Privacy policy

Where we process personal data on the basis of your consent, this is done under Art. 6(1)(a) GDPR. You may withdraw consent already given at any time with effect for the future. Withdrawal may be made informally, for example by e-mail or letter. Alternatively you may use our provided withdrawal form. Withdrawal does not affect the lawfulness of processing carried out until that time.

Responsible handling of personal data is important to us. All data processed in connection with the use of our website are treated confidentially and in accordance with the applicable data-protection rules.

When you access and use our website, different information that may relate to you can be processed. Personal data are information by which a person can be identified directly or indirectly. Which data are concerned, why they are processed and on which legal basis is described in the individual sections of this privacy statement.

To protect your data we use appropriate technical and organisational security measures. These measures serve in particular to protect personal data against unauthorised access, loss, alteration or other unlawful processing. Despite these precautions, data transmission over the internet cannot be completely free of risk. In particular, communication by e-mail cannot in all circumstances exclude access by third parties.

Within the statutory framework you have various rights in relation to the processing of your personal data. You may as a rule exercise these rights at any time vis-à-vis the controller.

We currently do not use analytics or tracking services that are not technically required.

When you use our website, certain information about how visitors use individual pages and content may be recorded. Such evaluation can take place in statistical form and help us better adapt the website and its content to users’ needs.

So-called analytics programmes or services of external providers may be used for this purpose. Such services are not currently active. If we use analytics or tracking services in future, this privacy statement will name the specific provider, the purposes, the data processed and any cookies or similar storage technologies.

Our website is operated with Contabo GmbH as an external hosting provider.

Contabo GmbH Aschauer Straße 32a 81549 München Germany

In the course of hosting, personal data arising from use of our website may be processed and stored on the provider’s servers. This may include in particular IP addresses as well as contact, communication, contract and technical access data.

Processing serves the secure, reliable and technically correct provision of our website as well as handling enquiries and carrying out related operations.

Where Contabo processes personal data on our behalf, processing is based on an agreement on commissioned processing under Art. 28 GDPR. Processing takes place only within the agreed services and according to our documented instructions.

We have concluded the necessary data-protection agreements with the hosting provider insofar as this is required for the respective processing.

We as a rule keep personal data only as long as required for the respective processing purpose. If the purpose for which the data were collected ceases, they are erased unless statutory retention duties or another legal basis require further storage.

If you request erasure of your personal data or withdraw consent, we examine whether the conditions for erasure are met. Unless there is a statutory duty of further retention and no other legal basis for storage, the data concerned are erased.

If further retention is required by statute or another legally permissible reason, erasure takes place after expiry of the respective retention period or as soon as the reason for further storage ceases.

After actual receipt by Allprova Technologies, the withdrawal declaration can or shall be documented in accordance with the data-protection, retention and erasure concept.

A distinction is made between two operations: A. Implementing the withdrawal: processing based solely on the withdrawn consent is stopped for the future insofar as no other legal basis exists. B. Documenting the withdrawal: proof of when and how the withdrawal was declared may be stored for the required period insofar as a lawful basis exists.

The proof required for documentation must therefore not be erased automatically at the same time as the technical implementation of the withdrawal.

Incoming forms may be stored to document and prove the withdrawal, to handle later queries and to protect, pursue or defend legal claims, insofar as a suitable legal basis exists and storage is necessary and proportionate. Storage must not be justified indefinitely solely by a generic reference to “evidentiary purposes”. Purpose, scope and duration of storage must be documented in a comprehensible way.

Unlimited storage is not permitted. The specific retention period will be determined before go-live on the basis of the actual business and legal requirements in Allprova Technologies’ retention and erasure concept.

We currently do not use analytics or tracking services that transfer personal data to the USA.

Services and applications of providers based in the USA may be used on our website. Depending on the service used, personal data may then be transferred to servers in the United States or other places outside the European Union and processed there.

Transfers of personal data to the USA are subject to particular data-protection requirements. For companies that participate in the EU-U.S. Data Privacy Framework, there is a recognised basis for transfer under the corresponding adequacy decision of the European Commission. For other providers, additional safeguards such as standard contractual clauses may be required.

Despite existing safeguards, it cannot be completely excluded that US authorities may access certain data within their statutory powers. This may in particular concern law enforcement or national security.

If such services are used in future, we have no influence on the specific processing by the respective external providers. This privacy statement would then be supplemented with the specific providers.

To carry out our business activities we sometimes rely on support from external companies and other bodies. Depending on the service, it may be necessary to transmit certain personal data to these recipients or to enable them to process such data.

Transmission does not take place without a corresponding legal basis. Personal data are in particular disclosed where this is necessary for performance of an existing contract or for pre-contractual measures, where transmission is permitted on the basis of a legitimate interest under Art. 6(1)(f) GDPR, where there is a statutory duty of disclosure, or where another data-protection provision permits the processing or disclosure.

If we engage an external service provider to process personal data on our behalf, the cooperation is governed by an agreement on commissioned processing under Art. 28 GDPR. The respective provider processes the data entrusted to it only for the agreed purposes and within the defined mandate.

Where we process personal data jointly with another controller and jointly determine the purposes and means of processing, the resulting responsibilities are governed by a corresponding agreement under Art. 26 GDPR.

Depending on the type of process, personal data may be processed and stored in different systems and with different service providers. This may in particular concern hosting of our website, handling of contact enquiries and the creation and administration of offers, orders and contracts. Processing takes place only to the extent required and on the basis of the applicable data-protection rules.

If you send us a message via the contact form, write to us by e-mail or contact us by telephone, we process the information you transmit or that is collected in the course of contact insofar as this is necessary to handle your matter and, where applicable, for follow-up questions. This may in particular include your name, your contact details and the content of your enquiry.

Which legal basis applies depends on the content and purpose of your enquiry. If your contact relates to the initiation or performance of a contract, processing is based on Art. 6(1)(b) GDPR. In other cases processing may be based on our legitimate interest in properly handling enquiries under Art. 6(1)(f) GDPR. Where we expressly ask for consent, processing is based on Art. 6(1)(a) GDPR.

You may withdraw consent given at any time with effect for the future. The lawfulness of processing until the time of withdrawal remains unaffected.

Data transmitted via the contact form are stored only as long as required to handle your enquiry and, where applicable, subsequent questions. They are then erased unless statutory retention duties exist or another legal basis permits or requires further storage.

Your information is disclosed to other bodies only if there is a corresponding data-protection basis. This may for example be the case if disclosure is necessary to handle your matter or another legal basis under Art. 6 GDPR permits the transmission.

If you contact us by e-mail or telephone, we process the information transmitted or collected by us insofar as this is necessary to handle your matter. This may in particular include your contact details and the content of your enquiry.

The legal basis here also depends on the specific reason for contact. Depending on the case, processing may be based on Art. 6(1)(b) GDPR, Art. 6(1)(f) GDPR or — where consent has been obtained — Art. 6(1)(a) GDPR.

Data arising from contact are erased as soon as the respective purpose of processing ceases and no statutory retention duties or other legal reasons prevent erasure.

To protect data transmission on our website we use SSL or TLS encryption. Confidential data that you transmit to us, for example via a contact form or in the course of an order, are thereby transmitted in encrypted form.

You can recognise an encrypted connection by “https://” in the browser bar and by the padlock symbol. Encryption protects the transmitted data during transmission against unauthorised access by third parties.

When you access our website, the server automatically records certain technical information in so-called server log files. This includes in particular the browser used and its version, the operating system, the previously visited page (referrer URL), the host name of the accessing device, date and time of access and the IP address.

Logging serves primarily to ensure secure and trouble-free operation of our website, to detect technical errors and to review the stability and security of our systems. Data stored in the server log files are as a rule not combined with other personal data.

Processing is based on Art. 6(1)(f) GDPR where the necessary conditions are met. Our legitimate interest lies in particular in the technically reliable provision, securing and optimisation of our website.

Access logs for this website are as a rule automatically rotated and deleted in the Allprova infrastructure after no more than 30 days, unless a specific security incident requires longer retention. Logging of other projects on the same server is not affected.

For the operation and provision of our website we use various technical systems and applications. Where these systems process or store personal data, this takes place only within the applicable data-protection rules.

Our website is hosted in a server environment we operate. Technical operation uses, among other things, server, database and application software. This includes in particular Contabo as hosting provider, PostgreSQL as database system and the technical components used to run our web application.

In the course of using our website, personal data may in particular be processed and stored in the following areas:

1. Server and access logs: technical access data such as IP address, date and time of access, pages or URLs requested, browser information and other technical details;
2. User accounts and client accounts: data required for registration, sign-in, authentication and use of the personal account area;
3. Contact, request and project forms: information you yourself transmit when contacting us or making a project or offer request;
4. Client projects and project administration: information arising in connection with handling and administering client projects;
5. Reviews: information you transmit via a review or feedback form;
6. File uploads: files and related information insofar as this function is offered on the website and used by you;
7. Cookies and similar storage technologies: in particular technically required session cookies and, where applicable, local storage or session storage insofar as these are needed for website functions, sign-in, sessions or technical provision.

Processing may among other things include the collection, transmission, storage and administration of personal data within our own application and server infrastructure.

Where external providers are involved in processing personal data, they are described in the relevant sections of this privacy statement. Transmission to external bodies takes place only if there is a corresponding data-protection basis.

Not every piece of software used for technical development and operation constitutes a standalone service vis-à-vis visitors to our website. Development and runtime components such as React, Next.js, Node.js, TypeScript, Docker and Docker Compose are therefore not treated as standalone third-party services, provided their use does not transmit personal data to external providers.

Our website uses cookies. These are small data sets stored in the browser on your device and that can be read again on a later visit. They support in particular the technical provision and use of certain functions of our website.

We distinguish in particular between the following types of cookie:

1. Session cookies: these cookies are stored only for the duration of your visit. They support, for example, maintaining a session and are as a rule deleted as soon as you close your browser.
2. Technically necessary cookies: these cookies are required so that certain website functions can be provided and used properly. They may include, for example, cookies for sign-in, authentication or technical session management. They are stored only as long as required for the respective function.
3. Persistent cookies: such cookies remain on the device for a defined period after the visit ends. They may, for example, retain certain settings or states for a later visit. Where we use such cookies, the storage period is limited to what is required for the respective purpose.

We use in particular session cookies and technically required cookies. Session cookies are needed only for the duration of your visit and are as a rule deleted when you close the browser. Technically required cookies may, for example, enable sign-in, authentication or certain website functions. They are used only as long as required for the respective function.

For technically required cookies that are strictly necessary for a digital service expressly requested by the user, consent is as a rule not required under section 25(2) no. 2 TDDDG. For other cookies or access to information on the device, prior consent may be required.

You can manage cookie settings yourself through the functions of the browser you use. Depending on the browser you may, for example, be informed when cookies are set, allow cookies only in individual cases, refuse cookies in certain cases or generally, and specify that stored cookies are deleted automatically when the browser is closed.

Please note that disabling or restricting cookies may mean that certain functions of our website can be used only to a limited extent or not fully.

Where the use of cookies additionally processes personal data, the legal basis required for this depends on the respective processing purpose. The specific storage period depends on the function of the respective cookie and is limited to the required period.

We currently use the following storage technologies:

The newsletter function is not currently active. Registration via the website is not currently possible.

After a future activation you will be able to subscribe to our newsletter voluntarily. The newsletter would inform you about news, current developments, services, offers and other information from our company.

Registration requires your e-mail address. Where you voluntarily provide further details, these may be used to align newsletter content as closely as possible with your interests and needs.

After activation, processing of your personal data for sending the newsletter takes place only on the basis of your consent under Art. 6(1)(a) GDPR. Consent is voluntary and not a condition for using our website or concluding a contract.

You may withdraw consent given under Article 7(3) GDPR at any time with effect for the future. Withdrawal may be made informally, for example by e-mail or letter. Alternatively you may use our provided withdrawal form. The lawfulness of processing carried out on the basis of your consent until the time of withdrawal remains unaffected.

A corresponding bot-protection service is not currently active.

To protect our website and in particular our forms against automated access, spam and abusive requests, we may use a service to detect bots and automated access.

The service checks, on the basis of technical information and signals from the browser and device environment, whether access is likely from a natural person or from an automated system. This may in particular involve processing technical information about the browser used, the device and the type of access.

Processing serves solely to protect our website and to prevent abusive or automated input. Content you enter in a form is not processed by the bot-protection service for the service’s own purposes, insofar as this is technically provided by the respective provider.

Where consent is required to use the service, it is used only after the corresponding consent has been given. Where use is required to defend against spam, abuse and automated access for the security and proper operation of our website, processing is based on our legitimate interest under Art. 6(1)(f) GDPR, insofar as the statutory conditions are met.

If the service is activated later, this privacy statement will be supplemented with the specific provider used.