Privacy Policy

1) Introduction and contact details of the controller

1.1 We are glad that you are visiting our website and thank you for your interest. Below we inform you about how your personal data is handled when you use our website. Personal data here means any data by which you can be personally identified.

1.2 The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Velion-Software, Riccardo Coppola, Wörsbachstraße 4a, 65510 Hünstetten, Germany, phone: +49 1551 0286647, email: info@velion-software.de. The controller for the processing of personal data is the natural or legal person who alone or jointly with others determines the purposes and means of processing personal data.

2) Data collected when visiting our website

2.1 When you use our website purely for information, that is when you do not register or otherwise transmit information to us, we only collect the data that your browser transmits to our server (so-called "server log files"). When you access our website we collect the following data, which is technically necessary for us to display the website to you:

The page of ours you visited
Date and time of access
Amount of data sent, in bytes
Source/referrer from which you reached the page
Browser used
Operating system used
IP address used (where applicable: in anonymised form)

Processing takes place pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not passed on or otherwise used. We do, however, reserve the right to review the server log files retrospectively should there be concrete evidence of unlawful use.

2.2 For security reasons and to protect the transmission of personal data and other confidential content (for example orders or enquiries directed to the controller), this website uses SSL or TLS encryption. You can recognise an encrypted connection by the string "https://" and the padlock symbol in your browser bar.

3) Hosting & content delivery network

3.1 Hosting

For hosting our website and displaying its content we use a provider that renders its services, itself or through selected subcontractors, exclusively on servers within the European Union.

With the exception of the static content described under section 3.2, all data collected on our website is processed on these servers.

We have concluded a data processing agreement with the provider that ensures the protection of our site visitors' data and prohibits unauthorised disclosure to third parties.

3.2 Content delivery network (Amazon Web Services)

We deliver static content of our website (for example images, fonts, stylesheets and scripts) via our subdomain cdn.velion-software.de. The technical service provider for this is Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg ("AWS"). The content is held in Amazon S3 storage in the Europe (Frankfurt) region and delivered through the Amazon CloudFront content delivery network.

When you open a page, your browser requests this content directly from the AWS servers. This technically necessarily transmits your IP address and further connection data (date and time of retrieval, requested file, volume of data transferred, browser and operating system identifier and, where applicable, the referring page) to AWS, where it is processed in server log files.

Embedding this content does not set cookies or otherwise access information on your device. Caching the retrieved files in your browser cache is strictly necessary for the display of the website that you have expressly requested within the meaning of § 25(2)(2) TDDDG, so no consent is required for it.

The legal basis for the processing is Art. 6(1)(f) GDPR on the basis of our legitimate interest in the secure, reliable and fast delivery of our website content and in reducing loading times.

Delivery takes place via edge locations distributed worldwide, so that requests from Europe are regularly answered by servers within the European Union.

We have concluded a data processing agreement with AWS (AWS GDPR Data Processing Addendum) that ensures the protection of our site visitors' data and prohibits unauthorised disclosure to third parties.

Access by Amazon Web Services, Inc., based in the USA, cannot be ruled out. For data transfers to the USA the provider has agreed to the standard contractual clauses adopted by the European Commission pursuant to Art. 46(2)(c) GDPR. In addition, the provider has joined the EU-US Data Privacy Framework, which on the basis of an adequacy decision by the European Commission ensures compliance with the European level of data protection.

You can find further information on data protection at AWS at https://aws.amazon.com/privacy/

4) Cookies

To make visiting our website attractive and to enable the use of certain functions, we use cookies, that is small text files that are stored on your device. Some of these cookies are automatically deleted again when you close your browser (so-called "session cookies"), while others remain on your device for longer and allow page settings to be saved (so-called "persistent cookies"). In the latter case you can find the storage period in the cookie settings overview of your web browser.

Where personal data is also processed by individual cookies we use, the processing takes place pursuant to Art. 6(1)(b) GDPR either for the performance of the contract, pursuant to Art. 6(1)(a) GDPR in the case of consent having been given, or pursuant to Art. 6(1)(f) GDPR to safeguard our legitimate interests in the best possible functionality of the website and a customer-friendly and effective design of your visit.

You can set your browser so that you are informed about the setting of cookies and can decide individually whether to accept them, or exclude the acceptance of cookies in certain cases or generally.

Please note that if cookies are not accepted, the functionality of our website may be limited.

Cookies we set: language preference

As soon as you actively choose a display language using the language switch, we set a technically necessary cookie:

Name: velion_lang · Purpose: storing the display language you selected · Content: the language code only ("de" or "en") · Storage period: 1 year.

The cookie contains no identifier by which you could be identified, is not evaluated for analytics or advertising purposes, cannot be read by JavaScript (HttpOnly), and is not transmitted to third parties. It is set only when you switch the language yourself, not on merely visiting our website.

This storage does not require consent pursuant to Section 25(2)(2) TDDDG, as it is strictly necessary in order to provide the service you have expressly requested, namely displaying the website in the language you selected. Insofar as personal data is processed in this context, this is done pursuant to Art. 6(1)(f) GDPR to safeguard our legitimate interest in a functional and user-friendly website. You can delete the cookie at any time via your browser's cookie settings.

If you have not chosen a language, we determine the display language from the "Accept-Language" header that your browser transmits with every page request in any case. It is evaluated solely in order to deliver the corresponding language version and is not stored by us.

5) Contacting us

5.1 WhatsApp Business

You have the option of contacting us via the messaging service WhatsApp provided by WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. For this we use the so-called "Business version" of WhatsApp.

If you contact us via WhatsApp in connection with a specific transaction (for example an order you have placed), we store and use the mobile number you use with WhatsApp and – if provided – your first and last name pursuant to Art. 6(1)(b) GDPR in order to process and answer your request. On the same legal basis we may ask you via WhatsApp to provide further data (order number, customer number, address or email address) so that we can assign your enquiry to a particular transaction.

If you use our WhatsApp contact for general enquiries (for example about our range of services, availability or our website), we store and use the mobile number you use with WhatsApp and – if provided – your first and last name pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in providing the requested information efficiently and promptly.

Your data is only ever used to answer your enquiry via WhatsApp. It is not passed on to third parties.

Please note that WhatsApp Business gains access to the address book of the mobile device we use for this purpose and automatically transfers phone numbers stored in that address book to a server of its parent company Meta Platforms Inc. in the USA. To operate our WhatsApp Business account we use a mobile device whose address book contains exclusively the WhatsApp contact details of users who have themselves contacted us via WhatsApp.

This ensures that every person whose WhatsApp contact details are stored in our address book has already consented, pursuant to Art. 6(1)(a) GDPR, to the transmission of their WhatsApp phone number from the address books of their chat contacts when first using the app on their device by accepting the WhatsApp terms of use. Transmission of data belonging to users who do not use WhatsApp and/or have not contacted us via WhatsApp is thereby excluded.

For the purpose and scope of the data collection and the further processing and use of the data by WhatsApp, as well as your related rights and the settings available to protect your privacy, please refer to WhatsApp's privacy notice: https://www.whatsapp.com/legal/?eea=1#privacy-policy

We have concluded a data processing agreement with the provider that protects our site visitors' data and prohibits disclosure to third parties.

In the course of the processing described above, data may be transferred to servers of Meta Platforms Inc. in the USA.

5.2 When you contact us (for example via the contact form or by email), personal data is collected. Which data is collected when a contact form is used can be seen from the respective contact form. This data is stored and used exclusively for the purpose of answering your enquiry or for making contact and the associated technical administration.

The legal basis for processing this data is our legitimate interest in answering your enquiry pursuant to Art. 6(1)(f) GDPR. If your contact is aimed at concluding a contract, the additional legal basis for the processing is Art. 6(1)(b) GDPR. Your data will be deleted once your enquiry has been conclusively dealt with. This is the case where it can be inferred from the circumstances that the matter concerned has been conclusively clarified and provided that no statutory retention obligations prevent deletion.

5.3 Contact form (Web3Forms)

For the technical provision and delivery of enquiries sent through our contact form we use the service "Web3Forms" provided by Web3Creative, Kerala, India.

When you open our contact page, a script belonging to the provider is loaded in your browser; your IP address is transmitted to the provider in the process. When you submit the form, the data you have entered – form of address and title (if provided), first and last name, email address, phone number and the customer and project type you selected – is transmitted to the provider's servers, stored there and delivered to us by email. The form does not contain a free-text field.

The provider is based in India; the form data is processed on servers in the USA. According to the provider, server log files arising there are deleted regularly – roughly every two months.

Note on third-country transfers: There is no adequacy decision by the European Commission for India pursuant to Art. 45 GDPR. There are also currently no appropriate safeguards within the meaning of Art. 46 GDPR in place with the provider, in particular no standard contractual clauses. The transfer is therefore based on your consent pursuant to Art. 49(1)(a) GDPR, which you give by confirming that you have taken note of this privacy policy before submitting the form.

We expressly draw your attention to the risks associated with this transfer: the third countries concerned do not have a level of data protection equivalent to European law. It cannot be ruled out that state authorities may access the transmitted data without you having effective legal remedies or enforceable data subject rights against this. Enforcing your rights under the GDPR against the provider may be difficult or impossible.

You are not obliged to give this consent. Instead, you can contact us informally at any time by email at info@velion-software.de or by phone on +49 1551 0286647; no transfer to the contact form provider takes place in that case. You may withdraw consent once given at any time with effect for the future.

To protect against automated input, the service additionally embeds the CAPTCHA service described under section 7.2.

You can find further information on data protection at the provider at https://web3forms.com/privacy

6) Web analytics services

Google Analytics 4

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"), which enables an analysis of your use of our website.

By default, when you visit the website Google Analytics 4 sets cookies, which are stored as small text elements on your device and collect certain information. The scope of this information also includes your IP address, which Google truncates by removing the last digits in order to rule out direct attribution to a person.

The information is transmitted to Google servers and processed further there. Transfers to Google LLC, based in the USA, are also possible.

Google uses the information collected on our behalf in order to evaluate your use of the website, to compile reports on website activity for us and to provide further services connected with website use and internet use. The truncated IP address transmitted by your browser in the context of Google Analytics is not merged with other Google data. The data collected in the course of using Google Analytics 4 is stored for a period of two months and then deleted.

All of the processing described above, in particular the setting of cookies on the device used, only takes place if you have given us your express consent to it pursuant to Art. 6(1)(a) GDPR. Without your consent, Google Analytics 4 is not used during your visit. You may withdraw consent you have given at any time with effect for the future. To exercise your right of withdrawal, please deactivate this service via the "cookie consent tool" provided on the website.

We have concluded a data processing agreement with Google that ensures the protection of our site visitors' data and prohibits unauthorised disclosure to third parties.

Further legal information on Google Analytics 4 can be found at https://business.safety.google/privacy/, https://policies.google.com/privacy and at https://policies.google.com/technologies/partner-sites

Demographic characteristics
Google Analytics 4 uses the special "demographic characteristics" function and can use it to create statistics that make statements about the age, gender and interests of site visitors. This is done by analysing advertising and information from third parties. This makes it possible to identify target groups for marketing activities. The data collected cannot, however, be attributed to a specific person and is deleted after being stored for a period of two months.

Google Signals
As an extension to Google Analytics 4, Google Signals may be used on this website in order to have cross-device reports generated. If you have activated personalised advertising and have linked your devices to your Google account, Google may – subject to your consent to the use of Google Analytics pursuant to Art. 6(1)(a) GDPR – analyse your usage behaviour across devices and create database models, including on cross-device conversions. We do not receive any personal data from Google, only statistics. If you wish to stop cross-device analysis, you can deactivate the "Personalised advertising" function in the settings of your Google account. To do so, follow the instructions on this page: https://support.google.com/My-Ad-Center-Help/answer/12155764
Further information on Google Signals can be found at the following link: https://support.google.com/analytics/answer/7532985

UserIDs
As an extension to Google Analytics 4, the "UserIDs" function may be used on this website. If you have consented to the use of Google Analytics 4 pursuant to Art. 6(1)(a) GDPR, have set up an account on this website and log in to that account on different devices, your activities, including conversions, can be analysed across devices.

Collection of user-provided data
In order to improve the analysis results for users whose contact details we have received in the context of business or business-like relationships, we use the "collection of user-provided data" function.
Subject to your express consent pursuant to Art. 6(1)(a) GDPR, under this function we transmit one or more files containing customer data aggregated for your person (above all email address and phone number) to Google electronically. Google does not gain access to plain data in the process; instead it automatically encrypts the information in the customer files during the transmission process using a special algorithm. Google can then only use the encrypted information to match it to existing Google accounts that the data subjects have set up.
The processing serves to make measurement data more precise, improves cross-device user traceability and enables the integration of analysis results into Google Ads advertising personalisation and conversion tracking functions.
You may withdraw your consent to us at any time with effect for the future. Further information on Google's data protection measures in relation to the transmission of customer data can be found here: https://support.google.com/google-ads/answer/6334160

7) Site functionality

7.1 Fonts (web fonts)

For a consistent display of typefaces, this website uses exclusively self-hosted web fonts. No fonts are loaded from third-party servers – in particular not from Google Fonts. No connection to Google or any other external font provider takes place; accordingly, no data is transmitted to such providers.

The font files are delivered via our own content delivery network. In that respect the information under section 3.2 of this policy applies.

7.2 hCaptcha

To protect our contact form against abusive automated input we use the CAPTCHA service "hCaptcha" provided by Intuition Machines, Inc., 1065 SW 8th St #704, Miami, FL 33130, USA.

The service is embedded as part of the form service described under section 5.3. It checks whether an input is made by a natural person or abusively by machine and automated processing, and in this way blocks spam and similar automated malicious access. For this purpose the provider collects in particular the IP address of the device used, identification data of the browser and operating system type used, language settings and display properties as well as mouse, keyboard and touch input and the time spent, and transmits this to the provider's servers for evaluation. Cookies or comparable technologies may be used in the process, that is small text files stored in the device's browser.

The legal basis for the processing is our legitimate interest in preventing misuse and spam and in the security of our systems pursuant to Art. 6(1)(f) GDPR. Storing information on your device, or accessing information already stored there, is strictly necessary for the use of the contact form that you have expressly requested within the meaning of § 25(2)(2) TDDDG.

For data transfers to the USA the provider has joined the EU-US Data Privacy Framework, which on the basis of an adequacy decision by the European Commission ensures compliance with the European level of data protection. In addition, the provider has agreed to the standard contractual clauses adopted by the European Commission pursuant to Art. 46(2)(c) GDPR.

Further information can be found in the provider's privacy notice at https://www.hcaptcha.com/privacy

8) Tools and miscellaneous

8.1 Cookie consent tool

To obtain effective user consent for cookies and cookie-based applications that require consent, this website uses a so-called "cookie consent tool". The "cookie consent tool" is shown to users when they open the page in the form of an interactive interface on which consent for particular cookies and/or cookie-based applications can be given by ticking boxes. Through the use of the tool, all cookies/services requiring consent are only loaded if the user concerned gives the corresponding consent by ticking a box. This ensures that such cookies are only set on the user's device where consent has been given.

The tool sets technically necessary cookies in order to store your cookie preferences. As a rule, no personal user data is processed in the process.

If, in an individual case, personal data (such as the IP address) is nevertheless processed for the purpose of storing, assigning or logging cookie settings, this takes place pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in legally compliant, user-specific and user-friendly consent management for cookies and hence in a legally compliant design of our website.

A further legal basis for the processing is Art. 6(1)(c) GDPR. As a controller we are subject to the legal obligation to make the use of cookies that are not technically necessary dependent on the respective user's consent.

Insofar as necessary, we have concluded a data processing agreement with the provider that ensures the protection of our site visitors' data and prohibits unauthorised disclosure to third parties.

Further information about the operator and the settings available in the cookie consent tool can be found directly in the corresponding interface on our website.

8.2 DATEV

For handling our accounting we use the cloud-based accounting software service of the following provider: DATEV eG, Paumgartnerstr. 6-14, 90429 Nuremberg, Germany

The provider processes incoming and outgoing invoices and, where applicable, our company's bank movements in order to record invoices automatically, match them to transactions and produce financial accounting from them in a partially automated process.

Where personal data is also processed in this context, the processing takes place on the basis of our legitimate interest in the efficient organisation and documentation of our business transactions pursuant to Art. 6(1)(f) GDPR.

9) Rights of the data subject

9.1 Applicable data protection law grants you the following data subject rights (rights to information and intervention) vis-à-vis the controller with regard to the processing of your personal data, whereby reference is made to the legal basis cited for the respective conditions of exercise:

Right of access pursuant to Art. 15 GDPR;
Right to rectification pursuant to Art. 16 GDPR;
Right to erasure pursuant to Art. 17 GDPR;
Right to restriction of processing pursuant to Art. 18 GDPR;
Right to notification pursuant to Art. 19 GDPR;
Right to data portability pursuant to Art. 20 GDPR;
Right to withdraw consent given pursuant to Art. 7(3) GDPR;
Right to lodge a complaint pursuant to Art. 77 GDPR.

9.2 RIGHT TO OBJECT

IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST IN THE CONTEXT OF A BALANCING OF INTERESTS, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THIS PROCESSING WITH EFFECT FOR THE FUTURE ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED. WE RESERVE THE RIGHT TO CONTINUE PROCESSING, HOWEVER, IF WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING WHICH OVERRIDE YOUR INTERESTS, FUNDAMENTAL RIGHTS AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.

IF YOUR PERSONAL DATA IS PROCESSED BY US FOR THE PURPOSE OF DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH ADVERTISING. YOU MAY EXERCISE THE OBJECTION AS DESCRIBED ABOVE.

IF YOU EXERCISE YOUR RIGHT TO OBJECT, WE WILL CEASE PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

10) Duration of storage of personal data

The duration of storage of personal data is determined by the respective legal basis, the purpose of processing and – where applicable – additionally by the respective statutory retention period (for example retention periods under commercial and tax law).

Where personal data is processed on the basis of express consent pursuant to Art. 6(1)(a) GDPR, the data concerned is stored until you withdraw your consent.

Where statutory retention periods exist for data processed in the context of legal or quasi-legal obligations on the basis of Art. 6(1)(b) GDPR, this data is routinely deleted after the retention periods have expired, provided it is no longer required for the performance or initiation of a contract and/or we no longer have a legitimate interest in continued storage.

Where personal data is processed on the basis of Art. 6(1)(f) GDPR, this data is stored until you exercise your right to object under Art. 21(1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where personal data is processed for direct marketing purposes on the basis of Art. 6(1)(f) GDPR, this data is stored until you exercise your right to object under Art. 21(2) GDPR.

Unless otherwise stated in the other information in this policy about specific processing situations, stored personal data is otherwise deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.

This is a courtesy translation. The legally binding version is the German Datenschutzerklärung.

Last updated: 5 August 2026