Privacy Policy

Last updated: 2 November 2026

This policy describes the current Customer Action Desk validation website at customeractiondesk.com, its example demo, launch-notification form and feedback form.

Controller and contact

Email: info@customeractiondesk.com. Use this contact for privacy requests or to withdraw a launch-notification request.

Website delivery, hosting and security

Our hosting provider is DomainFactory GmbH, c/o WeWork, Neuturmstraße 5, 80331 München, Germany. Delivering the website necessarily involves processing connection data, including your IP address, requested resource, request time and browser request headers. Hosting infrastructure may retain access and error logs to operate and secure the service. This server-level processing is separate from the validation analytics described below.

The website stores form submissions and validation records in a server-side database. The operator and hosting services supporting the website, database and logs process these data for their respective operational purposes. Hosting-log retention depends on operational and security needs and the provider's applicable arrangements; no fixed server-log deletion period is specified here.

For site delivery, operational diagnostics and security, the legal basis is Article 6(1)(f) GDPR: our legitimate interests in providing a reliable website, preventing misuse and investigating faults.

Recipients and international transfers

DomainFactory may use subprocessors and affiliated GoDaddy-group companies to provide and support its hosting services. Depending on the service or support involved, this may include processing of or access to personal data from countries outside the European Economic Area, including the United States. Where required, applicable transfer mechanisms may include an adequacy decision, including the EU-US Data Privacy Framework where applicable, or the European Commission’s Standard Contractual Clauses. Further information is available in DomainFactory’s privacy information.

Validation and campaign analytics

We use first-party measurements to evaluate interest in the product concept, understand campaign and source performance, understand interaction with the validation page and demo, and distinguish obvious automated traffic.

For each new landing-page visit or standalone demo visit, the application creates a random, opaque validation identifier. Initial attribution is captured once and is not overwritten by later events. The application associates this identifier with:

• The original external referrer's hostname, where supplied, rather than the full referrer URL; the landing path and page version.
• Campaign parameters: utm_source, utm_medium, utm_campaign, utm_content and utm_term, where present.
• Primary language from the ordinary request headers and a coarse desktop, mobile or tablet category derived from the browser request header. Browser timezone and JavaScript-derived browser language are not collected.
• Visit and event timestamps, JavaScript-seen and qualified-visit signals based on page visibility.
• Landing sections reached, Explore navigation interactions, form focus/submission/success signals, and demo progress such as starting, skipping the introduction, requesting approval, executing an example action, viewing history/details, completing or restarting the demo.
• Bot/honeypot classifications and their reasons.

The tracking application does not store raw or hashed IP addresses or full user-agent strings. Browser headers are processed to derive coarse device and known-crawler indicators. Analytics events do not contain submitted email addresses or feedback text; these are stored separately. The identifiers are pseudonymous, not a guarantee of anonymity.

The legal basis for our validation and campaign analytics is Article 6(1)(f) GDPR. Our legitimate interests are evaluating demand for Customer Action Desk, measuring the effectiveness and quality of campaign traffic, understanding how visitors interact with the validation page and demo, and distinguishing obvious automated traffic from likely human visits.

We limit this processing to what is reasonably necessary for those purposes. The analytics use an ephemeral, pseudonymous visit identifier that is not stored in cookies, localStorage, sessionStorage or other persistent browser storage. We do not use fingerprinting, cross-site tracking or third-party analytics services, and the analytics application does not store raw or hashed IP addresses.

The current validation page and demo do not use Google Analytics or comparable third-party analytics, fingerprinting, localStorage or sessionStorage for tracking, cross-site tracking, or behavioural advertising. Fonts, scripts, images and the demo are served from this site; no external analytics service receives these events.

Security cookie and ephemeral analytics identifier

The landing page uses CADSESSION, a first-party PHP session cookie for this hostname, with a configured lifetime of 24 hours. It is sent only over HTTPS, is unavailable to JavaScript (HttpOnly), and uses SameSite=Lax. It identifies server-side state for form-security tokens, session integrity, expiry and submission limits. Analytics do not use this cookie or store analytics state in the PHP session.

The analytics identifier is rendered into the current page and held in its document and JavaScript memory. It is not stored in cookies, localStorage, sessionStorage, IndexedDB or another persistent browser-storage API. The embedded same-origin demo reads the current parent page's identifier; the token is not included in the demo URL. Analytics requests omit cookies. Optional hidden form fields carry the identifier so a successful submission can be associated with the current visit; missing or invalid analytics linkage does not prevent a valid form submission.

Identifiers are valid for analytics writes for 24 hours from visit creation, independently of database retention. Reloading or returning later normally creates a new visit, and separate tabs normally create separate visits. A standalone demo visit is independent. These measurements count validation/page visits, not unique people or cross-day visitors.

You can delete or block cookies in your browser; doing so can prevent secure form submission, while analytics do not require a cookie. The demo and these legal pages do not start a PHP session. These legal pages send no campaign/demo engagement events, although an existing site cookie may accompany ordinary requests to this hostname.

Launch notifications

If you voluntarily enter your email address and submit the launch-update form, we store it with a source label, subscription status and timestamps for the requested notification when Customer Action Desk is ready. The legal basis is your consent expressed by that specific request, under Article 6(1)(a) GDPR. It is not a request for unrelated marketing.

The current form stores the address for a future launch notification. It sends no immediate email or confirmation email and does not implement double opt-in. A successful signup can also be recorded as a conversion associated with the current validation visit, including whether the address was already on the list.

You can withdraw your request at any time by contacting info@customeractiondesk.com. Withdrawal does not affect the lawfulness of consent-based processing before withdrawal. Providing an email address is optional; without it, we cannot send the requested update.

Product feedback

Submitting feedback is optional. We store your feedback text and its submission timestamp to evaluate and improve the product concept. The legal basis is Article 6(1)(f) GDPR, reflecting our legitimate interest in understanding and documenting feedback voluntarily provided to us.

The feedback record does not contain a direct validation-visit reference. Form security uses the separate security session; if an optional valid analytics identifier is supplied, a successful submission can create a visit-linked analytics event. Timing and anything you include in the text may make feedback identifiable, so it should not be treated as anonymous. Please avoid including sensitive information or other people's personal data.

Automated traffic and spam prevention

We use technical anti-spam and bot-detection mechanisms, including honeypot fields, known-crawler indicators, form-security checks and interaction signals, to recognise obvious automated traffic and spam. Suspected automated submissions may be discarded. These measures help protect the website and preserve the validity of interest measurements.

For security and spam prevention, the legal basis is Article 6(1)(f) GDPR: our legitimate interest in protecting the service and preventing abuse. Using classification for campaign analysis is part of the analytics processing described above. These measures do not make decisions with legal or similarly significant effects about visitors.

Retention

Validation analytics are retained only as long as necessary to evaluate the relevant campaign and product validation and are deleted afterwards. Launch-notification addresses are retained until the requested notification is sent, consent is withdrawn or the validation purpose ends. Feedback is retained only as long as necessary to evaluate and document product feedback.

Session-security state expires after 24 hours. Server-side session files then become eligible for cleanup; physical removal can occur later. Cookie expiry does not delete database records. Necessary incident investigation or applicable legal obligations may justify retaining specific records longer.

Your rights

Subject to the applicable GDPR conditions, you may request access, rectification, erasure, restriction of processing and data portability. Where processing is based on legitimate interests, you may object on grounds relating to your particular situation. Where it is based on consent, you may withdraw consent at any time without affecting earlier lawful processing.

Contact info@customeractiondesk.com to exercise these rights. We may need proportionate information to identify the relevant record and verify your request; a random visit identifier alone does not tell us your name.

You may complain to a supervisory authority, including the State Commissioner for Data Protection of Lower Saxony (LfD Niedersachsen), or the authority for your habitual residence, workplace or the place of an alleged infringement.