Privacy policy

As of October 2026 · for the Latoda inspection platform (https://ai.latoda.de)

1. Controller

The controller responsible for processing personal data on this platform is:

Adoxin UG
Katharinenstr. 4
20457 Hamburg
Germany
Phone: +49 (40) 37 50 248 -57
Email: info@adoxin-group.com

Latoda is Adoxin UG's brand for its AI products. Further details are in the imprint. Please send questions about data protection to the e-mail address above.

2. What this is about

Companies use the platform to record and evaluate inspections of wind turbines and to create reports. For now it is open by invitation only: only people we have given access can use it. This policy explains which personal data is processed, for what, on which legal basis, and what rights you have.

3. Visiting the platform

For every page you open, our hosting provider processes technically necessary data: IP address, time, requested address, amount of data transferred and browser details. This is needed to deliver the pages and run the platform securely (Art. 6(1)(f) GDPR; legitimate interest in secure, stable operation). These logs are deleted automatically after a limited period.

4. Signing in

Sign-in uses the Auth0 service of Okta, Inc. (EU region). It processes your e-mail address, your name (if given), an identifier of your account and whether your e-mail address is confirmed; passwords are handled by Auth0 alone - we never receive them. The legal basis is Art. 6(1)(b) GDPR (providing access) and (f) (protection against unauthorized access).

For every sign-in we store the time, IP address and browser details. If a sign-in is refused because the address has no access, we store the e-mail address, time and IP address of that attempt. Both serve security and accountability (Art. 6(1)(f) GDPR).

5. Your account and use

For your account we store your e-mail address, name, language, your organizations and roles, and when you last used the platform. Changes administrators make to accounts, memberships, organizations and sharing are logged (who, what, when, IP address). When a technical error occurs, we store a description of it with the identifier of the account concerned; these entries are deleted regularly. The legal basis is Art. 6(1)(b) GDPR, for logs and errors (f) (security, fixing faults).

6. Content you record

Sites, turbines, components, inspections, photos, files and reports recorded or uploaded on the platform belong to the respective organization. They may contain personal data, for example names of people in inspection reports or on photos. For this content the organization that records it decides on purposes and means; we process it on its behalf (Art. 28 GDPR). We provide a data processing agreement on request. Who sees the content is decided by the organization and what it shares with other organizations.

7. Cookies

We set exactly one cookie: latoda_platform_session. It keeps your sign-in, the chosen organization, the language and the chosen colour scheme (light/dark), is strictly necessary to use the platform and expires after 14 days at the latest. There are no analytics, tracking or advertising cookies, so no consent is required (Section 25(2) no. 2 TDDDG).

8. AI assistance for imports, forms and repair economics

When you import a table (CSV/Excel), the platform can propose which column matches which field. Only then are the column names and at most 20 sample rows of the file sent through the Requesty service (EU gateway in Frankfurt am Main, Germany) to a Microsoft Azure OpenAI model operated in France. The data serves only this proposal; a person always checks the result before anything is taken over. For each call we store only the time, purpose and cost, not the content. The legal basis is Art. 6(1)(b) and (f) GDPR. Please do not upload unnecessary personal data for imports. Likewise, an organization's administrator can build their own inspection forms with an AI assistant: then their request, the earlier messages of that conversation and the form itself (chapters, questions, answer options - no inspection data) are sent the same way; a proposal is only taken over when the administrator saves it. If they attach a file (such as their company's existing checklist), that file is sent too. If they have a form's own texts translated, only those texts are sent. Whoever edits an inspection can have its form filled in from documents (such as an earlier report, an oil analysis or a photo of the nameplate): then those documents and the form's questions are sent; the proposed values are only stored once the person has checked and accepted them, and the inspection's history notes this with the file names. Likewise, an organization's administrator can have the values of its repair economics assumptions (such as day rates, prices, contract terms) proposed from documents such as quotes, framework contracts or power purchase agreements: then those documents and the list of inputs are sent; a value is only taken over once the administrator has checked it and saved the assumptions. For the summary of the repair economics in a BLD-AI report, the computed results (amounts, years, the recommendation - no personal data) are sent; the AI writes only the text, and the platform fills in every figure in it. We do not store attached files or documents; please do not upload documents containing unnecessary personal data. No other content is sent to AI services; BLD-AI's forecasts are computed by the platform itself.

9. Maps and weather data

Maps on the platform's pages (e.g. the overview of sites) load map tiles from OpenStreetMap (OpenStreetMap Foundation, United Kingdom). Their server receives your IP address and browser details. The legal basis is Art. 6(1)(f) GDPR (showing locations); the European Commission has issued an adequacy decision for the United Kingdom.

The map in BLD-AI reports loads map data (tiles, map style, fonts) from OpenFreeMap (Hyperknot Software Kft., Hungary) when the report is opened. Their server receives your IP address and browser details; according to the provider, its access logs contain no IP addresses and error logs are deleted after 7 days. OpenFreeMap delivers the map data through the content delivery network Cloudflare (Cloudflare, Inc., USA; certified under the EU-U.S. Data Privacy Framework). No cookies are set. The legal basis is Art. 6(1)(f) GDPR (showing locations). Without an internet connection, or when the map cannot be loaded, the report shows the positions without map data.

For erosion forecasts the platform retrieves weather data from NASA POWER. Only the coordinates of the turbine are sent, no personal data.

10. Recipients and processors

• Railway Corporation (USA) - hosting of the application, database and files. The data is kept in the EU region (Amsterdam, Netherlands).
• Okta, Inc. / Auth0 (USA) - sign-in; stored in the EU region.
• Requesty (Frankfurt am Main) and Microsoft Azure OpenAI (data center in France) - only for AI assistance with imports, forms and repair economics (section 8).

Data processing agreements under Art. 28 GDPR are or will be concluded with these providers. Where a provider is based in the USA and access from there cannot be ruled out, transfers are based on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR) or, where the provider is certified, the EU-U.S. Data Privacy Framework (Art. 45 GDPR).

Within the platform, your data is seen by the members of your organization and - as far as your organization shares something - by members of other organizations. Data is never passed on to third parties for advertising.

11. How long we keep data

We keep account data for as long as you have access to the platform. When your access ends, we delete it at your request and otherwise as soon as it is no longer needed for the purposes above, unless statutory retention obligations apply. After an erasure, what you recorded for an organization stays with that organization, but without your name. We delete error entries after 90 days; the e-mail address, IP address and browser details of refused sign-ins after 90 days; IP addresses and browser details of all other log entries after one year. An organization's content is kept for as long as that organization uses the platform. Database backups are deleted automatically when their retention period ends.

12. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). To exercise them, write to info@adoxin-group.com. If your request concerns an organization's content (section 6), we forward it to that organization.

You also have the right to lodge a complaint with a data protection supervisory authority, for example the one responsible for us: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany.

13. No automated decisions

There is no automated decision-making or profiling within the meaning of Art. 22 GDPR. The platform's forecasts concern turbines, not people.

14. Changes

We update this policy when the platform or the law changes. The version published here applies.