Information on the Processing of Personal Data

When the public website is accessed, technically necessary data is processed. This includes, in particular, the IP address, date and time of access, requested resource, user agent, and other technical headers required for operation and security.

This data is processed to deliver the website, detect misuse, resolve disruptions, and ensure technical security. The legal basis is Article 6(1)(f) GDPR.

The public website is hosted on servers within the European Union. According to the information you provided, hosting is supplied by Hostinger using an EU data center.

As specified by you, no marketing cookies, tracking technologies, or public analytics services are used on the public website.

Cloudflare is used solely for functional purposes, particularly as a Content Delivery Network (CDN), for TLS, as a Web Application Firewall, and for DDoS protection. In this context, Cloudflare processes technically necessary connection and security data, such as the IP address, requested URL, timestamp, user agent, and other headers, to the extent required for delivery, protection, and stability.

The legal basis is Article 6(1)(f) GDPR. The legitimate interest lies in the secure, stable, and high-performance operation of the website.

As specified by you, no additional Cloudflare analytics functions such as Browser Insights, Real User Monitoring, or Web Analytics are used on the public website.

The customer portal is used to provide proposals, contracts, invoices, and support-related information. In connection with registration and login, the following data in particular may be processed: name, email address, company information, VAT ID, role and permission information, hashed passwords, and security-related login information.

Only technically necessary session cookies or tokens are used for the portal. The protected area cannot be used without them.

Two-factor authentication may optionally be used if it is enabled in the portal.

The master data and authentication data required to use the portal are necessary to provide this service. The portal cannot be used without this data.

When you contact VELUNO—for example, by form, email, or telephone—the data you provide is processed to handle your inquiry and any follow-up questions.

This applies in particular to contact details, the content of your message, and any additional information you voluntarily provide. The legal basis is Article 6(1)(b) GDPR where contact relates to steps prior to entering into a contract or performance of a contract; otherwise, Article 6(1)(f) GDPR applies.

Invoices are created and processed by VELUNO LLC. Only the data required for contract performance, billing, and statutory retention is processed, particularly name, address, company information, where applicable VAT identification number and service and invoice details.

According to the information you provided, invoice data is stored in the United States and retained in accordance with legal obligations. It may also be disclosed to authorities where there is a legal obligation to do so or where international mutual legal assistance provisions require it.

• IONOS Inc.: hosting of the public website and technical infrastructure

• Cloudflare, Inc.: reverse proxy, Content Delivery Network (CDN), TLS encryption, Web Application Firewall (WAF), and DDoS protection

• Google Ireland Limited (Google Analytics): processing of usage data for audience measurement based on the user's consent. A transfer of data to Google LLC in the United States cannot be ruled out.

• Other recipients only where required for contract performance, compliance with legal obligations, or technical provision.

Where Cloudflare or invoice processing is involved, personal data may also be processed outside the European Union or European Economic Area, particularly in the United States.

Where personal data is transferred to a third country, such transfers take place only in compliance with data-protection requirements, particularly on the basis of an adequacy decision or other appropriate safeguards.

Under your configuration, Cloudflare is integrated solely for functional purposes. For any transfers of data to Cloudflare in the United States, certification under the EU-U.S. Data Privacy Framework is relevant according to the current status.

Personal data is stored only for as long as required for the respective purpose. Relevant factors include technical necessities, the contractual relationship, security purposes, and statutory retention obligations.

Log data is stored only for the period required for secure operation, error analysis, and detection of misuse. Contract and invoice data is stored in accordance with the applicable statutory retention periods.

Subject to the statutory requirements, you have the following rights in particular:

• Access to the personal data being processed

• Correction of inaccurate data

• Deletion of personal data

• Restriction of processing

• Data portability

• Objection to processing based on legitimate interests

• Withdrawal of consent with effect for the future

• Lodging a complaint with a competent supervisory authority

To exercise your rights, you may contact us using the contact details stated above.