Privacy
1. Data controller
The controller responsible for data processing on this website is:
Roberto Neumann
trading as „Vayvolt“
Emmentaler Str. 121
13409 Berlin
Germany
Email: contact@vayvolt.de
Further details can be found in our Imprint.
2. Access data at the host
When you access this website, your browser automatically transmits access data to our hosting provider (e.g. IP address, date and time, URL accessed, volume of data, browser type). The host processes this data as part of operating the infrastructure. Our own visitor statistics (without marketing tracking) are described in section 8.
3. Contact form
When you contact us via the contact form ("Contact" page), we only collect the fields shown: name, email address, subject and message. Your IP address at the time of submission is stored for technical and security reasons (e.g. to prevent abuse and to enforce rate limits).
Purpose: To process your request and, if applicable, to reply.
Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps) or Art. 6(1)(f) GDPR (legitimate interest in handling enquiries).
Retention: Data is stored in a database (table contact_requests) and deleted after at most 12 months, unless legal retention obligations apply. We can consider a shorter retention period on request.
Only fields necessary for the enquiry are requested. A hidden field (honeypot) is used to protect against automated submissions.
4. Legal basis
Where we obtain consent for processing, Art. 6(1)(a) GDPR applies. For the performance of contractual or pre-contractual measures, Art. 6(1)(b) GDPR applies. For processing to comply with legal obligations, Art. 6(1)(c) GDPR applies. For legitimate interests, Art. 6(1)(f) GDPR applies.
5. Storage period
Personal data is stored only for as long as necessary for the stated purpose or as required by statutory retention periods. After that, the data is deleted.
6. Your rights (data subject rights)
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21). To exercise these rights, please contact us by email or via the contact form – including for data from the contact form, newsletter subscription or a Forge purchase or subscription. We will process your request within the statutory time limits. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR).
7. Cookies
This website uses only technically necessary cookies. They are required for basic site functionality.
Visitor count (cookie „vayvolt_vd“): To count visitors per day, we set a technically necessary cookie named vayvolt_vd. It stores only the current date and expires at the end of the day, so each visitor is counted at most once per day. If you reject cookies, recognition is done on the server using a non-reversible day hash (your IP address is not stored permanently for this; see section 8). This site does not use third-party analytics or marketing cookies (e.g. Google Analytics).
8. Visitor statistics
We collect limited visitor statistics to improve our website: at most one entry per visitor per calendar day (first page path visited, referrer domain or URL, coarse device type and – where technically possible – country derived from the IP address). There is no page-by-page tracking and no profiling across days.
Raw data is kept for about 14 days and then aggregated into daily totals. The admin area, API routes and Forge checkout pages are excluded from this statistics.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in data-minimised reach measurement). Objection: You may object to processing for reasons relating to your particular situation (Art. 21 GDPR); please contact us.
9. Third-party services, processors and international transfers
Hosting: This website is hosted by Serverprofis GmbH, Otto-Lilienthal-Ring 34-36, 85622 Feldkirchen, Germany. The host processes access data as a processor.
Email (SMTP): For confirmation and system emails (newsletter double opt-in, contact replies, Forge licences, subscription management) we use the SMTP service configured in our system (usually via our host). This processes email address, subject and content.
Stripe (Stripe Payments Europe, Ltd. and/or Stripe, Inc.): We use Stripe for payments, subscriptions and the customer portal (invoices, payment methods, cancellation). Stripe processes payment data, billing data and customer identifiers. Legal basis: Art. 6(1)(b) GDPR. Privacy: stripe.com/privacy. Where data is transferred to third countries (e.g. the USA), Stripe relies on appropriate safeguards (e.g. standard contractual clauses).
MaxMind GeoLite2: To determine country from the IP address for visitor statistics we use the GeoLite2 database held locally on our server. The IP is used only for the lookup and is not stored in plain text in the statistics table.
Where required, we have data processing agreements with the providers listed above pursuant to Art. 28 GDPR.
10. Newsletter
If you subscribe to our newsletter, we collect your email address and the page language at sign-up. We use double opt-in: you receive a confirmation email with a link valid for 7 days. Your subscription is only complete after you click that link.
Legal basis: Art. 6(1)(a) GDPR (consent). Unconfirmed sign-ups are deleted automatically after at most 7 days. Confirmed addresses are kept until you unsubscribe or we discontinue the newsletter.
You may withdraw consent at any time (e.g. via the unsubscribe link in the newsletter or by contacting us). A hidden field (honeypot) and rate limits help prevent abuse.
11. Forge purchase and manage subscription
When you purchase Vayvolt Forge (licence or subscription), we collect the data requested at checkout, e.g. name, email, address, company, VAT ID, phone (optional), chosen plan, payment type and a password hash for customer access. We store when you agreed to these terms and the privacy policy.
Payment and subscription management are handled by Stripe (see section 9). Licence keys and subscriptions are stored in our database (tables including forge_checkouts, forge_licenses). Retention: for the term of the contract and beyond only where statutory retention applies (e.g. tax and commercial law).
Under „Manage subscription“ you can request a time-limited link by email (valid for about 30 minutes). Only someone with access to that mailbox can open the Stripe customer portal (cancel at period end, payment method, invoices). Legal basis: Art. 6(1)(b) GDPR.
12. Changes
We may update this privacy policy to reflect changes in the law or in our website and services. The current version is always available on this page.