Privacy policy

This website sets no cookies and loads no third-party services into your browser. It does count page views — with software that runs on our own server in the EU and does not recognise you beyond the day. Unless you submit a form or ask Kio something, your data does not leave our own servers.

• No cookies, no identifier in your browser, no consent prompt — because nothing is stored on your device.
• Traffic is measured with Umami on our own server in the EU. No analytics provider, no ad networks, no social networks.
• Fonts are downloaded at build time and served from our own server. Your browser does not contact Google.
• Appointment booking talks to Cal.com — from the server, not from your browser.
• Questions to the AI help Kio go to OpenAI without recognisable personal details — from the server, not from your browser. We do not store the conversation unless you hand it over to our team.

The controller within the meaning of Art. 4 (7) GDPR is:

Company

Veydex UG (haftungsbeschränkt) i. G.

Address

Posberg 6a25923 Süderlügum

Email

kontakt@veydex.com

Phone

+49 157 58353026

We have not appointed a data protection officer. We are not required to under Art. 37 GDPR and Sec. 38 BDSG.

You have the following rights in relation to us:

Access, Art. 15 GDPR

You can find out whether and which data we process about you.

Rectification, Art. 16 GDPR

We must correct inaccurate data and complete incomplete data.

Erasure, Art. 17 GDPR

We erase your data unless a retention obligation stands in the way.

Restriction, Art. 18 GDPR

Instead of erasing, we can restrict processing on request.

Portability, Art. 20 GDPR

You receive your data in a common, machine-readable format.

Objection, Art. 21 GDPR

You can object to processing based on legitimate interests.

You may also lodge a complaint with a supervisory authority under Art. 77 GDPR. The authority responsible for us is: Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel

A message to kontakt@veydex.com is enough for any of these requests.

The website is hosted by: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, with data centres in Germany and Finland, i.e. within the EU

Every request produces access data that the server logs for technical reasons. This is typically the shortened or full IP address, date and time, the address requested, the page visited before, browser and operating system, and the transfer status.

We need this data to deliver the site, detect faults and fend off attacks. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is secure and stable operation.

Log retention period: 14 days

We do not combine these logs with other data and do not analyse them to identify individuals.

To see which pages get read, we count page views with Umami. The software runs at umami.infra.veydex.com on our own server in the EU. No analytics provider is involved, and the figures never leave our own environment.

Umami sets no cookies, stores nothing in your browser and issues no identifier that would recognise you beyond the day. Each page view records:

• the address called up and the page you came from
• browser, operating system, device type and screen size
• your browser language and the country derived from your IP address
• the date and time of the visit

On top of that we count three events, because they tell us whether the site does its job: how far people scroll on the pricing page, how long the Hub page stays visible, and that the contact form was submitted. For the form we also count which industry was selected and which page you entered through — not what you wrote.

Your IP address is only used in memory: once to derive the country, and once to compute a visit identifier together with a random value that changes every day. The IP address itself is not stored. The visit identifier cannot be reversed and is a different one the next day — so we do not recognise you beyond a single day.

The purpose is traffic measurement: which pages get read, where visitors come from and where they drop off. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is improving this website on solid numbers rather than on gut feeling.

We do not ask for consent under Sec. 25 (1) TDDDG: the measurement stores nothing on your device and reads nothing from it that describes you. The single look into your browser storage is for the switch described in the next paragraph — that is, for your own objection. That is why this site shows no consent banner.

You can object to the measurement under Art. 21 GDPR; a message to kontakt@veydex.com is enough. Two routes work immediately and without us: an ad or script blocker that blocks umami.infra.veydex.com — or the switch “umami.disabled” in your browser storage, which the script checks before every transmission and which silences it on that device.

Retention period for the measurement data: 24 months

When you submit the contact form, we send the details you entered to our mailbox by email. Processed are:

• name (required)
• email address (required)
• your message (required)
• business, phone number, trade and the till system you run today, as far as you provide them
• the page you entered on, the domain that referred you, and any campaign parameters from the address bar, if there were any

That last line needs a word of explanation, because it is solved in an unusual way: those details live only in your browser's memory for as long as the tab is open. We store nothing on your device for it. Reload, or open a second tab, and they are gone — and then the enquiry simply says nothing about it.

The purpose is handling your enquiry. The legal basis is Art. 6 (1) (b) GDPR where the enquiry aims at a contract, otherwise Art. 6 (1) (f) GDPR — our legitimate interest is answering enquiries.

Sending runs through: Brevo SAS, 106 boulevard Haussmann, 75008 Paris, France, with data centres in the EU. Messages arrive in our mailbox at Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, Netherlands, also with data centres in the EU

We send a confirmation of receipt to the address you gave. It contains your name but not your message, and any reply to it lands in our mailbox. The same applies to the till check on the contact page; there you only enter your till system and your email address, and the confirmation names the till system.

We keep the enquiry until it is settled and no follow-up questions are expected. If it leads to a contract, commercial and tax retention periods apply.

On the pricing page you can put together a set of modules and have that selection sent to you by email. We process your email address, the modules you picked and the same origin details as for the contact form.

You receive exactly one email: your selection. We add you to no mailing list and send you nothing afterwards that you did not ask for. A copy goes to our mailbox so that someone can answer if you reply to it.

The purpose is sending the selection you requested. The legal basis is Art. 6 (1) (b) GDPR, because it happens on your request and serves the initiation of a contract.

So that nobody can use this form to bury other people's addresses in mail, we limit how many requests come from one email address and one IP address. For that the server remembers for one hour when a request arrived. That note lives only in memory and is not stored.

Sending runs through: Brevo SAS, 106 boulevard Haussmann, 75008 Paris, France, with data centres in the EU. Messages arrive in our mailbox at Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, Netherlands, also with data centres in the EU

We use Cal.com for appointment booking. The provider is Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA.

Worth knowing: your browser does not talk to Cal.com. The page asks our own server for free slots, and only that server turns to Cal.com. No scripts, tracking pixels or cookies from Cal.com are loaded into your browser.

A booking transmits:

• name and email address (required)
• business, phone number and what it is about, as far as you provide them
• the slot you chose and your time zone

The purpose is arranging and holding the appointment, including the confirmation and the calendar invite. The legal basis is Art. 6 (1) (b) GDPR.

Cal.com processes the data as our processor. As the provider is based in the United States, a transfer to a third country takes place — see section 13.

In the help window at the bottom right you can ask Kio questions. Kio is an artificial intelligence — a language model, not a person. Kio answers questions about Veydex based on our help articles and can get things wrong. Our help articles and the answers of our team are what counts. Kio makes no decisions about you.

When you send Kio a question, our server processes the text of the question and up to eight earlier lines of the current conversation. Before any of it is passed on, it replaces recognisable personal details with placeholders:

• email addresses, phone numbers, IBANs and card numbers
• addresses with street and house number
• passwords, PINs and one-time codes
• VAT identification numbers
• names, if you state them explicitly (“my name is …”)

A filter like this does not catch everything. So please do not enter personal or sensitive data — no passwords, no bank details, nothing about your guests or your team. Kio does not need any of it to answer a question about Veydex.

The cleaned question, the cleaned conversation and matching excerpts from our help articles go to the programming interface of the AI provider, which generates the answer. Your browser has no connection to it; it receives neither your IP address nor any identifier of yours. The provider is: OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland

OpenAI processes the data as a processor on our behalf (Art. 28 GDPR) and does not use it to train its models. OpenAI uses further sub-processors, including OpenAI OpCo, LLC in the USA; OpenAI publishes the current list at platform.openai.com/subprocessors.

Data may be transferred to the USA in the process. No adequacy decision of the EU Commission covers this transfer, because OpenAI is not certified under the EU-US Data Privacy Framework. It relies on the EU Commission's standard contractual clauses under Art. 46 (2) (c) GDPR; you can request a copy at kontakt@veydex.com. Despite these safeguards, access to the data by US authorities cannot be ruled out.

We do not store your conversation with Kio. Question and answer stay in our server's memory only until the answer has reached you, and we write them to no log. OpenAI keeps requests and answers for up to 30 days to detect abuse and deletes them afterwards, unless OpenAI is legally required to keep them longer.

If the same general question comes in again — say “How do I reset my password?” — we answer from a cache instead of sending it to OpenAI again. Only the first question of a conversation goes in, and only if the filter found nothing in it, stored as a check value together with the answer: for 24 hours at most and only in our server's memory. Neither your IP address nor an identifier nor the time of your question is stored — the answer cannot be linked to you.

To stop anyone from querying Kio in bulk, we limit the number of questions per IP address. For this the server keeps a check value calculated from the address and the times of the questions — only in memory and for one hour at most. The IP address does not go to OpenAI.

If Kio cannot help or you would rather talk to a person, you can hand the conversation over to our team. Kio then asks for your email address and, optionally, your business. Only after you confirm do the conversation, email address and business go as a support request to our own system, the Veydex Hub on our servers (section 4) — not to OpenAI. The same applies to messages you write in the help window without Kio. A person from our team replies by email. If our system is unreachable at that moment, the request goes to our mailbox by email instead; sending works as for the contact form (section 6).

We keep a support request until it is resolved and no follow-up questions are to be expected. If it concerns a contract with us, the retention periods under commercial and tax law apply as well.

The legal basis for Kio, the cache and the limit per IP address is Art. 6 (1) (f) GDPR. Our legitimate interest is to answer questions about Veydex quickly and at any hour, and to protect the service from abuse and unnecessary cost. Handing over to our team is based on Art. 6 (1) (b) GDPR where your request concerns or prepares a contract with us, otherwise on Art. 6 (1) (f) GDPR — our legitimate interest is answering your request.

Using Kio is voluntary. You can reach us just as well through the contact form or by email at kontakt@veydex.com. You can object to the processing under Art. 21 GDPR (section 3). Because we do not store your conversation with Kio, the simplest way to object is not to use Kio; for a request that was handed over, a message to kontakt@veydex.com is enough.

The help window stores nothing on your device. The conversation lives only in your browser's memory and is gone as soon as you reload or close the page.

If you apply through the form on the careers page, we process:

• name and email address (required)
• phone number, links and your message, where you provide them
• the documents you upload
• the role you are applying for, together with its role number

The purpose is to run the application process. The legal basis is section 26(1) sentence 1 BDSG in conjunction with Art. 88 GDPR: the processing is necessary for deciding whether to enter into an employment relationship. Where your documents contain details going beyond that — a photograph or a date of birth, say — we rely on your consent under Art. 6(1)(a) GDPR. You give it when you submit and can withdraw it at any time with future effect.

Your documents are not sent around as email attachments. They sit in a protected storage area only we can reach; the notification to us contains nothing but the storage location. The storage is operated by: Hetzner Online GmbH, in data centres within the EU

A confirmation of receipt with your name, the position and the number of files you sent goes to your address.

We delete your application no later than six months after the process ends. The period follows the two-month limitation period in section 15(4) AGG plus an allowance for service and the duration of any proceedings. If the application leads to employment, the documents go into the personnel file instead.

If you want to be deleted sooner, a message to us is enough. We will not add you to a talent pool — nothing is kept for later without asking you.

The site uses the typefaces Geist Sans and Geist Mono. They are downloaded once when the application is built and served from our own server afterwards. Loading the page therefore sends no request to Google and transmits no IP address there.

The contact form and the booking form each contain a safeguard that recognises automated requests. If it recognises one, we discard the request. No personal data is collected for this and no third-party service is involved. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is preventing abuse.

Apart from us, your data reaches only:

Hosting

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, with data centres in Germany and Finland, i.e. within the EU

Email delivery

Brevo SAS, 106 boulevard Haussmann, 75008 Paris, France, with data centres in the EU. Messages arrive in our mailbox at Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, Netherlands, also with data centres in the EU

Appointment booking

Cal.com, Inc., USA

AI help Kio

OpenAI Ireland Ltd., Ireland; sub-processors including in the USA

Data processing agreements under Art. 28 GDPR are in place with all processors. A transfer to the United States takes place for appointment booking and may take place for questions to Kio. For appointment booking it is to be safeguarded by the standard contractual clauses under Art. 46 (2) (c) GDPR or, where the provider is certified under it, by the adequacy decision on the EU-US Data Privacy Framework. For Kio it relies on the standard contractual clauses (section 9).

We do not sell data, do not pass it on for advertising purposes and disclose it to authorities only where we are legally obliged to.

This website carries out no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

Where a business processes data of its guests, customers or staff in the Veydex Hub, that business is the controller. Veydex then acts as a processor under Art. 28 GDPR on the basis of a separate agreement.

Data subjects should therefore address requests for access, rectification and erasure to the business where they are a guest or customer. We forward such requests and support the business in answering them.

We adapt this policy when the processing changes or the law requires it. The version published on this page at the time applies.