Privacy policy

This website sets no cookies and loads no third-party services into your browser. It does count page views — with software that runs on our own server in Germany and does not recognise you beyond the day. Unless you submit a form, your data does not leave our own servers.

• No cookies, no identifier in your browser, no consent prompt — because nothing is stored on your device.
• Traffic is measured with Umami on our own server in Germany. No analytics provider, no ad networks, no social networks.
• Fonts are downloaded at build time and served from our own server. Your browser does not contact Google.
• Appointment booking talks to Cal.com — from the server, not from your browser.

The controller within the meaning of Art. 4 (7) GDPR is:

Company

not yet provided

Address

not yet providednot yet provided

Email

[email protected]

Phone

not yet provided

Data protection officer: not yet provided

You have the following rights in relation to us:

Access, Art. 15 GDPR

You can find out whether and which data we process about you.

Rectification, Art. 16 GDPR

We must correct inaccurate data and complete incomplete data.

Erasure, Art. 17 GDPR

We erase your data unless a retention obligation stands in the way.

Restriction, Art. 18 GDPR

Instead of erasing, we can restrict processing on request.

Portability, Art. 20 GDPR

You receive your data in a common, machine-readable format.

Objection, Art. 21 GDPR

You can object to processing based on legitimate interests.

You may also lodge a complaint with a supervisory authority under Art. 77 GDPR. The authority responsible for us is: not yet provided

A message to [email protected] is enough for any of these requests.

The website is operated by: not yet provided

Every request produces access data that the server logs for technical reasons. This is typically the shortened or full IP address, date and time, the address requested, the page visited before, browser and operating system, and the transfer status.

We need this data to deliver the site, detect faults and fend off attacks. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is secure and stable operation.

Log retention period: not yet provided

We do not combine these logs with other data and do not analyse them to identify individuals.

To see which pages get read, we count page views with Umami. The software runs at umami.infra.veydex.com on our own server in Germany. No analytics provider is involved, and the figures never leave our own environment.

Umami sets no cookies, stores nothing in your browser and issues no identifier that would recognise you beyond the day. Each page view records:

• the address called up and the page you came from
• browser, operating system, device type and screen size
• your browser language and the country derived from your IP address
• the date and time of the visit

On top of that we count three events, because they tell us whether the site does its job: how far people scroll on the pricing page, how long the Hub page stays visible, and that the contact form was submitted. For the form we also count which industry was selected and which page you entered through — not what you wrote.

Your IP address is only used in memory: once to derive the country, and once to compute a visit identifier together with a random value that changes every day. The IP address itself is not stored. The visit identifier cannot be reversed and is a different one the next day — so we do not recognise you beyond a single day.

The purpose is traffic measurement: which pages get read, where visitors come from and where they drop off. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is improving this website on solid numbers rather than on gut feeling.

We do not ask for consent under Sec. 25 (1) TDDDG: the measurement stores nothing on your device and reads nothing from it that describes you. The single look into your browser storage is for the switch described in the next paragraph — that is, for your own objection. That is why this site shows no consent banner.

You can object to the measurement under Art. 21 GDPR; a message to [email protected] is enough. Two routes work immediately and without us: an ad or script blocker that blocks umami.infra.veydex.com — or the switch “umami.disabled” in your browser storage, which the script checks before every transmission and which silences it on that device.

Retention period for the measurement data: not yet provided

When you submit the contact form, we send the details you entered to our mailbox by email. Processed are:

• name (required)
• email address (required)
• your message (required)
• business, phone number, trade and the till system you run today, as far as you provide them
• the page you entered on, the domain that referred you, and any campaign parameters from the address bar, if there were any

That last line needs a word of explanation, because it is solved in an unusual way: those details live only in your browser's memory for as long as the tab is open. We store nothing on your device for it. Reload, or open a second tab, and they are gone — and then the enquiry simply says nothing about it.

The purpose is handling your enquiry. The legal basis is Art. 6 (1) (b) GDPR where the enquiry aims at a contract, otherwise Art. 6 (1) (f) GDPR — our legitimate interest is answering enquiries.

Sending runs through: not yet provided

We keep the enquiry until it is settled and no follow-up questions are expected. If it leads to a contract, commercial and tax retention periods apply.

On the pricing page you can put together a set of modules and have that selection sent to you by email. We process your email address, the modules you picked and the same origin details as for the contact form.

You receive exactly one email: your selection. We add you to no mailing list and send you nothing afterwards that you did not ask for. A copy goes to our mailbox so that someone can answer if you reply to it.

The purpose is sending the selection you requested. The legal basis is Art. 6 (1) (b) GDPR, because it happens on your request and serves the initiation of a contract.

So that nobody can use this form to bury other people's addresses in mail, we limit how many requests come from one email address and one IP address. For that the server remembers for one hour when a request arrived. That note lives only in memory and is not stored.

Sending runs through: not yet provided

We use Cal.com for appointment booking. The provider is Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA.

Worth knowing: your browser does not talk to Cal.com. The page asks our own server for free slots, and only that server turns to Cal.com. No scripts, tracking pixels or cookies from Cal.com are loaded into your browser.

A booking transmits:

• name and email address (required)
• business, phone number and what it is about, as far as you provide them
• the slot you chose and your time zone

The purpose is arranging and holding the appointment, including the confirmation and the calendar invite. The legal basis is Art. 6 (1) (b) GDPR.

Cal.com processes the data as our processor. As the provider is based in the United States, a transfer to a third country takes place — see section 12.

If you apply through the form on the careers page, we process:

• name and email address (required)
• phone number, links and your message, where you provide them
• the documents you upload
• the role you are applying for, together with its role number

The purpose is to run the application process. The legal basis is section 26(1) sentence 1 BDSG in conjunction with Art. 88 GDPR: the processing is necessary for deciding whether to enter into an employment relationship. Where your documents contain details going beyond that — a photograph or a date of birth, say — we rely on your consent under Art. 6(1)(a) GDPR. You give it when you submit and can withdraw it at any time with future effect.

Your documents are not sent around as email attachments. They sit in object storage only we can reach; the notification to us contains nothing but the storage location. The storage is operated by: not yet provided

We delete your application no later than six months after the process ends. The period follows the two-month limitation period in section 15(4) AGG plus an allowance for service and the duration of any proceedings. If the application leads to employment, the documents go into the personnel file instead.

If you want to be deleted sooner, a message to us is enough. We will not add you to a talent pool — nothing is kept for later without asking you.

The site uses the typefaces Geist Sans and Geist Mono. They are downloaded once when the application is built and served from our own server afterwards. Loading the page therefore sends no request to Google and transmits no IP address there.

The contact form and the booking form each contain a hidden field that only automated programs fill in. If it is filled, we discard the request. No personal data is collected for this and no third-party service is involved. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is preventing abuse.

Apart from us, your data reaches only:

Hosting

not yet provided

Email delivery

not yet provided

Appointment booking

Cal.com, Inc., USA

Data processing agreements under Art. 28 GDPR are in place with all processors. A transfer to the United States takes place for appointment booking. It is to be safeguarded by the standard contractual clauses under Art. 46 (2) (c) GDPR or, where the provider is certified under it, by the adequacy decision on the EU-US Data Privacy Framework.

We do not sell data, do not pass it on for advertising purposes and disclose it to authorities only where we are legally obliged to.

This website carries out no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

Where a business processes data of its guests, customers or staff in the Veydex Hub, that business is the controller. Veydex then acts as a processor under Art. 28 GDPR on the basis of a separate agreement.

Data subjects should therefore address requests for access, rectification and erasure to the business where they are a guest or customer. We forward such requests and support the business in answering them.

We adapt this policy when the processing changes or the law requires it. The version published on this page at the time applies.