Privacy policy
This Privacy Policy explains how we process personal data when you visit our website, submit inquiries or job applications, use our company profiles, and participate in video conferences.
1. Data Controller and Contact Information
The entity responsible for the processing described in this statement is:
Roover GmbH
Im Mediapark 5
50670 Cologne
Germany
Phone: +49 175 9924 204
Email: info@roover.de
If you have any questions regarding the processing of your personal data or the exercise of your rights, please use the contact information provided.
2. Hosting and Technical Implementation
Hosting and Server Log Files
Our website is hosted by Raidboxes GmbH, Hafenstraße 32, 48153 Münster. Our domain and the associated DNS records are managed by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin. Both providers process data on our behalf based on a data processing agreement.
When you visit our website, technically necessary information is processed. This includes your IP address, the time of your visit, the URL you accessed, and the information transmitted by your browser regarding your browser, operating system, and, if applicable, the page you visited previously. This information is used to deliver the website, analyze errors, and defend against attacks. IP addresses are stored in log files for a maximum of seven days to detect and prevent attacks.
The legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest lies in the secure and reliable provision of our website. For more information, see the Raidboxes Privacy Policy and the STRATO Privacy Policy.
Cookies and Similar Technologies
Our website uses cookies and similar technologies that store or retrieve information on your device. For technologies that require consent, we will obtain your consent in advance. The legal bases are Section 25(1) of the TDDDG for storage and access, and Article 6(1)(a) of the GDPR for the associated processing.
To the extent that storage or access is absolutely necessary to provide a service you have expressly requested, the exception under § 25(2)(2) of the TDDDG applies. You may use the website in its entirety even without consenting to statistical analyses.
Consent Management with Borlabs Cookie
To manage your consent settings, we use the Borlabs cookie from Borlabs GmbH, Hamburger Straße 11, 22083 Hamburg. The plugin runs entirely on our server. Your settings are not transmitted to Borlabs.
The Borlabs cookie stores your selection and a randomly generated identifier in a cookie in your browser. The cookie is deleted after 182 days. After that, we will ask you again. To document your consent, your selection is logged on our server along with the identifier. The legal basis for this is Article 6(1)(c) of the GDPR in conjunction with Article 7(1) of the GDPR. The cookie is stored in accordance with Section 25(2)(2) of the TDDDG.
You can change or revoke your preferences at any time by clicking the cookie settings icon, which appears on every page.
Language Versions
Our website is available in German and English. We use the WPML plugin, which runs on our server, to provide this functionality. There is no automatic redirection based on your browser language. To display the selected language, WPML may set a technically necessary cookie (Section 25(2)(2) TDDDG).
Fonts and Icons
The Poppins and Roboto fonts, as well as the Font Awesome icons, are hosted on our own server. When the website loads, no connection is established with Google or other external providers.
3. Contact Form and Inquiries
If you contact us via the contact form, by email, or by phone, we will process your contact information, the content of your inquiry, and any information necessary to handle your request. The purpose is to respond to your inquiry and any follow-up questions you may have.
We create the contact form using Elementor Pro. The information entered in the form is sent to us via email through our web server at Raidboxes. It is not stored in our website’s database. Our email accounts are managed by Microsoft Ireland Operations Limited as our data processor as part of Microsoft 365. Information regarding data transfers to the U.S. can be found in Section 7.
If you are a party to the contract yourself, or if we are preparing a contract with you in response to your request, the legal basis is Article 6(1)(b) of the GDPR. For company contacts and other inquiries, the legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest lies in processing business inquiries.
Only the Roover employees responsible for processing your request will see it. We delete the data as soon as the request has been fully processed and we no longer need it. If the request leads to a contractual relationship, the statutory retention periods apply, such as those under commercial and tax law.
Contacting us is voluntary. We need the information marked as required fields in order to process your inquiry.
Spam Protection with hCaptcha
To protect our contact form from spam and automated requests, we use hCaptcha from Intuition Machines, Inc., 1065 SW 8th St #704, Miami, FL 33130, USA. hCaptcha verifies whether an entry was made by a human. To do this, it processes, in particular, your IP address, browser and device information, timestamps, and mouse and keyboard movements on the page. To accomplish this, hCaptcha may store or read information on your device.
The legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest lies in protecting our website from misuse and spam. To the extent that we request consent via the cookie settings, the legal basis is Article 6(1)(a) of the GDPR in conjunction with Section 25(1) of the TDDDG. You may withdraw your consent at any time.
Intuition Machines, Inc. is certified under the EU-U.S. Data Privacy Framework. Data transfers to the U.S. are based on the EU Commission’s Adequacy Decision (Art. 45 of the GDPR). According to hCaptcha, it deletes cookie and analytics data as soon as possible, no later than one year after the cookie expires. For more information, see hCaptcha’s Privacy Policy.
4. Applications
We accept applications via email. We process your contact information, your application materials, and any information generated during the application process, such as notes from interviews. The purpose is to make a decision regarding your employment. The legal basis is Article 6(1)(b) of the GDPR.
We process special categories of personal data—such as information regarding a severe disability—only to the extent necessary to exercise rights or fulfill obligations under labor law (Art. 9(2)(b) GDPR). Please do not send us any sensitive information that is not required for the application.
Only those involved in the selection process have access to your application. The emails are stored in our Microsoft 365 mailboxes (see Section 7).
If your application is rejected, we will delete your data six months after the conclusion of the application process. During this time, we retain your data to defend ourselves against potential claims, such as those under the General Equal Treatment Act. The legal basis for this is Article 6(1)(f) of the GDPR. If an employment relationship is established, we will transfer the necessary data to your personnel file and notify you separately.
We will only retain your information for a longer period for future job openings with your separate consent (Art. 6(1)(a) of the GDPR), which you may revoke at any time.
5. Statistical Analysis with Google
Google Tag Manager
We use Google Tag Manager and Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Tag Manager manages the analytics tags on our website. When the page loads, it establishes a connection to Google, during which your IP address is processed.
Tag Manager and Google Analytics are not loaded until you have given your consent in the “Statistics” category of the cookie settings. We use Google Consent Mode v2 in basic mode: Without your consent, no data is transmitted to Google via these services. The legal bases are Art. 6(1)(a) of the GDPR and § 25(1) of the TDDDG.
Google Analytics 4
We use Google Analytics to analyze how our website is used in order to improve its content and usability. The data processed includes pages viewed, time spent on the site, the source of the visit, device and browser information, and an approximate location at the city or region level. We also track the successful submission of the contact form and clicks on email addresses and LinkedIn links. The content of your form submissions is not transmitted to Google. The usage data is assigned to a pseudonymous identifier for your device.
Google Signals is disabled. According to Google, Google Analytics 4 does not store IP addresses. For visits originating in the EU, the IP address is used on servers in the EU to determine the location and is then discarded.
Google processes the data in accordance with the data processing terms we have accepted. We have disabled the sharing of data with Google for its own purposes. Access is granted only to Google’s technical support team for the purpose of troubleshooting issues.
Retention Period and Withdrawal
User- and event-level data is automatically deleted after 14 months. The period starts over each time you visit the site. Aggregated statistics that are not linked to individual visitors are not affected by this.
You can revoke your consent at any time by clicking the cookie settings icon. The revocation will take effect going forward. You can also prevent data collection by using Google’s browser add-on.
Data Transfer to the United States
Data may be transferred to Google LLC in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework (registration entry). The transfer is based on the EU Commission’s adequacy decision (Art. 45 GDPR). In addition, the standard contractual clauses in Google’s data processing terms apply (Art. 46 GDPR).
6. Company Profiles on Social Media
We maintain company profiles on LinkedIn, Facebook, Instagram, X, and YouTube. On our website, we provide links to these profiles using simple links without embedded plugins. This means that no connection to these networks is established when you visit our website. Only when you click on a link does the respective network process data in accordance with its own privacy policy. If you consent to statistics tracking, Google Analytics also records clicks on LinkedIn links.
When you contact us via a social media platform or interact with our posts, we process your information for the purposes of communication and handling your inquiry. The legal basis for this is Article 6(1)(f) of the GDPR. Our legitimate interest lies in business communication and providing information about our company. We delete data from inquiries as soon as your request has been resolved.
With regard to the statistics that the operators provide to us regarding the use of our profiles, we share responsibility with the operator on LinkedIn and Meta (Art. 26 GDPR). You may exercise your rights with us and with the platform operator. Since only the platform operator has access to user data, it is best to contact them directly.
The provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. The joint controller agreement for Page Insights can be found here. LinkedIn Corporation in the U.S. is certified under the EU-U.S. Data Privacy Framework. For more information, see LinkedIn’s Privacy Policy.
Facebook and Instagram
Both services are provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The joint controller agreement for page statistics applies to our Facebook page and our Instagram profile. You can find it here. Meta Platforms, Inc. in the U.S. is certified under the EU-U.S. Data Privacy Framework. For more information, see Facebook’s Privacy Policy and Instagram’s Privacy Policy.
X
The service provider for users in the EU is X Internet Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland. X Corp. in the U.S. is certified under the EU-U.S. Data Privacy Framework. For more information, see X’s Privacy Policy.
YouTube
Our YouTube channel is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google is responsible for data processing when you visit the channel. Google LLC in the U.S. is certified under the EU-U.S. Data Privacy Framework. For more information, see Google’s Privacy Policy.
Embedded Videos: When we embed YouTube videos on our website, we use the enhanced privacy mode. The videos are not loaded until you have given your consent in the cookie settings or have enabled the specific video by clicking on it. After that, a connection to Google is established. In the process, your IP address, the page you visited, and device and browser information are transmitted, and Google may store information on your device. If you are logged into YouTube, Google can associate the view with your account. The legal basis is Article 6(1)(a) of the GDPR in conjunction with Section 25(1) of the TDDDG. You can revoke your consent at any time by clicking the cookie settings icon.
7. Microsoft 365: Email and Video Conferencing
For email and video conferencing, we use Microsoft 365 from Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Microsoft processes the data as our data processor based on the Microsoft Data Protection Addendum.
Emails sent to us, including inquiries submitted via our contact form and job applications, are stored in our Microsoft 365 mailboxes. The purpose, legal basis, and retention period depend on the specific context (see Sections 3 and 4).
Video Conferences with Microsoft Teams
We use Microsoft Teams for video conferences with customers, prospective customers, job applicants, and business partners. In this context, we process names and contact information, details regarding the meeting and participation, connection and device information, as well as the content of the meeting—including video, audio, chat, and shared screen content.
If you are a party to a contract or if we are preparing a contract with you, the legal basis is Article 6(1)(b) of the GDPR. For company representatives and other business communications, the legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest lies in conducting business communications. Section 4 applies additionally to job interviews.
Recording, Transcription, and Copilot: We only record or transcribe meetings if all participants have been informed in advance and have given their consent (Art. 6(1)(a) GDPR). For transcribed meetings, Microsoft Copilot can generate summaries and to-do lists within our Microsoft 365 account. According to Microsoft, it does not use this content to train its AI models. We delete recordings, transcripts, and summaries as soon as we no longer need them for the agreed-upon purpose. You may withdraw your consent at any time.
We delete other data from meetings as soon as it is no longer necessary for communication, provided there are no legal retention requirements.
Data Transfer to the United States
Microsoft Corporation in the United States is certified under the EU-U.S. Data Privacy Framework. To the extent that data is transferred to the United States, this is done on the basis of the EU Commission’s adequacy decision (Art. 45 GDPR), supplemented by the standard contractual clauses in the Microsoft Privacy Agreement (Art. 46 GDPR). Further information: Microsoft Privacy Statement.
8. Retention Period, Security, and Your Rights
General Retention Period
Unless a specific retention period is stated in the individual sections, we store personal data only for as long as it is necessary for the respective purpose. We store it for a longer period only if there are statutory retention requirements or if we need it to assert, exercise, or defend legal claims.
Security
The connection between your browser and our website is encrypted using HTTPS. We take technical and organizational measures to protect your data.
Your Rights
Under the GDPR, you have the following rights:
- Information about the data we have stored about you and a copy of that data (Art. 15 of the GDPR)
- Rectification of Inaccurate Data (Art. 16 of the GDPR)
- Deletion of Your Data (Art. 17 of the GDPR)
- Restriction of Processing (Art. 18 GDPR)
- Data portability for data that you have provided to us and that we process automatically based on your consent or a contract (Art. 20 GDPR)
- Withdrawal of consent with future effect (Art. 7(3) of the GDPR). For the website, please use the cookie settings icon; for other types of consent, please use our contact information.
Right to Object (Art. 21 of the GDPR)
If we process your data on the basis of Article 6(1)(f) of the GDPR, you may object at any time for reasons arising from your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, or the processing is necessary for the establishment, exercise, or defense of legal claims.
If your data is processed for direct marketing purposes, you may object to this at any time. We will then no longer use your data for this purpose.
Right to File a Complaint
You may file a complaint with a data protection supervisory authority, particularly in the Member State where you reside, where you work, or where the alleged violation occurred. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestraße 2–4, 40213 Düsseldorf (Contact).
As of October 2026