Privacy Notice – Support Service
With this notice, we inform you whether and which data we collect from you, and how we use, disclose, transfer, and store (“process”) it. We also explain how you can object to the use of your data. We always treat your personal data confidentially and in accordance with statutory data protection provisions and this privacy notice.
1. Who is responsible for data collection and processing?
The controller is:
ioki GmbH (“ioki”)
An der Welle 3
60322 Frankfurt am Main, Germany
Email: privacy@ioki.com
The appointed Group Data Protection Officer is:
Mr. Wolfgang Schlattmann
Email: privacy@ioki.com
2. Collection and processing of your data
We collect and process your data exclusively for specific purposes. These purposes may arise from technical necessity, contractual requirements, or explicit user requests.
For technical reasons, certain data must be collected and stored when you visit support.ioki.com, such as the date and duration of the visit, the pages accessed, your IP address, identification data for the browser and operating system used, and the website from which you accessed our site.
2.1 Support requests
To support the technical operation of the on-demand service, we use the helpdesk and issue-tracking system of the following provider:
181 Fremont St.,
San Francisco, CA 94105,
USA
The system serves the communication between us and you for handling technical inquiries, incident reports, and operational support cases. Where necessary for the analysis or resolution of technical issues, individual pieces of information from the operating system may also be processed as part of a support case. This is done exclusively to ensure technical operation and to resolve faults.
Storage location
The data location of the infrastructure used is within the European Economic Area (EEA). The service provider applies suitable technical and organizational measures to ensure the security and confidentiality of the data processed.
Reporting function
The reporting function available in Zendesk (analyses and reports for support staff, e.g. via Zendesk Explore) processes exclusively the data already collected in the course of ticket handling, and does so server-side. This processing takes place under the existing data processing agreement (Art. 6(1)(b) GDPR, DPA with Zendesk).
2.3 Cookie consent tool: CCM19
To obtain, document, and manage cookie consent, we use the consent management tool CCM19. Provider:
Papoo Software & Media GmbH
Auguststr. 4
53229 Bonn, Germany
| Name | Type | Duration | Purpose |
| ccm_consent | Local Storage | 1 year | Stores the cookie consent agreement specifying which cookies may be set |
Place of processing: Bonn & Falkenstein, Germany – no data is transferred to third countries.
Legal basis: Art. 6(1)(c) GDPR in conjunction with Section 25(2) No. 2 TDDDG (statutory obligation to document consent).
For the Web Widget (Classic), Zendesk additionally provides a pre-configured cookie permission interface: CCM19 transmits the consent status granted (or refused) to the widget, which only sets the corresponding functional and analytics cookies once consent has been given. Technically necessary cookies are excluded from this and are set irrespective of consent.
3. Legal basis for data processing
We process your personal data based on one of the following legal bases.
3.1 Consent
Where we obtain your consent for processing operations involving personal data, this serves as the legal basis pursuant to Article 6(1)(a) GDPR.
3.2 Contract
Where the processing of personal data is necessary for the performance of a contract with you, the contract constitutes the legal basis pursuant to Article 6(1)(b) GDPR. Article 6(1)(b) GDPR also applies to processing operations necessary for carrying out pre-contractual measures, for example in the case of inquiries about our products or services.
3.3 Legal obligations
Where our company is subject to a legal obligation that requires the processing of personal data, such as to fulfil tax obligations, the processing is based on Art. 6(1)(c) GDPR.
3.4 Legitimate interest
To continuously improve our offering, we store and analyze usage data on a pseudonymized basis. The legal basis for this is Art. 6(1)(f) GDPR.
We are also interested in maintaining the customer relationship with you and in providing you with information and offers that we believe match your interests. We therefore process your data (also with the assistance of service providers) on the basis of Article 6(1)(f) GDPR in order to send you information and offers. We use your contact details (first name, last name, email) for email advertising and market research, provided you have not objected to such use. Likewise, an email address that we have obtained from you in the course of a business relationship may be used for advertising purposes.
You may object to this use of your data for advertising purposes at any time with effect for the future. You can send your objection to us by email at hello@ioki.com (objection to advertising).
4. Encryption
To protect your data, the transmission of your data via the website takes place using SSL encryption. You can recognize an encrypted connection by the address bar changing from “http://” to “https://” and by the padlock symbol in your browser’s address bar.
When SSL encryption is activated, the data transmitted to us cannot be read by third parties.
5. Is data disclosed to third parties?
For the general handling of contracts, it is usually necessary to engage processors acting on our instructions, such as data center operators or other parties involved in fulfilling the contract.
External service providers who process data on our behalf are carefully selected by us and are contractually bound to strict obligations. The service providers act on our instructions, which is ensured through strict contractual provisions, technical and organizational measures, and additional controls.
Beyond this, your data will only be transferred if you have given us explicit consent to do so or on the basis of a legal provision.
Data is not transferred to third countries outside the EU/EEA or to an international organization unless appropriate safeguards are in place. These include the EU Standard Contractual Clauses as well as an adequacy decision by the European Commission.
6. How long is your data stored?
We store your data only for as long as is necessary to fulfil the purpose for which it was collected (for example, within the framework of a contractual relationship) or as long as required by law. Accordingly, in the context of a contractual relationship, we store your data at least until the contract has been fully terminated. The data is subsequently retained for the duration of the statutory retention periods. Please also note our information under No. 2.2.1 regarding the storage of applicant data.
Your personal data remains with us until the purpose of the data processing no longer applies. Upon a legitimate request for erasure, your data will be deleted, unless we have other legally permissible grounds, such as tax- or commercial-law retention obligations, for storing your personal data. Where statutory retention periods apply, deletion takes place once those periods have expired.
7. Use of cookies and analytics tools
Our website uses “cookies.” Cookies are small text files that are stored locally on your device when you visit a website. They do not cause any damage to your device. These cookies are stored either for the duration of a session (session cookies) or permanently (persistent cookies). Session cookies are automatically deleted at the end of your visit, while persistent cookies remain stored on your device until you delete them yourself or your browser deletes them automatically.
When using our Zendesk Help Center (Web Widget Classic), the following cookies and/or local storage elements are set.
7.1 Technically necessary cookies (no opt-in required)
These cookies are essential for the operation of the website and enable basic functions such as page navigation, access to protected areas, and ensuring the security of the website. Without these cookies, the website cannot function properly. Technically necessary cookies are used on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR, Section 25 TDDDG.
| Area | Cookie | Purpose | Retention |
| Zendesk – Auth/Session | _zendesk_session, _zendesk_shared_session, _zendesk_authenticated, _zendesk_login_session, zendesk_thirdparty_test | Authentication, session, CSRF protection | 8 hrs / Session |
| Zendesk – Help Center | _help_center_session | Session key | Session |
| Zendesk – Help Center | articleVotes | Prevents duplicate article ratings | Persistent/Session |
| Zendesk – Help Center | request_method | Navigation/preload | Persistent (Local Storage) |
| Zendesk – Web Widget (Classic) | ZD-zE_oauth | Auth token after login | 2 hrs |
| Zendesk – Web Widget (Classic) | _answer_bot_service_session | Answer Bot session key | Session |
| Cloudflare – Bot protection | __cf_bm, _cfruid, _cfuvid | Bot management, rate limiting | ~30 min / Session |
| Cloudflare Turnstile | cf_clearance | Confirms a passed bot check | 1 year |
| CCM19 (see above) | ccm_consent | Stores cookie consent | 1 year |
7.2 Cookies that are not strictly necessary for using the site
For the use of non-essential cookies, we request your unambiguous, freely revocable opt-in consent via the cookie banner in accordance with Section 25 TDDDG.
For technically necessary cookies, consent under Section 25 TDDDG is not required, and they are set automatically when you visit the website.
7.2.1 Functional/preference cookies
These cookies are used to store your preferences and settings on our website. This allows us to offer you a personalized experience and adapt the presentation of the website to your preferences. The use of preference cookies is based on your consent pursuant to Art. 6(1)(a) GDPR.
| Area | Cookie | Purpose | Retention |
| Help Center | GUIDE_REQUESTS_APP_COLUMN_CONFIG | View settings | Depends on browser |
| Web Widget (Classic) | ZD-settings | Hash of widget settings | Persistent |
| Web Widget (Classic) | ZD-store | Consistent widget display across page navigation | Persistent |
| Web Widget (Classic) | ZD-sendApiBlips | Reduces analytics blips for client-side API usage | Depends on browser |
| AI Agent – Advanced | lastReadMessageId_<bot ID>, platformConversationId_<bot ID>, isSoundToggleOn | Conversation/sound status | Persistent (Local Storage) |
7.2.2 Analytics cookies
Legal basis for categories 2 and 3: Art. 6(1)(a) GDPR and Section 25(1) TDDDG (consent).
| Area | Cookie | Purpose | Retention |
| Help Center | help_center_data | Stores search term (not linked to a user) | 48 hrs |
| Help Center | hc:{user-id}:recently_visited_articles | Recently viewed articles | Persistent (Local Storage) |
| Web Widget (Classic) | ZD-suid, ZD-buid | Session/device ID for analytics events | 20 min / Persistent |
| Zendesk Chat (formerly Zopim) | __zlcmid | Stores live chat ID | 1 year |
8. What rights do users have?
You have the right, at any time and free of charge, to obtain information about the origin, recipients, and purpose of your personal data stored by us. You also have the right to rectification, erasure, and restriction of your personal data, insofar as this is legally permissible and possible within the framework of an existing contractual relationship.
The right to restriction of processing applies in the following cases:
- If you dispute the accuracy of your personal data stored by us, we generally need time to verify this. For the duration of the verification, you have the right to demand the restriction of the processing of your personal data (Art. 16 GDPR).
- If the processing of your personal data was/is unlawful, you may request the restriction of data processing instead of erasure (Art. 17 GDPR).
- If we no longer need your personal data but you need it to assert, exercise, or defend legal claims, you have the right to request the restriction of the processing of your personal data instead of erasure (Art. 18 GDPR).
- If you have objected to processing, a balancing of your interests and ours must be carried out. As long as it has not yet been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data (Art. 21(1) GDPR).
If you have restricted the processing of your personal data, such data – apart from being stored – may only be processed with your consent, or for the assertion, exercise, or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the EU or a Member State.
Whether and to what extent these rights apply in an individual case, and the conditions that apply, are set out in the GDPR. The GDPR also grants you, under certain circumstances, a right to data portability (Art. 20 GDPR). Where you have given a data protection consent, you may revoke it at any time with effect for the future. You furthermore have the right to lodge a complaint with the competent data protection supervisory authority.
The supervisory authority responsible for ioki GmbH is:
Hessischer Datenschutzbeauftragter
Gustav-Stresemann-Ring 1
65189 Wiesbaden
To exercise your rights, a letter by post or an email is sufficient, addressed to:
ioki GmbH
An der Welle 3
60322 Frankfurt am Main
Email: hello@ioki.com
8.1 Revocation
Where you have given a data protection consent, you may revoke it at any time with effect for the future (Art. 7(3) sentence 1 GDPR).
The revocation does not affect the lawfulness of the processing carried out on the basis of your consent prior to the revocation. Likewise, any further processing of this data on a different legal basis remains unaffected.
9. Cookie settings
Cookie settings can be changed at any time via the cookie icon.
10. Updates to this privacy notice
We adapt this privacy notice to reflect changed functionalities or changes in the legal situation. We therefore recommend that you review this privacy notice regularly. Where your consent is required, or where parts of this privacy notice contain provisions of the contractual relationship with you, changes will only take effect with your agreement.
As of: August 2026
Note: This is an English working translation of the German-language privacy notice published at ioki.com/zendesk/. The German version is authoritative; in case of discrepancies, the German text prevails.
[DM1]Check Link auf der deutschen Seite