Privacy Policy
This privacy policy explains how we process personal data in connection with the
AI maturity assessment. For other areas of the PROSTEP website, PROSTEP AG's
general privacy policy applies in addition.
Controller
PROSTEP AG
Heinrich-Hertz-Straße 3–7
64295 Darmstadt
Germany
Email: infocenter@prostep.com
Commercial register: Darmstadt Local Court (Amtsgericht Darmstadt), HRB 8383
Data protection officer
Nadi Sönmez
Data Protection Officer of PROSTEP AG
Email: datenschutz@prostep.com
Purpose of the assessment
The AI maturity assessment provides an initial, non-binding assessment of the AI
readiness of a company, a division, a site, or a team. It is provided as an individual B2B
information and consulting offering. Based on the answers entered, a results report is created
and attributed to a company and to the requesting person.
We also use the company, contact, and assessment data to evaluate the assessment,
identify possible consulting needs, qualify potential business customers or prospects, prepare a
possible business relationship, and contact you in connection with your specific assessment and
any resulting consulting and support services.
Participation is voluntary, but not anonymous. Using the assessment requires
providing the required business contact details. You can complete the entire assessment without
consenting to additional marketing information such as newsletters, events, webinars, or general
product information.
What data we process
Information you provide
- Contact details: first and last name and business email address as required information for
individually providing, attributing, and contacting you about your assessment. The phone number
is voluntary and is only used if you provide it.
- Company and classification data: company, industry, company size, and the division, site, or
team the entries relate to.
- Assessment answers on organizational AI readiness, AI usage, data landscape, governance, use
areas, use cases, capability, and KPI/ROI considerations.
- Voluntary comments and contextual information in free-text fields.
- Your choice regarding a voluntary consent to additional marketing information by email, for
example about products, services, events, webinars, studies, and other offerings without a
specific connection to your assessment.
Data generated by the system
- Interim assessment progress, calculated result values, maturity levels, and the results
report.
- Identifiers, timestamps, and technical information required for the session, confirmation,
continuation, results link, evidence of consent, security, and error analysis.
- Technical log data, to the extent it actually arises when accessing and securing the
assessment, such as IP address, time, resource accessed, browser or device information, and
error or security events.
Free-text fields
Free-text entries are voluntary. Please do not enter personal data about third
parties or confidential information there.
Purposes and legal bases
Carrying out, continuing, and providing the results report
We process the required contact, company, and assessment data to carry out the
non-anonymous assessment you started, to save interim progress, to confirm your business email
address, and to provide you with the personal continuation or results link and the results report.
The legal basis is Art. 6(1)(b) GDPR.
Company-related classification and prospect qualification
We process company, industry, company size, division/site/team, contact details,
assessment answers, and results to identify possible consulting needs, recognize potential business
customers, qualify leads internally, prepare a possible business relationship, and contact you in
connection with your specific assessment and any resulting consulting and support services. The
legal basis is Art. 6(1)(f) GDPR.
Our legitimate interest lies in acquiring new business customers, classifying
prospects according to their needs, internal lead qualification, contacting you about your specific
assessment, and preparing a possible business relationship. In doing so, we take into account that
the assessment expressly also serves this purpose, relates to a professional B2B context, and that
you are informed of this before starting. We base additional marketing information without a
specific connection to the assessment on your separate consent.
Additional marketing information by email
If you activate the separate, not pre-selected checkbox, we may additionally send
you information by email about products, services, events, webinars, studies, and other offerings
from PROSTEP AG. This consent only concerns additional marketing information without a specific
connection to your assessment. The legal basis is your consent under Art. 6(1)(a) GDPR. For
promotional outreach, we additionally observe Section 7 of the German Act Against Unfair
Competition (UWG).
You may withdraw your consent to additional marketing information at any time with
effect for the future, for example by emailing
datenschutz@prostep.com or via an unsubscribe option
provided in the respective email. The lawfulness of processing carried out until the withdrawal
remains unaffected. A withdrawal has no effect on carrying out or accessing the assessment, or on
being contacted in connection with your specific assessment.
Technical operation and security
To the extent technical log data arises, we process it to securely provide the
service, analyze errors, prevent misuse, and investigate security incidents. The legal basis is
Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and trouble-free operation of the
assessment.
Anonymized analyses and benchmarks
We additionally analyze assessment answers in anonymized and aggregated form for
internal and external benchmarks, for example comparing maturity levels by industry or company
size. Creating these analyses from answers that are still personal data at that point is based on
our legitimate interest (Art. 6(1)(f) GDPR); in doing so, we remove contact details, free-text
entries, and other identifying individual information so that it can no longer be traced back to
your company or your person. The anonymized analyses are then no longer personal data and are
retained indefinitely.
As long as your data is still personal data, you may object at any time to its use
for these analyses for reasons arising from your particular situation, under Art. 21 GDPR; your
data will then not be included in the benchmark data pool.
Required and voluntary information
We need the information marked as required fields in the form to carry out and
provide the non-anonymous assessment, for the company-related classification explained before the
start, to contact you in connection with your specific assessment, and for prospect qualification.
Without this information, the assessment cannot be carried out.
The phone number, free-text comments, and consent to additional marketing
information by email are voluntary. You suffer no disadvantage in using the assessment from not
providing a phone number, not filling in free-text fields, or not giving consent to additional
marketing information.
Results email, assessment-related contact, and additional marketing information
The email confirming, continuing, or providing the results report is a service
message you requested. It may contain information directly required to access or discuss your
specific assessment. Without additional marketing consent, it does not contain newsletters, general
product information, event invitations, or campaigns without a specific connection to the
assessment.
PROSTEP may contact you in connection with your specific assessment and any
resulting consulting and support services. Additional marketing information without a specific
connection to the assessment is only sent based on separate consent. The consent given is documented
with time, channel, and text version so that we can demonstrate it.
Recipients and authorized access
Within PROSTEP AG, only those units that need the data for the stated purposes are
given access. These may in particular be relevant staff in consulting and sales, as well as
authorized IT and administration units.
To the extent we use service providers for hosting, email delivery, CRM,
maintenance, backup, or monitoring, they process this data only to the extent required and, where
they act as processors, on the basis of an agreement under Art. 28 GDPR.
Processing outside the European Union and the European Economic Area
A transfer to countries outside the European Union or the European Economic Area
only takes place if the requirements of Art. 44 et seq. GDPR are met. If hosting, email, CRM,
backup, monitoring, maintenance, or administration involves a transfer to a third country, the
recipients, countries, and safeguards used will be added to this privacy policy.
Cookies, browser storage, and tracking
Only technically required cookies or comparable browser storage are used to the
extent necessary for the assessment you requested to function. Where storage or reading is strictly
necessary, this takes place without consent under Section 25(2) No. 2 of the German
Telecommunications Digital Services Data Protection Act (TDDDG).
Retention period and deletion
We store personal data only for as long as necessary for the respective purpose.
Data is also deleted if you effectively request deletion or object to processing and no overriding
legal grounds apply.
- We process contact, company, and assessment data to carry out the assessment, provide the
results report, and for assessment-related sales activities and prospect qualification until
objection or at the latest 24 months after the last substantive interaction, unless another legal
basis or retention obligation applies.
- Data for additional marketing information is processed until consent is withdrawn.
- Technical log data is deleted or blocked in accordance with the applicable security and
logging concept, unless it is required to investigate a security incident.
Regardless of these periods, we additionally analyze assessment answers in
anonymized form for benchmarks — see the "Anonymized analyses and benchmarks" section.
Personal continuation and results link
The personal continuation or results link provides access to your progress, entries,
or result. Please treat this link as confidential and only pass it on to authorized persons within
your organization.
We use appropriate technical and organizational measures to protect the link and the
data accessible through it against unauthorized access, loss, and alteration. These include in
particular an unguessable token, no personal data in the URL, and exclusion from search engine
indexing.
Your rights
Subject to the statutory requirements, you have in particular the following
rights:
- Access to the data processed about you under Art. 15 GDPR.
- Rectification of inaccurate or completion of incomplete data under Art. 16 GDPR.
- Erasure of your data under Art. 17 GDPR.
- Restriction of processing under Art. 18 GDPR.
- Data portability under Art. 20 GDPR, where the statutory requirements are met.
- Withdrawal of consent at any time with effect for the future under Art. 7(3) GDPR.
- Objection to processing based on Art. 6(1)(f) GDPR under Art. 21 GDPR.
Where we process your data on the basis of legitimate interests, you can object at
any time for reasons arising from your particular situation. You can object to processing for
additional marketing information at any time by withdrawing your consent. After an effective
objection or withdrawal, your data will no longer be processed for these purposes.
To exercise your rights, a message to
datenschutz@prostep.com is sufficient. To prevent
disclosure to unauthorized third parties, we may require suitable proof of identity.
Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory
authority. The following authority is in particular responsible for PROSTEP AG:
Hessian Commissioner for Data Protection and Freedom of Information
Wilhelmstraße 7
65185 Wiesbaden
Germany
Email: poststelle@datenschutz.hessen.de
Website: datenschutz.hessen.de
Version and changes
This specific privacy policy applies to the AI maturity assessment. We update it
whenever the actual processing or the legal situation changes. The version published on the
assessment page applies.
Last updated: 30 July 2026
DE