This privacy policy explains how we process personal data in connection with the AI maturity assessment. For other areas of the PROSTEP website, PROSTEP AG's general privacy policy applies in addition.
PROSTEP AG
Heinrich-Hertz-Straße 3–7
64295 Darmstadt
Germany
Email: infocenter@prostep.com
Commercial register: Darmstadt Local Court (Amtsgericht Darmstadt), HRB 8383
Nadi Sönmez
Data Protection Officer of PROSTEP AG
Email: datenschutz@prostep.com
The AI maturity assessment provides an initial, non-binding assessment of the AI readiness of a company, a division, a site, or a team. It is provided as an individual B2B information and consulting offering. Based on the answers entered, a results report is created and attributed to a company and to the requesting person.
We also use the company, contact, and assessment data to evaluate the assessment, identify possible consulting needs, qualify potential business customers or prospects, prepare a possible business relationship, and contact you in connection with your specific assessment and any resulting consulting and support services.
Participation is voluntary, but not anonymous. Using the assessment requires providing the required business contact details. You can complete the entire assessment without consenting to additional marketing information such as newsletters, events, webinars, or general product information.
Free-text entries are voluntary. Please do not enter personal data about third parties or confidential information there.
We process the required contact, company, and assessment data to carry out the non-anonymous assessment you started, to save interim progress, to confirm your business email address, and to provide you with the personal continuation or results link and the results report. The legal basis is Art. 6(1)(b) GDPR.
We process company, industry, company size, division/site/team, contact details, assessment answers, and results to identify possible consulting needs, recognize potential business customers, qualify leads internally, prepare a possible business relationship, and contact you in connection with your specific assessment and any resulting consulting and support services. The legal basis is Art. 6(1)(f) GDPR.
Our legitimate interest lies in acquiring new business customers, classifying prospects according to their needs, internal lead qualification, contacting you about your specific assessment, and preparing a possible business relationship. In doing so, we take into account that the assessment expressly also serves this purpose, relates to a professional B2B context, and that you are informed of this before starting. We base additional marketing information without a specific connection to the assessment on your separate consent.
If you activate the separate, not pre-selected checkbox, we may additionally send you information by email about products, services, events, webinars, studies, and other offerings from PROSTEP AG. This consent only concerns additional marketing information without a specific connection to your assessment. The legal basis is your consent under Art. 6(1)(a) GDPR. For promotional outreach, we additionally observe Section 7 of the German Act Against Unfair Competition (UWG).
You may withdraw your consent to additional marketing information at any time with effect for the future, for example by emailing datenschutz@prostep.com or via an unsubscribe option provided in the respective email. The lawfulness of processing carried out until the withdrawal remains unaffected. A withdrawal has no effect on carrying out or accessing the assessment, or on being contacted in connection with your specific assessment.
To the extent technical log data arises, we process it to securely provide the service, analyze errors, prevent misuse, and investigate security incidents. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and trouble-free operation of the assessment.
We additionally analyze assessment answers in anonymized and aggregated form for internal and external benchmarks, for example comparing maturity levels by industry or company size. Creating these analyses from answers that are still personal data at that point is based on our legitimate interest (Art. 6(1)(f) GDPR); in doing so, we remove contact details, free-text entries, and other identifying individual information so that it can no longer be traced back to your company or your person. The anonymized analyses are then no longer personal data and are retained indefinitely.
As long as your data is still personal data, you may object at any time to its use for these analyses for reasons arising from your particular situation, under Art. 21 GDPR; your data will then not be included in the benchmark data pool.
We need the information marked as required fields in the form to carry out and provide the non-anonymous assessment, for the company-related classification explained before the start, to contact you in connection with your specific assessment, and for prospect qualification. Without this information, the assessment cannot be carried out.
The phone number, free-text comments, and consent to additional marketing information by email are voluntary. You suffer no disadvantage in using the assessment from not providing a phone number, not filling in free-text fields, or not giving consent to additional marketing information.
The email confirming, continuing, or providing the results report is a service message you requested. It may contain information directly required to access or discuss your specific assessment. Without additional marketing consent, it does not contain newsletters, general product information, event invitations, or campaigns without a specific connection to the assessment.
PROSTEP may contact you in connection with your specific assessment and any resulting consulting and support services. Additional marketing information without a specific connection to the assessment is only sent based on separate consent. The consent given is documented with time, channel, and text version so that we can demonstrate it.
Within PROSTEP AG, only those units that need the data for the stated purposes are given access. These may in particular be relevant staff in consulting and sales, as well as authorized IT and administration units.
To the extent we use service providers for hosting, email delivery, CRM, maintenance, backup, or monitoring, they process this data only to the extent required and, where they act as processors, on the basis of an agreement under Art. 28 GDPR.
A transfer to countries outside the European Union or the European Economic Area only takes place if the requirements of Art. 44 et seq. GDPR are met. If hosting, email, CRM, backup, monitoring, maintenance, or administration involves a transfer to a third country, the recipients, countries, and safeguards used will be added to this privacy policy.
Only technically required cookies or comparable browser storage are used to the extent necessary for the assessment you requested to function. Where storage or reading is strictly necessary, this takes place without consent under Section 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG).
We store personal data only for as long as necessary for the respective purpose. Data is also deleted if you effectively request deletion or object to processing and no overriding legal grounds apply.
Regardless of these periods, we additionally analyze assessment answers in anonymized form for benchmarks — see the "Anonymized analyses and benchmarks" section.
The personal continuation or results link provides access to your progress, entries, or result. Please treat this link as confidential and only pass it on to authorized persons within your organization.
We use appropriate technical and organizational measures to protect the link and the data accessible through it against unauthorized access, loss, and alteration. These include in particular an unguessable token, no personal data in the URL, and exclusion from search engine indexing.
Subject to the statutory requirements, you have in particular the following rights:
Where we process your data on the basis of legitimate interests, you can object at any time for reasons arising from your particular situation. You can object to processing for additional marketing information at any time by withdrawing your consent. After an effective objection or withdrawal, your data will no longer be processed for these purposes.
To exercise your rights, a message to datenschutz@prostep.com is sufficient. To prevent disclosure to unauthorized third parties, we may require suitable proof of identity.
You have the right to lodge a complaint with a data protection supervisory authority. The following authority is in particular responsible for PROSTEP AG:
Hessian Commissioner for Data Protection and Freedom of Information
Wilhelmstraße 7
65185 Wiesbaden
Germany
Email: poststelle@datenschutz.hessen.de
Website: datenschutz.hessen.de
This specific privacy policy applies to the AI maturity assessment. We update it whenever the actual processing or the legal situation changes. The version published on the assessment page applies.
Last updated: 30 July 2026