Privacy Notice
Last updated: 9 October 2026
Applies to: ip-pilot.com and app.ip-pilot.com
Published at: https://www.ip-pilot.com/en/legal/privacy
Language: This notice is published in English only.
1. Who we are
IP Pilot is operated by:
Patent-Pilot GmbH
Kirchenstrasse 78
81675 Muenchen
Germany
Managing Directors: Robert Hollerbach, Dr. Volker Ruerup
Commercial register: Local Court of Munich (Amtsgericht München), HRB 232331
VAT ID: DE815697038
For any question about this notice or about your personal data, contact privacy@ip-pilot.com.
2. What this notice covers
This notice covers three different things, and the rules differ for each:
- Our website at ip-pilot.com, including everything you can see without logging in.
- The IP Pilot platform at app.ip-pilot.com, which you use under a License Agreement with us.
- The market data in IP Pilot, meaning the information about law firms, patent and trademark attorneys, other professionals and applicants that makes up the content of the product.
For all three, Patent-Pilot GmbH is the controller.
These three can apply to the same person at the same time. If you are, for example, a patent attorney who also uses IP Pilot at work, Part B applies to you as a user and Part C applies to your professional record in the market data. They are separate processing activities, carried out for separate purposes.
3. Part A: Our website
3.1 Server log data
When you visit ip-pilot.com, our servers and our content delivery provider automatically record technical data, including your IP address, the page requested, the date and time, the referring page, and information about your browser and operating system.
Purpose: delivering the site, keeping it secure, and defending against attacks.
Legal basis: Art. 6 (1)(f) GDPR. Our legitimate interest is operating a secure and functioning website.
3.2 Cookies and similar technologies
Apart from those that are strictly necessary to provide the site, we only set cookies and read information from your device with your consent. You give or refuse that consent in the banner shown when you first visit, and you can change your choice at any time using the cookie settings link in the site footer.
Legal basis: Section 25 (1) TDDDG together with Art. 6 (1)(a) GDPR for cookies requiring consent, and Section 25 (2) TDDDG together with Art. 6 (1)(f) GDPR for strictly necessary ones.
A current list of the individual cookies used, their purpose and their storage duration is maintained separately in our cookie policy, published at https://www.ip-pilot.com/en/legal/cookie-policy.
3.3 Website analytics and advertising
Where you consent to statistics or marketing cookies, we use the following:
| Service | What it does |
|---|---|
| Google Analytics 4 | Measures how the site is used, which pages are visited and which actions are taken |
| Google Ads | Measures which advertisements led to a visit or an inquiry, and shows our advertisements to people who have visited our site |
| LinkedIn Insight Tag | Measures the effect of our LinkedIn advertising and allows us to address comparable audiences |
| HubSpot tracking | Links a website visit to an inquiry you send us, so that we can respond in context |
Legal basis: Art. 6 (1)(a) GDPR.
3.4 Contact forms, requests for access and newsletter
When you submit a form on our website, for example to request access, download a report or contact us, we process the details you enter, which typically include your name, business email address, company and your message.
Fields marked as required are needed in order to process your request. Without them we cannot respond.
Purposes: answering your inquiry, providing the requested material, and contacting you about our products.
Legal basis: Art. 6 (1)(b) GDPR where the contact relates to a contract or its preparation, otherwise Art. 6 (1)(f) GDPR, our legitimate interest in responding to inquiries and in direct business communication. For the newsletter, Art. 6 (1)(a) GDPR. You can withdraw newsletter consent at any time using the unsubscribe link in every mailing.
This data is stored in our customer relationship management system.
We also receive inquiries through lead generation forms on LinkedIn. When you submit such a form, LinkedIn passes the details you enter to us, typically your name, business email address, company and job title. We process them for the same purposes and on the same legal basis as inquiries sent through our website. LinkedIn’s own processing of your data is governed by LinkedIn’s privacy policy.
3.5 Search on the website
Our website lets you search for a law firm by name. The search term is processed to return matching entries and to forward you to the corresponding preview page in the platform. Search terms are also recorded in our website analytics where you have consented to statistics cookies.
Legal basis: Art. 6 (1)(f) GDPR, our legitimate interest in providing and improving the search function.
4. Part B: The IP Pilot platform
This part applies to people who log in to app.ip-pilot.com as users of a customer organization.
4.1 Account, login and access rights
To give you access we process your name, business email address, the customer organization you belong to, your access rights and the product versions enabled for you, and technical identifiers assigned to your account.
Authentication is handled by an external identity provider. Account and entitlement information is also held in our customer relationship management system, which is connected to the identity provider so that we can manage which users have access to which parts of the product.
Purposes: providing access, administering the license, and supporting you.
Legal basis: Art. 6 (1)(b) GDPR for performance of the contract with your organization, and Art. 6 (1)(f) GDPR for administering our customer relationships.
4.2 Usage data
When you are logged in we record how the platform is used, linked to your user account. This includes the pages and functions you open, the actions you take, the time of those actions, your IP address and the approximate location derived from it.
Purposes: keeping the service secure and detecting unusual access, detecting misuse and checking compliance with the license terms, and improving the product.
Legal basis: Art. 6 (1)(f) GDPR. Our legitimate interest is operating a secure service, enforcing the agreed terms of use, and developing the product.
4.3 Content you create in the platform
The platform lets you create content, including personal notes, notes shared within your organization, saved dashboards and bookmarks. This content is stored so that it is available to you and, where you share it, to other users in your organization.
We process this content on behalf of your organization, which is the controller for it. The terms are set out in the Data Processing Agreement between Patent-Pilot GmbH and your organization. If you want to know how your organization handles this content, or you want it deleted, contact your organization in the first instance.
4.4 Artificial intelligence features
Some functions of the platform send the text you enter, together with related product data, to external providers of large language models so that a response can be generated. Where the input you provide contains personal data, that personal data is transmitted as part of the request.
Our contracts with these providers prohibit them from using the content we transmit to train their models.
Role and legal basis: the text you enter is processed on behalf of your organization, to generate the response and to keep your history available to you, as described in section 4.3. The providers act as our subprocessors. The market data used to generate the response is our own and is processed as described in Part C. Inputs to these functions are also used to improve the platform, on the basis of Art. 6 (1)(f) GDPR, our legitimate interest in developing the product.
Transfers outside the European Economic Area are described in section 7.
4.5 Maps, video and location lookup
Some functions rely on external services. To provide them, these services receive your IP address when you use the platform:
| Service | Purpose |
|---|---|
| Map display provider | Displaying search results on a map |
| Video hosting provider | Showing videos embedded in the platform |
| IP geolocation provider | Determining the approximate location of a login |
The IP geolocation lookup also supports the security purpose described in section 4.2, for example recognizing simultaneous logins from different locations.
Legal basis: Art. 6 (1)(b) GDPR for providing the requested function, and Art. 6 (1)(f) GDPR for the security purpose.
4.6 Billing and invoicing
We process the contact details needed to issue invoices to your organization, which may include the name of an individual contact, together with the invoice data itself. Invoice dates are visible to the admin users of your organization in the administration area of the platform.
Legal basis: Art. 6 (1)(b) GDPR, and Art. 6 (1)(c) GDPR for our statutory retention obligations under German commercial and tax law.
4.7 Publicly accessible profile pages
Some profile pages hosted on app.ip-pilot.com are accessible without logging in and can be found through search engines. They show a limited extract of the market data described in Part C. Visiting these pages is subject to the same rules on server log data, cookies, analytics and advertising as set out in Part A.
5. Part C: Market data about firms, professionals and applicants
This part explains how we process personal data about people whose professional activity is recorded in public patent and trademark records and who therefore appear in the IP Pilot product. It applies whether or not you are also a customer or user of ours. If you are, Part B applies to you as well, separately and for different data.
5.1 Where the data comes from
We obtain this data from:
- publicly accessible patent and trademark registers and official publications of patent and trademark offices, and
- other publicly accessible sources, including the websites of law firms and companies and public professional directories.
We do not obtain this data from you directly. Art. 14 GDPR therefore applies, and this section is the information required under that provision.
5.2 What data we process
- Name, and the professional role or function recorded
- The employer, law firm or organization the person is associated with
- Professional contact details, including business email address, where these are published in an accessible source
- The filings, proceedings and representations in which the person is named in official records, and the applicants and clients associated with those records
- Information derived from the above, such as activity over time, technical fields and jurisdictions
We consolidate this information into profiles of individuals, of law firms and of applicants, and we show how they relate to each other.
We do not process special categories of personal data within the meaning of Art. 9 GDPR for this purpose.
5.3 Why we process it
IP Pilot is a market intelligence product for the intellectual property sector. Its purpose is to make the structure and activity of that market transparent: who files what, where, for whom, and how that changes over time. Processing the professional details recorded in public registers is what makes that possible.
Legal basis: Art. 6 (1)(f) GDPR. Our legitimate interest, and the interest of our customers, is in transparency about a professional market that is documented in public records by law. We process only data relating to professional activity, taken from sources that are already public.
5.4 Who receives it
This data is made available to our customers, who are organizations that have licensed IP Pilot, and to their authorized users. Professional contact details as described in section 5.2 are shown only to customers holding the relevant product version.
Part of this data is also publicly accessible on profile pages that can be found through search engines, as described in section 4.7.
5.5 Publication instead of individual notification
Art. 14 (1) and (2) GDPR would normally require us to inform each person whose data we process. Our data covers a very large number of individuals, and for most of them we hold no means of contact at all. Notifying each person individually would involve disproportionate effort within the meaning of Art. 14 (5)(b) GDPR, and an unsolicited mass communication would itself be intrusive.
We therefore publish this notice instead, at a permanent and publicly accessible address, as the measure required by Art. 14 (5)(b) GDPR to protect your rights and interests.
5.6 Your right to object
If your personal data is processed as described in this Part C, you have the right to object at any time on grounds relating to your particular situation, under Art. 21 (1) GDPR. Write to privacy@ip-pilot.com. We will stop processing your data for this purpose unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms. Your other rights under section 9 apply here as well.
6. Recipients and service providers
We use external service providers to operate our website and our platform. Where they process personal data on our behalf, we have concluded data processing agreements with them under Art. 28 GDPR.
The categories of recipients and the providers we use in each category are:
| Category | Purpose | Providers |
|---|---|---|
| Hosting and infrastructure providers | Operating servers, databases and content delivery | Google Cloud, Amazon Web Services, Cloudflare, Hetzner, Raidboxes |
| Identity and access management | Authentication and login | Auth0 (Okta) |
| Product analytics and usage measurement | The usage data described in section 4.2 | Segment (Twilio), Mixpanel |
| Website analytics and advertising | The services described in section 3.3 | Google Analytics, Google Ads, LinkedIn, HubSpot |
| Customer relationship management, marketing and support | Inquiries, customer administration and support | HubSpot, LinkedIn (lead generation forms) |
| Billing and accounting | Invoicing and statutory bookkeeping | FastBill |
| Embedded content and in-product functions | Maps, video and location lookup | Google Maps Platform, Vimeo, ipapi.co |
| Providers of large language models | The functions described in section 4.4 | Google (Gemini) |
| IT and software development services | Support with the development, maintenance and operation of our platform | OctaCode |
| Office, communication and collaboration tools | Email, documents, internal communication, project and source code management | Microsoft 365, Atlassian (Jira, Confluence), Slack, GitLab, GitHub |
| Professional advisers and auditors | Legal, tax and audit services, where required | Not named |
We also disclose personal data where we are legally obliged to do so, for example to public authorities or courts.
7. Transfers outside the European Economic Area
Some of the providers referred to in section 6 are established outside the European Economic Area, or process data outside it. This applies in particular to providers established in the United States and to our software development service provider in Bosnia and Herzegovina.
Where we transfer personal data outside the European Economic Area, we do so on the basis of:
- an adequacy decision of the European Commission, where one applies to the provider and the transfer concerned, or
- the standard contractual clauses adopted by the European Commission under Art. 46 (2)(c) GDPR, together with an assessment of the circumstances of the transfer and, where necessary, additional protective measures.
Transfers to our software development service provider in Bosnia and Herzegovina take place on the basis of standard contractual clauses.
You can request a copy of the relevant safeguards from privacy@ip-pilot.com.
8. How long we keep data
We keep personal data for as long as it is needed for the purpose described in the relevant section above, and delete it once that purpose no longer applies. In practice:
- Account and contract data is kept while your organization’s license is in force, and afterwards for as long as we may still need it to wind up the contractual relationship or to defend a legal claim.
- Technical and usage data is kept for as long as it serves the security, operational and product purposes described above.
- Inquiry and marketing data is kept while there is an ongoing business relationship or a realistic prospect of one.
- Data collected with your consent is kept until you withdraw consent, or until the storage period stated in the cookie policy expires, whichever comes first.
- Market data as described in Part C is kept for as long as it remains relevant to the purpose in section 5.3, since the value of the product lies in showing professional activity over time. It is corrected and updated as the underlying public sources change.
- Invoicing and accounting records are kept for the periods required by German commercial and tax law.
Where a statutory retention obligation applies, we keep the data until that period ends and restrict its processing in the meantime.
9. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you (Art. 15)
- have inaccurate data corrected (Art. 16)
- have your data erased (Art. 17)
- have processing restricted (Art. 18)
- receive your data in a portable format (Art. 20)
- object to processing based on our legitimate interests, on grounds relating to your particular situation (Art. 21 (1)), and see section 5.6 above
- object to direct marketing at any time. Where we process your personal data for direct marketing, you may object without giving reasons, and we will stop processing it for that purpose (Art. 21 (2))
- withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal (Art. 7 (3))
To exercise any of these rights, write to privacy@ip-pilot.com. We respond within one month, and will tell you if we need longer.
You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian Data Protection Authority for the private sector (Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany). You may also complain to the authority where you live or work.
10. Changes to this notice
We update this notice when our processing changes or when the legal requirements change. The current version is always published at https://www.ip-pilot.com/en/legal/privacy, together with the date of its last update. Earlier versions are archived and remain available on request.
Changes take effect when published. Where a change affects processing that is based on your consent, we will ask for that consent separately.
