Privacy Policy

Controller

Deepvac GmbH

Represented by the Managing Director John Robertus

An der Universität 1 (Building 8141)

30823 Garbsen

Germany

Email: info@deepvac.space

Phone: +49 157 830 270 99

Registered office: Garbsen, Germany

General Information on Data Processing

We process personal data only to the extent necessary to provide a functional website, respond to inquiries, present our services, and operate our business communication in a secure and efficient manner.

Processing is carried out in accordance with the General Data Protection Regulation (GDPR) and applicable German data protection laws.

Personal data is not transferred to third parties unless this is necessary for the technical operation of the website, for the performance of a contract or pre-contractual measures, for compliance with a legal obligation, on the basis of your consent, or otherwise permitted by law.

Legal Bases for Processing

Where we process personal data, we rely in particular on the following legal bases:

• Art. 6(1)(a) GDPR: consent
• Art. 6(1)(b) GDPR: performance of a contract or pre-contractual measures
• Art. 6(1)(c) GDPR: compliance with a legal obligation
• Art. 6(1)(f) GDPR: legitimate interests

Where processing is based on Art. 6(1)(f) GDPR, our legitimate interests lie in the secure, stable, efficient, and user-oriented operation of our website, the professional presentation of our company, and our business communication.

Website Access Data and Server Log Files

When you access our website, information is automatically collected by our hosting provider in so-called server log files. This may include:

• IP address
• Date and time of access
• Requested content
• Access status and HTTP status code
• Amount of data transferred
• Referrer URL
• Browser type and version
• Operating system

This data is processed to ensure the stability, security, and technical functionality of the website and to detect, prevent, and investigate misuse or security-related incidents.

Legal basis: Art. 6(1)(f) GDPR.

Server log data is generally stored for a maximum of 7 days unless longer retention is required for the investigation of security-related incidents or to assert, exercise, or defend legal claims.

Contact by Email or Contact Form

If you contact us by email or submit an inquiry via our contact form, we process the personal data you provide for the purpose of handling your inquiry and communicating with you.

This may include in particular:

• first name
• last name
• business email address
• company name
• phone number, where voluntarily provided
• project or application information
• message content

Mandatory fields in the contact form are marked accordingly. These data are required in order to process your request.

Legal basis:

• Art. 6(1)(b) GDPR, if your inquiry relates to pre-contractual measures or the performance of a contract
• Art. 6(1)(f) GDPR, for general business communication and other inquiries

Your data will not be shared with third parties unless this is necessary to process your request, required by law, or otherwise legally permitted.

For the technical receipt and processing of form inquiries we use the Supabase platform (Supabase Inc., USA) as a processor pursuant to Art. 28 GDPR. The database used for this purpose is hosted in the EU (data centre region Ireland). Where personal data is transferred to third countries in this context, the transfer is based on the EU Standard Contractual Clauses.

To send the e-mails generated when you submit one of our forms (forwarding your inquiry to our team and an automatic confirmation of receipt to you), we use the service Resend, provided by Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA, as a processor pursuant to Art. 28 GDPR. Your form data, in particular name, e-mail address, company and message, is transmitted to Resend and processed in the USA. Resend is certified under the EU-U.S. Data Privacy Framework; the data processing agreement additionally includes the EU Standard Contractual Clauses. The legal basis is Art. 6(1)(b) GDPR (processing your inquiry) and Art. 6(1)(f) GDPR (reliable delivery).

We store your inquiry only for as long as necessary to process it. Where statutory retention obligations apply, storage may continue for the duration required by applicable law.

Abuse protection and logging

To protect our forms against spam and abuse, we store the IP address, the browser identifier (user agent), the e-mail address provided, the time, the form source, the result of the check and a checksum of the content in a log in our database (Supabase) when a form is submitted.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the security of our forms and the prevention of abuse.

Log entries are deleted automatically after 30 days.

Provision of Personal Data

The provision of personal data is neither legally nor contractually required. However, certain information may be necessary for us to process and respond to your inquiry. If you do not provide the relevant data, we may be unable to handle your request.

Hosting

This website is hosted by:

Hetzner Online GmbH processes personal data on our behalf on the basis of a data processing agreement pursuant to Art. 28 GDPR. Data processing takes place on servers located in Nuremberg, Germany.

Cookies and Similar Technologies

This website uses technically necessary cookies and similar storage technologies (such as localStorage) required for the secure and proper operation of the website.

No marketing, profiling or advertising tracking technologies are used. For anonymous audience measurement we use Plausible Analytics, which works without cookies and without storing anything on your device (see the section “Audience measurement with Plausible Analytics”).

Where optional external content is available, your preference may be stored locally on your device using browser storage. This is not used for tracking purposes.

You can view and change your choices at any time through the Privacy Settings link in the footer of this website.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and efficient provision of our website.

Audience measurement with Plausible Analytics

We use the web analytics service Plausible Analytics, provided by Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia, to understand how our website is used, for example which pages are viewed, which websites visitors come from, which device types and countries occur and how often contact, booking and download buttons are used.

Plausible does not set cookies and does not store any information on your device. Your IP address and browser identifier are not stored; they are only used briefly, together with a random value that changes daily, to create an anonymous identifier for counting visits. The random value is deleted after 24 hours. We cannot identify you personally. The data is processed on servers in Germany.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the statistical analysis and improvement of our website. Plausible processes the data as a processor pursuant to Art. 28 GDPR. You may object to this processing at any time (Art. 21 GDPR).

More information: https://plausible.io/data-policy

Google Maps

This website offers the option to display an interactive map provided by Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google Maps is loaded only after you have given explicit consent.

When Google Maps is activated, your IP address and technical connection data may be transmitted to Google servers, which may be located outside the European Economic Area.

Your consent preference is stored locally on your device using browser storage (localStorage). No data is transmitted to Google until you opt in.

You can withdraw your consent at any time through the Privacy Settings link in the footer or directly on the contact page.

Legal basis: Art. 6(1)(a) GDPR (consent).

For more information, see the Google Privacy Policy at https://policies.google.com/privacy.

Cloudflare Turnstile

This website uses Cloudflare Turnstile (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA) to protect contact forms from automated abuse and bot submissions.

As soon as you interact with one of our forms, for example by clicking into an input field, Cloudflare Turnstile is loaded. Cloudflare may then process technical data such as your IP address, browser type and interaction behavior to determine whether the submission comes from a human user. No connection to Cloudflare is made before this interaction.

Cloudflare processes this data as a processor on the basis of our instructions. The data is used exclusively for abuse prevention and is not used for tracking, profiling, or advertising purposes.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting our contact forms from spam and automated abuse. Turnstile is used as a strictly necessary security measure within the meaning of Section 25(2) No. 2 TDDDG.

For more information, see the Cloudflare Privacy Policy at https://www.cloudflare.com/privacypolicy/.

Appointment Scheduling via Calendly

For online appointment scheduling we integrate the Calendly service provided by Calendly LLC, 271 17th St NW, Atlanta, Georgia 30363, USA. The booking calendar is only loaded after you have expressly consented in the booking dialog. No data is transferred to Calendly before you give consent.

Once the calendar is loaded, your IP address and technical connection data are transferred to Calendly. If you book an appointment, Calendly additionally processes the details you enter (e.g. name, email address, selected time slot, optional message). Processing also takes place on servers in the USA; the transfer is based on appropriate safeguards pursuant to Art. 44 et seq. GDPR (EU Standard Contractual Clauses or certification under the EU-U.S. Data Privacy Framework).

You may withdraw your consent at any time with effect for the future – directly in the booking dialog via “Withdraw consent” or by clearing this website's local browser data.

Legal basis: Art. 6(1)(a) GDPR (consent); for carrying out a booked appointment, Art. 6(1)(b) GDPR.

Further information is available in Calendly's privacy policy: https://calendly.com/privacy

Data Retention

Personal data is stored only for as long as necessary for the respective processing purpose or as required by statutory retention periods under German law.

Business correspondence may be retained in accordance with applicable commercial and tax retention obligations.

Data Security

We implement appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access.

Data transmission between your browser and our website is encrypted using SSL or TLS technology.

Your Rights

You have the following rights under the GDPR:

• Right of access pursuant to Art. 15 GDPR
• Right to rectification pursuant to Art. 16 GDPR
• Right to erasure pursuant to Art. 17 GDPR
• Right to restriction of processing pursuant to Art. 18 GDPR
• Right to data portability pursuant to Art. 20 GDPR
• Right to object pursuant to Art. 21 GDPR
• Right to withdraw consent at any time pursuant to Art. 7(3) GDPR

Where personal data is processed on the basis of Art. 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation.

Supervisory Authority

If you believe that the processing of your personal data violates applicable data protection law, you have the right to lodge a complaint with a supervisory authority.

The competent supervisory authority for Deepvac GmbH is:

No Automated Decision-Making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR in connection with this website.

Changes to this Privacy Policy

We reserve the right to update this Privacy Policy in order to reflect changes in legal requirements or changes to our website or our services. The version published on our website shall apply.