How we handle your data

What employees control themselves

Each person decides directly in the app, separately for each processing purpose, whether and how their data is used — changeable at any time. By default, everything is set to OFF; nothing is secretly pre-selected.

• Consent — per purpose, individually
• Withdraw — just as easy as consenting, effective immediately
• Object — tracked separately, per Art. 21 GDPR
• Access and copy of your own consents, per Art. 15 GDPR

Neutral design, no dark patterns

The consent prompt is deliberately designed to be neutral, following the guidelines of the European Data Protection Board (EDPB). There's no pre-selection, no wording that pushes you toward agreeing.

Services work internally with pseudonyms, not a person's name. Personal details are removed before content is passed to external systems.

What leaders see — and what they don't

Leaders only receive aggregated results. Individual statements or people are never identifiable within them.

Transparency about your own data

• Every person can see which version of a consent they gave, and when.
• Recipients are disclosed — including an external text AI, which only receives content after redaction (removal of personal details).
• The right to complain to the relevant supervisory authority is explained.

Separating identity from content

"Privacy by Design" is built into 99rabbitsAI at the technical level: identity data and contributed content are stored separately from each other. Services work internally with pseudonyms rather than real names, and personal details are removed before content is passed to external systems (e.g. a text AI). A single contribution therefore cannot be traced back to a person.

Works Council and Co-Determination

We recommend involving the works council, data protection, and IT from the very start. Trust and governance boundaries are agreed jointly and documented.

Hosting and Storage Location

99rabbitsAI is designed for processing within the EU. The specific processors used, the data-centre locations, and the applicable retention periods are disclosed in the data processing agreement under Art. 28 GDPR, which you receive before the start and can review together with data protection and the works council.

Status

The Privacy Center (as of August 20, 2026) currently runs on the test environment and has been legally reviewed against the full GDPR compliance checklist. Next step: a withdrawal should stop processing not just in the display, but actively across all systems — going forward, changes should take effect everywhere within 24 hours at the latest. Self-service options will also be expanded with additional ways to access and delete data.

Built to GDPR: Consent (Art. 7) · Objection (Art. 21) · Access (Art. 15) · Transparency (Art. 12/13) · Data processing agreements (Art. 28).