Amazon.com, Inc.

You can request a copy of either safeguard by writing to privacy@paicon.com. The HubSpot agreement is also published at legal.hubspot.com/dpa and the AWS addendum at aws.amazon.com/agreement.

6. Cookies and similar technologies

We use cookies and similar technologies. We store or read information on your device without consent only where that is strictly necessary to provide a service you have expressly asked for. All others, in particular analytics, are set only after you consent through the banner shown when you first visit. You can withdraw consent at any time through the cookie settings link in the footer, as easily as you gave it. Your choice is recorded.

Parts of our pages, including scripts, forms and the demo booking tool, are served by HubSpot. Loading them means your browser connects to HubSpot and HubSpot receives your IP address, whether or not a cookie is set. HubSpot processes this data only on our instructions. We do not use any advertising cookies or tracking pixels on this website, and this site contains no video, images or other media content embedded from third parties.

Cookies we use

Category	Purpose	Set by	Name	Duration
Necessary	Remembering the cookie categories you consented to	HubSpot, on paicon.com	__hs_cookie_cat_pref	6 months
Necessary	Remembering that you declined cookies	HubSpot, on paicon.com	__hs_opt_out	6 months
Necessary	Not showing the banner again while you browse	HubSpot, on paicon.com	__hs_initial_opt_in	7 days
Necessary	Bot protection and rate limiting for forms and the booking tool	HubSpot’s content delivery network (Cloudflare)	__cf_bm	30 minutes
Necessary	Bot protection and rate limiting for forms and the booking tool	HubSpot’s content delivery network (Cloudflare)	__cfruid	end of session
Necessary	Bot protection and rate limiting for forms and the booking tool	HubSpot’s content delivery network (Cloudflare)	__cfuvid	end of session
Analytics	Recognising your browser across visits: first, last and current visit, number of sessions	HubSpot, on paicon.com	__hstc	6 months
Analytics	Your visitor identifier; sent with a form submission to link it to your visits	HubSpot, on paicon.com	hubspotutk	6 months
Analytics	Counting page views within one session	HubSpot, on paicon.com	__hssc	30 minutes
Analytics	Detecting whether you restarted your browser	HubSpot, on paicon.com	__hssrc	End of session

The contact forms and the demo booking tool set no cookies of their own; the bot-protection cookies listed above are set by the content delivery provider when those components load. If you have consented to analytics, a form submission carries your visitor identifier so that HubSpot can connect the submission to your earlier visits; if you have declined, the form still works and no such link is made.

7. Newsletter, demo calls and business contact

Newsletter. We send our newsletter on the basis of your consent, which we record with the date, the form you used and the text you agreed to. You confirm your address by clicking the link in a confirmation email before you receive anything. Every newsletter contains an unsubscribe link, and you can also write to privacy@paicon.com. We measure whether newsletters are opened and which links are clicked, using a small image embedded in the message, so that we can see what interests our readers; this measurement rests on the same consent and stops when you unsubscribe. Our newsletter runs on HubSpot, described in sections 4 and 5.

Demo calls. If you book a demonstration through the booking tool on our site, we process your contact details, your organisation, the time you chose and what you tell us about your interest, in order to arrange and hold the call. Booking runs through HubSpot. The basis is Art. 6(1)(f), or Art. 6(1)(b) where you are yourself the prospective customer. If we contact you afterwards about our services, that rests on our legitimate interest, and you can object at any time.

Business contact. We contact representatives of hospitals, research institutions and companies about our services. We obtain their details from LinkedIn profiles, from meeting them at conferences, and from referrals by people we already work with. The basis is Art. 6(1)(f), our interest in informing organisations that may use our services about them and in building business relationships. We do not send unsolicited advertising by email. When we first contact someone whose details we received from a third party, we tell them where the details came from. You can object to direct marketing at any time, without giving a reason, and we will stop.

8. Your rights

You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable form. Where processing rests on consent, you may withdraw it at any time; this does not affect processing already carried out. We answer requests within one month. To exercise any right, write to privacy@paicon.com.

You may object to direct marketing at any time, and we will stop. No reason is needed.

You have the right to complain to a supervisory authority. You may complain to the authority where you live, where you work, or where the matter you are complaining about happened. The authority competent for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany, poststelle@lfdi.bwl.de, www.baden-wuerttemberg.datenschutz.de

9. Applying for a job with us

If you apply to us, we process the information in your application, your contact details, CV, covering letter and anything else you send, in order to assess your suitability, to contact you about the application, and to decide whether to offer you a role. Applications reach us by email at recruiting@paicon.com and are seen by our management and the people involved in the hiring decision.

The basis is § 26(1) BDSG, read with Art. 88 GDPR: the processing is necessary for a decision about entering an employment relationship. If your application contains health or disability information that bears on a right or duty under employment law — for example a recognised disability — we process it under Art. 9(2)(b) GDPR together with § 26(3) BDSG. Health information you include that has no bearing on the role or on such a right or duty is not used in the assessment, and we remove it as soon as we notice it. If you apply speculatively, the basis is the same: your application is itself a request to take steps towards employment.

If we do not offer you a role, we delete your application six months after telling you, or six months after the vacancy is withdrawn; we keep it that long so that we can answer a claim under the equal-treatment legislation, for which the time limits are shorter still. We keep it longer only if you agree to us holding it for future openings, in which case we hold it for 12 months and you can withdraw at any time.

10. Our pages on LinkedIn and X

We operate a company page on LinkedIn and an account on X. Our basis for operating them is our legitimate interest in presenting the company and reaching people interested in our work.

LinkedIn. When you visit our LinkedIn page, LinkedIn Ireland Unlimited Company processes your interaction with it to produce statistics about how the page performs (Page Insights). For that processing we and LinkedIn are jointly responsible under Art. 26 GDPR. We receive those statistics only in aggregated form and cannot identify you from them. The division of responsibility is set out in LinkedIn’s Page Insights Joint Controller Addendum: LinkedIn is responsible for the processing itself, for security, and for answering data-subject requests about it; we are responsible for our own use of the statistics. You may exercise your rights against either of us regardless of that division (Art. 26(3)). LinkedIn transfers data to the United States under its own safeguards, described in LinkedIn’s privacy policy. https://www.linkedin.com/legal/l/page-joint-controller-addendum

X. When you visit our X account, X processes your data as its own controller under its own terms, including in the United States. X does not offer page operators an arrangement under Art. 26, and none exists between us and X. We receive aggregated account statistics from X and cannot identify you from them.

For everything else the platforms do with your data, for their own purposes, they are the controller and their privacy policies apply.

11. Personal data we obtain from other sources

Some of the personal data we hold does not come from you. This section informs the people concerned, most of whom have never visited this website, as Art. 14 GDPR requires.

Business contacts. We obtain business contact details (name, role, organisation, business email and phone) from LinkedIn profiles, from conferences we attend, and from referrals by people we work with, in order to contact organisations about our services. The basis is our legitimate interest described in section 7. We tell you where we got your details when we first contact you, and give you the rest of the information in this notice at the same time, and you can object at any time.

Clinical cases shown on this website. The example cases on our website come from The Cancer Genome Atlas (TCGA), a public research dataset published by the US National Cancer Institute. The programme that collected the data obtained consent for research use and publication in this form. TCGA releases this data in de-identified form. We hold no information that would let us identify the people concerned, and we do not attempt to. Our use of the cases follows the dataset’s own publication and data-use policies.

The clinical datasets we use to develop our products are not part of this website.

The rights in section 8 apply to this data as well. Because we cannot identify a person from a de-identified case, we can act on a request about clinical data only if you provide information that lets us find the record concerned (Art. 11(2) GDPR).

12. Automated decisions

We do not take decisions about you based solely on automated processing that produce legal effects for you or similarly significantly affect you.

13. Changes to this policy

We may update this policy. We will post the updated version here with a new date, and where a change is material we will draw attention to it on this page.

14. Contact

General enquiries: info@paicon.com. Data protection enquiries, and any request about your rights: privacy@paicon.com. Postal address: PAICON Holding GmbH, Am Taubenfeld 21/2, 69123 Heidelberg, Germany.

15. Version

This is version 2.0 of the policy and its date of publication is 22nd September 2026.