In this privacy policy we inform you, in accordance with Art. 13 and 14 GDPR, which personal data we process on vellinger-systems.com, for what purpose and on what legal basis, to whom we pass it on, how long we keep it and what rights you have. This is a translation; the German version is legally binding.
The controller within the meaning of the GDPR is: Colin Velten Vahrenhorst Vellinger Akazienweg 27 33790 Halle (Westfalen) Germany Phone: +49 15679 659891 Email: kontakt@vellinger-systems.com We have not appointed a data protection officer because we are not legally required to do so. Please send any data protection questions to the address above.
This website sets no cookies and loads no advertising or tracking scripts from Google or other ad networks. We only process personal data where there is a legal basis. These are in particular Art. 6 (1) (b) GDPR (contract and pre-contractual steps, such as booking a call), Art. 6 (1) (c) GDPR (legal obligations, such as keeping invoices) and Art. 6 (1) (f) GDPR (legitimate interests). We state the legal basis for each processing activity below. You are not legally required to provide your data. Without your name and email address, however, we cannot book a call for you or answer your message. There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.
This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Whenever a page is requested, Vercel processes connection data that is technically required: IP address, date and time, requested address, referrer, browser and operating system. This data is needed to deliver the page, fend off attacks and find errors. Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is the secure and reliable operation of the website. Retention: to our knowledge, Vercel keeps these logs for no more than 30 days. We have concluded a data processing agreement with Vercel pursuant to Art. 28 GDPR. For transfers to the USA, see "Transfers to third countries".
We do not set cookies. For 3 convenience functions we store small entries in your browser's storage (localStorage or sessionStorage). These entries never leave your device and contain no information about you: • whether the intro animation has already been shown in the last 24 hours, so it does not appear on every visit (localStorage, 24 hours); • whether a statistics event has already been counted in this session, so it is not counted twice (sessionStorage, until you close the tab); • your optional answer to how you heard about us, so you do not have to enter it twice when booking (sessionStorage, until you close the tab). The legal basis is § 25 (2) no. 2 TDDDG, because this storage is strictly necessary for the function you requested, and Art. 6 (1) (f) GDPR for the subsequent processing. You can delete these entries at any time in your browser settings.
For visitor statistics we use Plausible Analytics, provided by Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia. Plausible sets no cookies, builds no user profiles and does not store IP addresses. It counts page views, referring page, device type, browser, country and individual events on our site, such as whether a call was booked. No individual person can be identified from this. The script is loaded from servers in the EU and the data is processed in the EU. Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is understanding which content is used and improving the website. We have concluded a data processing agreement with Plausible.
You book calls directly on our website. Your browser only talks to our server; our server asks Cal.com for free slots and creates your booking there. Cal.com is operated by Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA. We process: name, email address, company, website address, phone number (if provided or needed for a phone call), chosen topic, type of call (video or phone), date, time and time zone, language and, optionally, how you heard about us. Cal.com stores the booking, creates the video call link (see "Video calls") and lets you reschedule or cancel. Legal basis: Art. 6 (1) (b) GDPR (pre-contractual steps at your request). Retention: we keep the booking at Cal.com until the call has taken place and no follow-up questions are to be expected, at the latest 12 months after the call, unless it leads to a contract. If a contract is concluded, the statutory retention periods apply (up to 6 or 10 years under § 257 HGB and § 147 AO). We have concluded a data processing agreement with Cal.com. More information: https://cal.com/privacy.
We hold video calls via Google Meet, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you book, Cal.com creates the call link in our Google Calendar. You do not need a Google account, a current browser is enough. Processed are: name and email address from the booking, picture and sound during the call if you turn on your camera or microphone, and technical connection data (for example IP address, device and browser). We do not record calls via Google Meet. Legal basis: Art. 6 (1) (b) GDPR (pre-contractual steps at your request). Google may also process data in the USA. Google is certified under the EU-US Data Privacy Framework, and standard contractual clauses are in place. More information: https://policies.google.com/privacy.
So that confirmations are not sent twice and reminders arrive at the right time, we store a short record for each booking (booking number, name, email address, company, date and time, topic and the identifiers of scheduled emails). For this we use the Redis database and the QStash scheduling service of Upstash, Inc., USA (https://upstash.com). Legal basis: Art. 6 (1) (b) GDPR. Retention: the record is deleted automatically after 90 days. Scheduled emails are deleted as soon as they have been sent or cancelled. We have concluded a data processing agreement with Upstash.
We send confirmations, preparation emails (24 hours before the call), reminders (1 hour before the call) and replies to messages via Resend, provided by Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. Your email address, your name and the content of the email are transmitted to Resend. Legal basis: Art. 6 (1) (b) GDPR. To our knowledge, Resend keeps delivery logs for no more than 30 days. We have concluded a data processing agreement with Resend.
If you contact us via the message form, by email or by phone, we process your details (name, email address, phone number if provided, topic and message) to answer your enquiry. After you send the form, you receive a confirmation by email. Via the "Price by email" form on the "Websites" page we process the address of your website and your email address to send you a fixed price by email. Here, too, you receive a confirmation. As with all emails from this website, they are sent via Resend (see above). The "Intro call" page also contains a link to WhatsApp. Only if you click this link and write to us does WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland, process your phone number and message under its own terms (https://www.whatsapp.com/legal/privacy-policy-eea). Nothing from WhatsApp is loaded on our website for this. Legal basis: Art. 6 (1) (b) GDPR if your enquiry aims at a contract, otherwise Art. 6 (1) (f) GDPR (legitimate interest in answering enquiries). Retention: we delete your enquiry once it has been dealt with and no follow-up questions are to be expected, at the latest after 12 months, unless statutory retention obligations apply.
To fend off automated mass requests, our server briefly counts how often bookings or messages are sent from the same IP address or email address. This count is held only in the server's memory, is disregarded after one hour at the latest and is deleted when the server restarts. Legal basis: Art. 6 (1) (f) GDPR; our legitimate interest is protection against abuse.
We run ads on Google Ads and want to know whether they lead to booked calls. For this we load no Google scripts and set no cookies. If you reach us through one of our ads, Google adds a random click identifier (GCLID) to the address. This identifier stays only in your browser's address bar and is passed along as you move between our pages. If you book a call, your browser sends the identifier to our server together with the booking. Only after Cal.com has confirmed the booking does our server report to Google: the click identifier, the time of booking, a fixed value of 100 euros and the booking number (so Google can recognise duplicate reports). If there is no click identifier, we report a SHA-256 hash of your email address instead. Your email address itself is not sent to Google. Google can only match the hash to a person who has a Google account with the same address. We do not store the click identifier, neither in databases nor in emails nor at Cal.com. Recipient: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; processing by Google LLC in the USA is possible. Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is measuring the success of our advertising spend. You can object to this processing at any time by email to kontakt@vellinger-systems.com. We will then not report any booking of yours to Google. More information: https://policies.google.com/privacy.
Our server retrieves the uptime figures for the websites we look after from UptimeRobot. No data about you is transmitted in the process.
We serve the Montserrat typeface from our own server. Loading the page does not connect to Google Fonts or any other font provider.
If a contract is concluded, we process the information we need to perform it: contact details, billing details, content for your website and access details you give us. The legal basis is Art. 6 (1) (b) GDPR, and for invoices and business letters also Art. 6 (1) (c) GDPR in conjunction with § 257 HGB and § 147 AO (retention of 6 or 10 years). Where we process data of your own customers on your behalf, for example via forms or mailboxes of your website, we conclude a data processing agreement with you.
Vercel, Cal.com, Resend, Upstash and, where applicable, Google also process data in the USA. For the USA there is an adequacy decision of the European Commission (EU-US Data Privacy Framework) of 10 July 2023. It applies to companies certified under this framework. Where a provider is not certified, we base the transfer on the EU Standard Contractual Clauses pursuant to Art. 46 (2) (c) GDPR agreed with that provider.
You have the right to: • access to your stored data (Art. 15 GDPR) • rectification of inaccurate data (Art. 16 GDPR) • erasure (Art. 17 GDPR) • restriction of processing (Art. 18 GDPR) • data portability (Art. 20 GDPR) • withdraw consent with effect for the future (Art. 7 (3) GDPR) • lodge a complaint with a supervisory authority (Art. 77 GDPR) The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Postfach 20 04 44, 40102 Düsseldorf, Germany, https://www.ldi.nrw.de. An informal message to kontakt@vellinger-systems.com is sufficient.
Where we process data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you may object at any time on grounds relating to your particular situation. We will then stop processing your data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. You may object to the measurement of our Google ads without giving reasons.
All connections to this website are encrypted with TLS (shown by "https" in the address bar). Access to our service providers is protected by two-factor sign-in wherever the provider offers it.
We update this privacy policy when our website or the legal situation changes. The version available here at the time of your visit applies.
For questions about data processing or to exercise your rights, contact us directly. We typically respond within one business day.
