Legal
Privacy Policy
Last updated: February 18, 2025
This Privacy Policy for VAARHAFT GmbH ("we," "us," or "our") describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services, including when you:
- Visit our website at www.vaarhaft.com, or any website of ours that links to this Privacy Notice
- Engage with us in other related ways, including any sales, marketing, or events
Questions or concerns? If you do not agree with our policies and practices, please do not use our Services. Contact us at privacy@vaarhaft.com.
Contents
01
Who We Are
The data controller responsible in accordance with the GDPR is:
02
How to Contact the Data Protection Officer
The designated data protection officer is:
03
What Do We Mean by "Legal Basis"?
We only collect, use or share your personal data where we have a legitimate purpose and a legal basis for doing so.
Art. 6(1)(a) GDPR: Consent: You have given us your consent to process your personal data for a specific purpose. You may withdraw consent at any time.
Art. 6(1)(b) GDPR: Contract: We need to use your data to fulfil a contract you have with us, or because you have taken steps before entering that contract.
Art. 6(1)(c) GDPR: Legal Obligation: We need to use your data to comply with the law.
Art. 6(1)(d) GDPR: Vital Interests: Processing your data is necessary to protect your vital interests or those of another person.
Art. 6(1)(e) GDPR: Public Task: Using your data is necessary for the performance of a task carried out in the public interest.
Art. 6(1)(f) GDPR: Legitimate Interests: Processing your data is necessary to support a legitimate interest we or another party has, only where this is not outweighed by your own interests.
04
Data Sharing and International Transfers
We use various service providers to help us deliver our services. We have agreements in place with all service providers that oblige them to protect your data.
Where your personal data is shared outside the EU, we ensure an equivalent level of protection via an "adequate" standard or Standard Contractual Clauses (SCCs). For US providers we rely on SCCs or the EU-US Data Protection Framework. Request a copy of our SCCs by emailing privacy@vaarhaft.com.
05
Your Rights
As a data subject within the meaning of the GDPR, you have the following rights:
1. Right of Access (Art. 15 GDPR)
You may request confirmation of whether your personal data is processed and obtain information on purposes, categories, recipients, storage periods, existence of other rights, right to lodge a complaint, origin of data, and existence of automated decision-making.
2. Right to Rectification (Art. 16 GDPR)
You have the right to have incorrect or incomplete personal data corrected without delay.
3. Right to Restriction of Processing (Art. 18 GDPR)
You may request restriction if you contest accuracy; processing is unlawful and you oppose erasure; you need data for legal claims; or you have objected to processing pending verification.
4. Right to Erasure – “Right to be Forgotten” (Art. 17 GDPR)
You may request deletion if: data is no longer necessary; you withdraw consent and no other basis exists; you object and no overriding grounds exist; data was unlawfully processed; or deletion is required by law.
5. Right to Data Portability
You have the right to receive your personal data in a structured, machine-readable format and to transfer it to another controller.
6. Right to Object
You have the right to object at any time to processing based on Art. 6(1)(e) or (f) GDPR, including profiling. If data is processed for direct marketing, you may object at any time.
7. Right to Complain to a Supervisory Authority
You have the right to lodge a complaint with a supervisory authority. A list of competent supervisory authorities in Germany is available at: bfdi.bund.de.
06
Data Processing When You Load Our Website
1.Description and Scope
Each time our website is accessed, our system automatically collects:
- Browser type and version
- Operating system
- Internet service provider
- Date and time of access
- Referring website
This data is stored in log files.
2.Purpose
Temporary storage of the IP address is necessary for delivery of the website. Log files ensure functionality and IT security. No marketing analysis takes place.
3.Legal Basis
Art. 6(1)(f) GDPR.
4.Duration of Storage
IP addresses in log files are deleted or anonymised after thirty days at the latest.
5.Exercising Your Rights
The collection of data for providing the website is technically necessary. The user may object; success is determined by a balancing of interests.
07
Use of Cookies
1.Description and Scope
We use technically necessary cookies and cookies that are not technically necessary. Technically necessary cookies store:
- Language settings
- Frequency of page views
- Use of website functionalities
Non-necessary cookies may also process: IP address, location, date/time of request, surfing behaviour tracking, and social media platform linking.
2.Purpose
Necessary cookies ensure functionality. Non-necessary cookies improve quality, personalise content and ads, provide social media features, and analyse traffic.
3.Legal Basis
Necessary cookies: § 25(2)(2) TDDDG. Non-necessary cookies: § 25(1) TDDDG in conjunction with Art. 6(1)(a) and Art. 7 GDPR.
4.Exercising Your Rights
Manage your cookie preferences at any time via our Cookie Notice.
08
Newsletter
We collect: email address, LinkedIn profile. Data is passed to an adequate provider exclusively for newsletter delivery.
Unsubscribe at any time via the opt-out link in every newsletter.
09
Contact via Email
Personal data transmitted with your email is stored and used exclusively for processing the conversation.
You can delete your account or request changes by emailing privacy@vaarhaft.com. Include: full name and registered email, the requested action, and any relevant details. All requests are processed within 10 business days.
10
Contact Form
Data collected when using the contact form:
- Email address
- Last name
- First name
- Company name
- IP address
- Date and time
You can delete your account or request changes by emailing privacy@vaarhaft.com. Include: full name and registered email, the requested action, and any relevant details. All requests are processed within 10 business days.
11
Application via Email and Form
Data collected via form or email: Last name, First name, Address, Telephone / mobile phone number, Email address, Curriculum Vitae, Certificates. Applications can alternatively be sent by email. We also offer an applicant/talent pool. Data is not passed to third parties.
Contact privacy@vaarhaft.com to withdraw your application or request deletion.
12
Corporate Web Profiles – Instagram
Instagram, part of Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland.
We have no influence on the processing of your personal data by Instagram and cannot make binding statements regarding the purpose and scope of that processing.
Legal basis for customer communication: Art. 6(1)(f) GDPR. For consent-based processing (sweepstakes, lead campaigns): Art. 6(1)(a) GDPR. Data generated on the company profile is not stored in our own systems. Object at any time by emailing privacy@vaarhaft.com.
Further information: Instagram Privacy Information
13
Corporate Profiles in Professionally Oriented Networks – LinkedIn
1.Scope
We maintain a corporate presence on LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland) for job applications, information, public relations, and active sourcing. Further information: LinkedIn Privacy Policy
2.Legal Basis
Art. 6(1)(f) GDPR; additionally Art. 6(1)(b) GDPR if contact aims to conclude a contract.
3.Purpose
Our corporate profile serves to inform users about our services.
4.Duration of Storage
Data generated on the company profile is not stored in our own systems.
5.Exercising Your Rights
Object at any time by email. Further information: LinkedIn Privacy Policy
14
Hosting & Email Delivery
This website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. When you visit the site, Vercel's servers automatically collect information in server log files: browser type, operating system, internet service provider, IP address, date/time of access, and the referring website. This data is not merged with other sources and is required to deliver the site reliably and securely. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and performant provision of the website). We have concluded a data processing agreement with Vercel; transfers to the USA are safeguarded by the EU standard contractual clauses and Vercel's certification under the EU-U.S. Data Privacy Framework. Further information: Vercel Privacy Policy
Messages submitted through our contact and demo request forms are delivered by email via Amazon Web Services (Amazon SES), provided by Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg. For this purpose, the data you enter in the form (such as name, email address, company, and your message) is processed for transmission. Legal basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract) and Art. 6(1)(f) GDPR (processing your enquiry). A data processing agreement is in place with AWS; any transfers to the USA are safeguarded by the EU standard contractual clauses and the EU-U.S. Data Privacy Framework. Further information: AWS Privacy Notice
15
Registration
Registration data collected: Email address, Last name, First name, IP address, Date and time of registration, Company name.
You can delete your account or request changes by emailing privacy@vaarhaft.com. Include: full name and registered email, the requested action, and any relevant details. All requests are processed within 10 business days.
16
Google Analytics 4
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data processed: first visit, usage path, clicks on external links, video usage, file downloads, advertising impressions, scroll behaviour, searches, language selection, page visits, location (region), IP address (shortened), browser/device information, internet provider, referrer URL. IP anonymisation enabled by default.
Revoke consent at any time. Opt-out: Google Partner Sites · GA Opt-out Plugin · Google Ads Settings
17
Google reCAPTCHA
Google LLC / Google Ireland Ltd. Analyses visitor behaviour to distinguish humans from bots. Data processed: user activity, device/browser info, IP address, operating system.
Revoke consent at any time. Opt-out: Google Ads Settings. Further info: Google Privacy Policy
18
Use of LinkedIn
LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. When accessing pages with LinkedIn features, a connection to LinkedIn servers is established. Data processed: user activity and device/browser information.
Opt-out: LinkedIn Guest Controls
19
Google Calendar
Google LLC, Mountain View, CA 94043, USA. When scheduling appointments, data processed may include: date/time, name, and email address.
Revoke consent at any time via your Google account settings or browser preferences.
20
Google Tag Manager
Google LLC / Google Ireland Ltd. GTM manages and bundles tags from Google and third-party services. GTM itself does not access personal data.
Opt-out: Google Ads Settings · GA Opt-out Plugin
21
Usercentrics
Usercentrics GmbH, Rosental 4, 80331 Munich, Germany. Consent Management Platform. Data processed: date/time of visit, device info, browser info, anonymised IP, opt-in/opt-out data. Processing within the EU.
Further information: Usercentrics Privacy Policy
22
LinkedIn Analytics
LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Pseudonymised user profiles are created. Data processed: OS, device ID, ISP, IP address, referrer URL, browser info.
Opt-out: LinkedIn Advertising Preferences
23
LinkedIn Insight Tag
LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. JavaScript tag. Data processed: URL, referrer URL, shortened/hashed IP, device/browser properties, timestamps. LinkedIn provides only aggregated audience reports.
Opt-out and further info: LinkedIn Privacy Policy
24
Google Sign-In
Google LLC, Mountain View, CA 94043, USA. Data processed: Google account info (email, public profile), device/browser info, IP address, login activity. Only information necessary for authentication is received.
Control via Google Account Settings. Further details: Google Privacy Policy
25
Integration of Third-Party Services via External Service Providers
We integrate plugins via external service providers. Connections to their servers are established and device/browser information (e.g. IP address) may be stored. Services used: Make.com, Pipedrive, Chatlab.
This privacy policy has been created with the assistance of DataGuard.