Privacy Policy

To process and respond to your enquiries and fulfil our business obligations, we may collect the following personal data:

• Identity Information: Name, surname, and company name.
• Contact Information: Email address, phone number, and — where relevant — postal address.
• Communication Details: The content of messages you send us via the contact form or email.
• Business Information: Company details, industry sector, and transaction or enquiry history, where applicable to the services requested.
• Technical Data: IP address, browser type, operating system, and page visit logs collected automatically by our hosting infrastructure for security purposes.

We collect only what is necessary for the purpose stated and do not request sensitive personal data (Art. 9 GDPR) unless strictly required.

We prioritise the security of your information. All data is handled with the following safeguards in place:

• Encryption: Data in transit is protected via TLS/HTTPS. Where data is stored electronically, appropriate encryption is applied at rest.
• Infrastructure: This website is hosted on Vercel Inc. (San Francisco, USA), which acts as our data processor under a Data Processing Agreement. Vercel maintains EU Standard Contractual Clauses (SCCs) as a transfer safeguard under Art. 46(2)(c) GDPR.
• Access Controls: Access to personal data is restricted to authorised personnel only, on a strictly need-to-know basis.

Your trust is our most valuable asset. Our policy is straightforward:

• No Sale of Data: We do not sell, rent, or trade your personal information to third-party marketing companies or any other external entity for their commercial gain.
• Essential Service Providers: We share data only with third parties strictly necessary to operate our services (e.g. our hosting provider). These partners are contractually prohibited from using your data for any other purpose.
• Legal Obligations: We may disclose information if required by law or to comply with a legal process, including requests from German tax authorities (Finanzamt), courts, or law enforcement agencies.

We do not embed third-party analytics tools, advertising networks, or social media tracking scripts on this website.

We process your personal data on the following legal grounds under Art. 6 GDPR:

• Performance of a Contract (Art. 6(1)(b) GDPR): Processing is necessary to fulfil a contract with you or to take pre-contractual steps at your request.
• Legal Obligation (Art. 6(1)(c) GDPR): To comply with statutory requirements including tax, accounting, and commercial law obligations (§ 257 HGB, § 147 AO).
• Legitimate Interests (Art. 6(1)(f) GDPR): To ensure the security and proper functioning of our website and to respond to enquiries addressed to us.

Under the GDPR, you have the following rights with respect to your personal data:

• The right to know whether your personal data is being processed (Art. 15 GDPR).
• The right to request information about how your data has been processed.
• The right to know the purpose of processing and whether data is used accordingly.
• The right to rectification of incomplete or inaccurate data (Art. 16 GDPR).
• The right to erasure of your data, subject to statutory retention periods (Art. 17 GDPR).
• The right to restriction of processing in certain circumstances (Art. 18 GDPR).
• The right to data portability where processing is automated (Art. 20 GDPR).
• The right to object to processing based on legitimate interests (Art. 21 GDPR).

You also have the right to lodge a complaint with the competent supervisory authority. For our registered location in North Rhine-Westphalia, this is:

Landesbeauftragte für Datenschutz und Informationsfreiheit NRW (LDI NRW)
Kavalleriestraße 2–4, 40213 Düsseldorf
ldi.nrw.de

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us at:

VonderWerk GmbH
Ruhrorter Straße 69
47059 Duisburg, Germany

Phone: +49 152 096 833 45
Email: info@vonderwerk.com

We will respond to all data subject requests within one month of receipt, in accordance with Art. 12(3) GDPR.