Skip to content

Legal

Privacy

Last updated: 25 October 2026

Controller

The controller responsible for processing personal data on this website is Andreas Dahrendorf, Hauptstr. 5l, 10317 Berlin, Germany. You can contact me by email, by phone at +49 160 96909462, or through the appointment and guest forms.

Accessing the website

This static website is operated on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. When the website is accessed, the server processes technical access data, in particular the IP address, date and time, requested URL, referrer, and user agent. This processing serves the delivery, stability, and security of the website. The legal basis is Art. 6 (1) (f) GDPR. Rotated access logs are deleted under the current server configuration after seven days at the latest, unless a longer retention period is legally required.

Local storage

The choice of light or dark mode is stored exclusively in the browser's local storage. This website does not use cookies for this purpose. The choice remains stored until it is changed or deleted in the browser.

Episode audio

We play the episodes as an audio file from our own server; this only creates the access logs described above. No other provider is involved. So that an episode can continue later at the same point, the browser stores the playback position in local storage. It is not sent to us and stays stored until the episode has been played to the end or the browser storage is cleared. The legal basis is Section 25(2) no. 2 TDDDG, because storing it is necessary for the playback you requested.

Newsletter

When you subscribe to the newsletter, we process your email address, the language and the page on which you signed up (as tags such as lang-en and source-episodes), and the time and IP address of the sign-up and the confirmation. We use double opt-in: you first receive an email with a confirmation link, and only after you click it do we send the newsletter. This lets us show that you requested the subscription yourself.

The legal basis is your consent under Art. 6(1)(a) GDPR. You can withdraw it at any time through the unsubscribe link in every email or by email. You will then receive no further newsletters; your address is kept, blocked, only as long as needed to prove the earlier consent. We measure neither email opens nor link clicks.

We send the newsletter through Mailcoach Cloud, operated by Spatie bv, Kruikstraat 22 bus 12, 2018 Antwerp, Belgium, as our processor. Mailcoach stores subscriber data within the European Economic Area, on servers of UpCloud and Aiven in Finland. The emails are delivered through the sending service Postmark (AC PM LLC, USA); for this, your email address and the content of the email are transferred to the USA. Postmark is certified under the EU-US Data Privacy Framework. The basis is the data processing agreement with Spatie under Art. 28 GDPR, which names Postmark as a sub-processor. More information: Mailcoach privacy policy and data processing agreement with sub-processors.

After you submit the form, Mailcoach shows its own page with a check against automated sign-ups: Cloudflare Turnstile by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Turnstile evaluates technical signals such as the IP address, browser identifier and connection characteristics; usually the check passes without any action on your part. Cloudflare processes this data on behalf of Mailcoach and, to improve its bot detection, also as a controller in its own right; data may be transferred to the USA. The legal basis is the legitimate interest in preventing sign-ups by bots (Art. 6(1)(f) GDPR). More information: Turnstile privacy notice.

Visitor statistics with Plausible Analytics

To understand which episodes are read and which links and buttons are used, we use Plausible Analytics by Plausible Insights OÜ, Tartu, Estonia. The data is processed on servers in Germany and does not leave the EU. Plausible sets no cookies and stores or reads no information on your device.

It records the page visited, the referring page, campaign details in the address (UTM), browser, operating system, device type and country, as well as clicks on links to other websites, on the follow buttons, starting a video and newsletter sign-ups, never with your email address. Your IP address is only briefly combined with the browser into an identifier that changes daily, and is not stored. We see only aggregated numbers, no individual people.

The legal basis is our legitimate interest in privacy-friendly audience measurement under Art. 6(1)(f) GDPR. Plausible processes the data as our processor under a data processing agreement. More information: Plausible data policy.

Guest and appointment forms

Guest participation uses an appointment form and a shared form for recording details. The recording details form is accessible through a personal link. Each participant also receives their own link to confirm their own permissions. The forms use no analytics, tracking pixels, cookies, or third-party embeds. They load code and media from the form service. The service processes technical request data for delivery and security. Rotated access-log files are retained for up to seven days; rotation is size-based.

Information in the forms and who can see it

The appointment form asks for your name and email, the number of guests, and one or more suitable times. Phone number, company, a note, and a second guest's name and email are optional. Without a name, email, and at least one time option, the request cannot be submitted. The shared Details form collects contact information, public name, company, role and city, optional portraits, and optional notes. It needs the primary guest's name and email to prepare participation. For two guests, the second name is required; their email is optional. Company, role, city, and phone numbers are optional. If a participant has no email address, the host must arrange delivery of that person's separate consent link another way.

The Details link opens one shared record for one or two guests. The organizer and any co-guest given this link can see the submitted details. Anyone who obtains the link may be able to access that record, so keep it private. A personal consent link shows only that participant's own name, email, and shared appointment. It cannot record consent for another participant.

We may receive a second participant's name, work details, or email from the organizer or another guest. To prepare the conversation, we may also use professional information available on company websites, public profiles, publications, or event pages. When we first contact a person named by someone else, we provide this notice and explain the source of their details.

Draft text and appointment choices are held in browsersessionStorage for the current tab so they can be restored during that browser session. They are sent to the service when the form is submitted. Consent checkbox choices and file selections are not restored from a draft. The light or dark theme is stored separately inlocalStorage until changed or deleted in the browser.

Personal permission and publication

The shared Details form does not collect consent. Each participant decides on their own personal page through three separate, initially unchecked choices: recording, editing and storing the conversation; publishing the episode with their name and professional details; and using their portrait and excerpts to promote the episode and EU AI Talk. All three choices are required for this recording format. If a participant does not agree to all three, their conversation is not recorded. If it has already been recorded, it is not published without the required permission. The decision is voluntary, and later withdrawal remains possible. The confirmation record contains that person's name and email, the time, language, version and exact text, the permissions selected, and how the confirmation was made.

If you later want to withdraw your permission in full or in part, or are unhappy with a publication, you can use the withdrawal or removal request form to ask us to remove the episode or specific content. You do not need to sign in or have your personal access link. An explanation is optional. You can also contact us by email or call +49 160 96909462. We review which participant and material your request concerns and handle the affected publications. Submitting the form does not trigger automatic deletion.

Within the permissions, published material may include the full recording or selected material, including unused takes and outtakes, as well as transcripts, translations, portraits, and professional identity details. This does not make every raw file public. Email addresses used for coordination, phone numbers, postal addresses, private notes, access links, and consent evidence remain operational records and are not published. An email address is public only if the guest separately chooses it as a public contact address.

Within the permissions granted, material intended for publication may be distributed worldwide across the channels used by EU AI Talk and adapted for different platforms. This includes promoting the episode and EU AI Talk. Names, portraits, voices, and statements remain personal data even when they are intended for publication.

Purposes and legal bases

  • We use appointment, contact, and profile details to arrange and carry out the guest's participation. Where the guest is the person making the request, this is based on steps before a contract or the performance of an agreement under Art. 6(1)(b) GDPR.
  • If an organizer or representative provides information or coordinates for a guest, we use what is needed to arrange the conversation and communicate with them, and to protect the service, administer the process, or establish, exercise, or defend legal claims. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR in reliable coordination, service security, and accountability.
  • We rely on each guest's consent under Art. 6(1)(a) GDPR to record, edit, store, archive, and otherwise process their audio, video, image, portrait, and professional information for publication or promotion. Website access and security logs are based on Art. 6(1)(f) GDPR.

Recipients and service providers

  • The form service is hosted by Hetzner Online GmbH on servers in Germany. The host and people authorized by EU AI Talk access records on managed devices and systems.
  • Fastmail Pty Ltd provides email and calendar services. It receives details needed for guest messages, invitations, and appointment coordination. Fastmail offers EU or US primary storage; even with EU primary storage, it keeps a US replica and uses US systems for backups and logs, as described in its data residency information.
  • Until 19 October 2026 we sent guests a headset by DHL. For that, DHL received the name, delivery address, email address, and any courier phone number given. We no longer collect delivery addresses. See DHL's privacy information.
  • From 19 to 24 October 2026 we recorded in the browser with Zencastr, Inc. (San Francisco, USA). Zencastr processed picture and sound, the displayed name, and technical connection data, says it primarily uses data centres in the United States, and describes itself as the controller of the data collected through its service. Its terms of service allow it to use recording content to train AI models. We no longer make new recordings there.
  • Riverside is used for recording, importing and exporting production material, editing, and the AI-assisted features we use for transcription, clips, subtitles, and translations. It processes the recording and material needed for those features. Riverside also describes processing recording content as an independent controller for its own AI model development. Its published policy provides an exclusion for Business customers with a written training opt-out agreement. These provider uses are distinct from producing and publishing this podcast; see Riverside’s privacy policy and service providers.
  • The private EU AI Talk CRM uses Obsidian Sync to sync selected guest and coordination records to the host's authorized vault devices. The EU AI Talk remote vault is in the Europe region. Private backup systems may also hold copies for recovery.
  • Metricool (Metricool Software, S.L., Spain) is used to schedule, publish, and analyse posts on connected platforms. It processes the intended text, images, audio and video content, publication times, and account and engagement data made available through the connected accounts. Metricool's linked privacy policy provides further details.
  • ChatGPT and Codex from OpenAI assist with preparing publication copy, planning, and managing and checking the publishing workflow. Content, instructions, and necessary tool outputs supplied for these tasks are processed by OpenAI. I retain editorial responsibility. The applicable data-handling rules depend on the product, account, and its settings; see OpenAI's information on accounts and data handling.
  • Distribution uses podcast and video platforms, the website, social media, and other suitable publication channels. Examples include Facebook, Instagram, Threads, X, Bluesky, LinkedIn, TikTok, YouTube, and Google Business Profile, as well as advertising placements such as Meta Ads where used. This list does not limit the agreed publication across media. Platforms also process content and usage data under their own privacy policies. Published material is accessible worldwide and may be saved and shared by third parties.

For this publishing workflow involving Metricool, ChatGPT/Codex, and publication platforms, I supply only material intended for that purpose and necessary planning details. Private coordination email addresses, phone numbers, delivery addresses, preparation notes, personal form links, consent evidence, and privacy requests are excluded. Information needed for coordination is still processed by the email, hosting, and CRM providers described above. This does not make it public.

Some providers may process data outside the European Economic Area (EEA). The location and transfer route depend on the provider and service. Where GDPR requires a transfer mechanism, this may be an applicable adequacy decision or an appropriate safeguard under Art. 46 GDPR, such as standard contractual clauses. Contact me for current transfer information for a particular provider and an available copy of the safeguard. Fastmail publishes its standard contractual clauses in its data protection agreement; Riverside publishes its processing terms in its data processing addendum.

Retention

We keep appointment requests and contact details while coordination, participation, and follow-up require them. Rejected or cancelled requests are reviewed and deleted when no further follow-up or legal need remains. Delivery addresses still kept from the time of headset shipping, and operational phone details, are removed manually when no longer needed, at the latest after the headset is returned; we then check that the cleanup was applied. Private notes and contact details are not published.

We retain complete recordings, including outtakes, and related production files in a private archive without a fixed expiry for historical documentation, possible future editorial use covered by the participant's permission, and evidence of the production and permissions. We review whether continued retention remains necessary. This does not make raw files public. A withdrawal stops the affected consent-based use for the future and prompts review of continued private retention. If permission no longer supports keeping material, we retain only what is needed for a specific legal obligation or claim, restrict it to that purpose, and review deletion when that need ends. Published material remains available while the relevant permission remains in effect. Consent evidence is retained while needed to document the decision, meet legal obligations, or establish, exercise, or defend legal claims, with periodic review and only for as long as those purposes require.

Encrypted private intake backups are not used for day-to-day operations and are limited to the 30 newest successful backup copies. This is a copy limit, not a fixed number of days: older copies may remain longer if new backups are paused or fail. Deleted active data may remain in these restricted recovery copies until they are replaced or separately removed. If data are restored from a backup, recorded deletion and withdrawal requests must be reapplied before the restored service returns to normal operation.

Researching possible guests

To find and invite guests for the podcast, we research publicly available professional information about people and companies: name, role, company, professional profiles and channels (such as LinkedIn, YouTube, company websites), posts published there, and a public profile picture. We store this information with its source in our internal planning system. We use profile pictures internally for recognition only and do not publish them.

For this research we use ScrapingBee by VostokInc SAS (Paris, France) to retrieve public profiles, profile pictures and company pages, ScrapeCreators by Web Scraping Guy LLC (Texas, USA) to search for public channels and posts, and Google's YouTube Data API; to draft a first message we use OpenAI Codex and Anthropic Claude. The legal basis is our legitimate interest in finding and approaching suitable guests (Art. 6 (1) (f) GDPR). You can object at any time (Art. 21 GDPR); we then delete your information and only note that we will not add you again.

When we contact you, we name the source of your information and refer to this notice. We delete information about people we do not contact no later than twelve months after it was collected; after a decline we delete the profile and pictures after three months.

Contact

Clicking an email link opens the email program configured in your browser; it does not itself send data to EU AI Talk. If you email, call, or submit a form, the information you provide is used to handle the enquiry. Email and calendar infrastructure is provided by Fastmail Pty Ltd. The legal basis is Art. 6(1)(b) GDPR for enquiries about potential cooperation and otherwise Art. 6(1)(f) GDPR. Messages are retained while needed to answer and for any resulting legal obligations.

Your rights

Subject to the statutory requirements, you have the right to access, rectification, erasure, restriction of processing, data portability, and objection to processing. You may withdraw consent for future processing at any time and ask us to remove or restrict material published under that consent. Each participant may make a request about their own data independently. We will stop the affected consent-based use for the future and take appropriate steps on our own channels. Public content may already have been copied or shared by others, so complete removal of third-party copies cannot be guaranteed.

To withdraw consent or request removal, use the withdrawal or removal request form. For these and other rights requests, you can also email andx@euai.talk or call +49 160 96909462. We will verify identity only when reasonably necessary. We normally reply within one month. If a lawful extension is needed, we will explain the reason and expected timeframe within that first month.

We privately store the name, contact details, affected content or scope, and optional message you submit through the form to identify and handle your request and document the action taken. These details are not published. You do not need to give fresh consent for this. We retain the request only as long as necessary to handle it, meet legal obligations, or establish, exercise, or defend legal claims.

You also have the right to lodge a complaint with a data protection supervisory authority. In Berlin, this is the Berlin Commissioner for Data Protection and Freedom of Information.