Privacy Policy

1.1. Contact Details

The data controller pursuant to Art. 4(7) of the EU General Data Protection Regulation (GDPR) is:

Vantum GmbH
Holbeinstraße 14
04229 Leipzig, Germany

Email: [email protected]

Legally represented by Eddie Esche.

1.2. Scope of Data Processing, Purposes, and Legal Bases

The scope, purposes, and legal bases of data processing are detailed further below. The following legal bases may apply:

• Art. 6(1)(a) GDPR — serves as the legal basis for processing operations for which we obtain consent.
• Art. 6(1)(b) GDPR — applies where the processing of personal data is necessary for the performance of a contract, e.g. when a visitor purchases a product or we provide a service. This also applies to processing necessary for pre-contractual measures.
• Art. 6(1)(c) GDPR — applies where we process personal data to fulfill a legal obligation, such as under tax law.
• Art. 6(1)(f) GDPR — serves as the legal basis where we rely on legitimate interests for the processing of personal data, e.g. for cookies required for the technical operation of our website.

1.3. Data Processing Outside the EEA

Where we transfer data to service providers or other third parties outside the EEA, the security of the data is guaranteed by EU Commission adequacy decisions pursuant to Art. 45(3) GDPR, where available. For data transfers to service providers in the USA, the legal basis is an adequacy decision of the EU Commission, provided the service provider is additionally certified under the EU-US Data Privacy Framework. In other cases, the legal basis for data transfer is standard contractual clauses adopted by the EU Commission, which ensure the security of the data transfer pursuant to Art. 46(2)(b) GDPR.

1.4. Storage Duration

Unless expressly stated otherwise in this privacy policy, the data stored by us will be deleted as soon as it is no longer required for its intended purpose and there are no statutory retention obligations to the contrary. If the data is not deleted because it is required for other legally permissible purposes, its processing will be restricted — i.e. the data will be blocked and not processed for other purposes.

1.5. Rights of Data Subjects

Data subjects have the following rights with regard to their personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification or erasure (Art. 16, 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to withdraw consent at any time

Data subjects also have the right to lodge a complaint with a data protection supervisory authority regarding the processing of their personal data. Contact details of data protection supervisory authorities in Germany are available at bfdi.bund.de.

1.6. Obligation to Provide Data

Customers, prospective customers, or third parties are only required to provide the personal data that is necessary for the establishment, execution, and termination of the business relationship, or that we are legally obligated to collect. Without this data, we will generally have to decline the conclusion of a contract or the provision of a service.

1.7. No Automated Individual Decision-Making

We do not use fully automated decision-making pursuant to Art. 22 GDPR for the establishment and execution of business relationships. Should we employ such procedures in individual cases, we will inform you separately where required by law.

1.8. Contact

When you contact us, e.g. by email, the data you provide (e.g. name and email address) will be stored by us to answer your inquiry. The legal basis for processing is our legitimate interest in responding to inquiries directed at us (Art. 6(1)(f) GDPR). We delete the data collected in this context once storage is no longer necessary, or restrict processing if statutory retention obligations apply.

2. Data Processing on Our Website

2.1. Note for Website Visitors from Germany

Our website stores information on the end device of website visitors (e.g. cookies) or accesses information already stored on the end device (e.g. IP addresses). Details are provided in the following sections. This storage and access occurs on the following legal bases:

• Where this storage or access is strictly necessary to provide the service expressly requested by the website visitor (e.g. to ensure IT security), it is based on § 25(2)(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG).
• Otherwise, this storage or access is based on the consent of the website visitor (§ 25(1) TDDDG).

Subsequent data processing is carried out in accordance with the following sections and on the basis of the provisions of the GDPR.

2.2. Informational Use of the Website

When using the website for informational purposes only — i.e. when visitors do not separately transmit information to us — we collect the personal data that the browser transmits to our server to ensure the stability and security of our website. This constitutes our legitimate interest, and the legal basis is Art. 6(1)(f) GDPR. This data includes:

• IP address
• Date and time of the request
• Time zone difference to Greenwich Mean Time (GMT)
• Content of the request (specific page)
• Access status / HTTP status code
• Amount of data transferred
• Referring website
• Browser type and version
• Operating system and its interface
• Language and version of the browser software

This data is also stored in log files. It is deleted when storage is no longer necessary, at the latest after 14 days.

2.3. Web Hosting and Website Delivery

We use Cloudflare as a content delivery network for our website. The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. The provider processes personal data transmitted via the website, e.g. content, usage, meta/communication data, or contact data, in the USA. Further information can be found in the provider's privacy policy at cloudflare.com/privacypolicy.

We have a legitimate interest in utilizing sufficient storage and delivery capacity to ensure optimal data throughput even during peak loads. The legal basis for the described data processing is therefore Art. 6(1)(f) GDPR. The transfer of personal data to a country outside the EEA is based on an adequacy decision. The security of the data transferred to the third country is ensured because the EU Commission has determined, by way of an adequacy decision pursuant to Art. 45(3) GDPR, that the third country provides an adequate level of protection.

2.4. Contact Form

When you contact us via the contact form on our website, we store the data requested there and the content of the message. The legal basis for processing is our legitimate interest in responding to inquiries directed at us (Art. 6(1)(f) GDPR). We delete the data collected in this context once storage is no longer necessary, or restrict processing if statutory retention obligations apply.

2.5. Technically Necessary Cookies

Our website uses cookies. Cookies are small text files stored in the web browser on a visitor's device. Cookies help make our offering more user-friendly, effective, and secure. Where these cookies are necessary for the operation of our website or its functions ("technically necessary cookies"), the legal basis for the associated data processing is Art. 6(1)(f) GDPR. We have a legitimate interest in providing customers and other visitors with a functional website.

2.6. Third-Party Services

2.6.1. Google Search Console

We use Google Search Console for SEO optimization and analysis. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes usage data (e.g. visited web pages, interest in content, access times) and meta/communication data (e.g. device information, IP addresses) in the USA. The legal basis for processing is Art. 6(1)(f) GDPR. We have a legitimate interest in optimizing our search engine performance. The transfer of personal data to a country outside the EEA is based on an adequacy decision. The security of the data transferred to the third country is ensured because the EU Commission has determined, by way of an adequacy decision pursuant to Art. 45(3) GDPR, that the third country provides an adequate level of protection. Data is deleted when the purpose of its collection no longer applies and no retention obligation exists. Further information can be found in the provider's privacy policy at business.safety.google/privacy.

3. Changes to This Privacy Policy

We reserve the right to amend this privacy policy with effect for the future. A current version is always available on this page.

4. Questions and Comments

For questions or comments regarding this privacy policy, please contact us using the details provided above.