Privacy Policy

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

VALENTO GmbH
Represented by: Eva Brandenburg, Shahad Hussain Kavassery Sakeer

Kaiser-Joseph-Str. 254
79098 Freiburg im Breisgau

Email: hello@valento.io
Website: valento.io

2.1 Scope of the processing of personal data

As a matter of principle, we process our users’ personal data only to the extent necessary to provide a functioning website together with our content and services. Personal data of our users is generally processed only with the user’s consent. An exception applies in cases where obtaining prior consent is not possible for factual reasons and the processing of the data is permitted by law.

2.2 Legal basis for the processing of personal data

Where we obtain the consent of the data subject for processing operations involving personal data, Art. 6(1)(a) of the EU General Data Protection Regulation (GDPR) serves as the legal basis.

Where the processing of personal data is necessary for the performance of a contract to which the data subject is a party, Art. 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations necessary for the performance of pre-contractual measures.

Where the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Art. 6(1)(c) GDPR serves as the legal basis.

Where the processing is necessary to protect a legitimate interest of our company or of a third party, and the interests, fundamental rights and freedoms of the data subject do not override that interest, Art. 6(1)(f) GDPR serves as the legal basis for the processing.

2.3 Erasure of data and storage period

The personal data of the data subject is erased or blocked as soon as the purpose of storage ceases to apply. Data may be stored beyond that point where this has been provided for by the European or national legislator in Union regulations, laws or other provisions to which the controller is subject. Data is also blocked or erased when a storage period prescribed by the standards referred to expires, unless there is a need for continued storage of the data for the conclusion or performance of a contract.

3.1 Description and scope of the data processing

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device. The following data is collected: information about the browser type and version used, the user’s operating system, the user’s internet service provider, the user’s IP address, the date and time of access, websites from which the user’s system reaches our website, and websites accessed by the user’s system via our website. This data is also stored in our system’s log files. This data is not stored together with other personal data of the user.

3.2 Legal basis and purpose

The legal basis for the temporary storage of the data and the log files is Art. 6(1)(f) GDPR. The temporary storage of the IP address by the system is necessary in order to deliver the website to the user’s device. Storage in log files takes place in order to ensure the functionality of the website and the security of our information technology systems.

3.3 Storage period

The data is erased as soon as it is no longer required to achieve the purpose for which it was collected. Where data is collected in order to provide the website, this is the case when the respective session has ended. Where data is stored in log files, this is the case after seven days at the latest.

Our website is hosted with Cloudflare; Cloudflare also handles DNS resolution and delivery via a content delivery network (CDN). The provider is Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. When you visit our website, technically necessary data (in particular IP addresses) is processed by Cloudflare as a processor within the meaning of Art. 28 GDPR. Delivery takes place via a global server network; your request may therefore also be answered from a location outside the EU. Cloudflare deletes log files automatically after a short period. For details, please see Cloudflare’s privacy policy: https://www.cloudflare.com/privacypolicy/

Where personal data is transferred to the USA in this context, we base the transfer primarily on the European Commission’s adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR), provided the recipient is certified. Where this is not the case, or should that decision cease to apply, the EU standard contractual clauses pursuant to Art. 46(2)(c) GDPR apply in addition. You can request a copy of the safeguards at hello@valento.io.

The hosting service provider is used on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in presenting our website as reliably as possible.

5.1 Description and scope of the data processing

Our website provides contact forms (for example for case study enquiries) which can be used to make contact electronically. If a user makes use of this option, the data entered in the input mask is transmitted to us and stored. This data is: name, email address, company, where applicable further details (for example the number of SKUs), and the time of submission. Your consent is obtained as part of the submission process and reference is made to this privacy policy.

Alternatively, it is possible to contact us via the email address provided, hello@valento.io. In this case, the user’s personal data transmitted with the email is stored. The data is not passed on to third parties in this context. The data is used exclusively for processing the conversation.

5.2 Legal basis

Where the user has given consent, the legal basis for processing the data is Art. 6(1)(a) GDPR. The legal basis for processing data transmitted in the course of sending an email is Art. 6(1)(f) GDPR. Where the email contact is aimed at concluding a contract, Art. 6(1)(b) GDPR is an additional legal basis for the processing.

5.3 Storage period

The data is erased as soon as it is no longer required to achieve the purpose for which it was collected. For personal data from the contact forms and data sent by email, this is the case when the respective conversation with the user has ended.

We use Microsoft Bookings to book appointments, a service provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. When you book an appointment via our website, your details (name, email address and, where applicable, further data entered by you) are transmitted to Microsoft and processed there. The data processing takes place on the basis of your consent (Art. 6(1)(a) GDPR) or for the performance of pre-contractual measures (Art. 6(1)(b) GDPR).

Further information can be found in Microsoft’s privacy statement: https://privacy.microsoft.com/en-us/privacystatement

If you subscribe to our newsletter or we contact you by email, we use Brevo (formerly Sendinblue). The provider is Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany.

Brevo is a service which can be used, among other things, to organise and analyse the sending of emails. The data you enter is stored on Brevo’s servers. The data processing takes place on the basis of your consent (Art. 6(1)(a) GDPR). You can withdraw this consent at any time.

For detailed information on Brevo, please see: https://www.brevo.com/legal/privacypolicy/

We process personal data of contact persons at companies which we would like to approach as potential business partners, including where we did not collect this data from you directly. With the following information we fulfil our duty to provide information under Art. 14 GDPR.

8.1 Categories of data and sources

We process exclusively work-related details: first and last name, function or position, company affiliation, business contact details and publicly available information on professional activities. The sources we use are the commercial and company registers, legal notice details and websites of companies, professional networks such as LinkedIn, and the trade and business press.

8.2 Purposes and legal basis

We use this data to assess whether working together makes sense professionally, to identify the right contact person, to prepare our conversations and documents, and to approach you in a business context. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the initiation of business relationships in a B2B environment. We do not process special categories of personal data under Art. 9 GDPR and we do not take automated decisions within the meaning of Art. 22 GDPR.

8.3 Storage period

We store this data for as long as there is a legitimate reason to make contact, and for no longer than 24 months after the last contact. If you object to the processing, we will erase the data without delay; we may then only store your contact details on a suppression list in order to prevent you being approached again.

8.4 Your right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data (Art. 21(1) GDPR). Where the processing is for direct marketing purposes, you may object at any time without giving reasons (Art. 21(2) GDPR); we will then no longer process your data for that purpose. A message to hello@valento.io is sufficient.

Where you have consented to this in the cookie banner, we use TWIPLA (Visitor Analytics) to analyse user behaviour on our website. The provider is TWIPLA GmbH, Friedrichstraße 68, 10117 Berlin, Germany. TWIPLA processes data in compliance with the GDPR within the EU.

The data processed includes the anonymised IP address, pages accessed, time spent on the site and the referrer. This data is not combined with other data. Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw your consent at any time with effect for the future by adjusting your cookie settings.

If you do not give consent, we use TWIPLA exclusively in a cookieless mode: no cookies are set and no personal profiles are created; only aggregated, anonymous statistics (for example page views) are recorded, which do not allow any conclusions to be drawn about you personally. The legal basis for this is Art. 6(1)(f) GDPR — our legitimate interest in anonymous audience measurement in order to improve our offering.

Further information: https://www.twipla.com/en/privacy-policy

Where you have consented to the “Marketing” category in the cookie banner, we use Overloop to identify companies visiting our website. The provider is Overloop SRL, Rue des Pères Blancs 4, 1040 Brussels, Belgium (VAT no. BE 0645.917.753).

When a page is opened, an invisible frame is loaded which transmits the page address, the page title and your IP address to Overloop. Overloop matches the IP address against a database in order to determine the company behind it. The purpose is to approach potential business customers. Since IP addresses may constitute personal data, this is used solely on the basis of your consent.

In doing so, Overloop stores an identifier in your browser’s local storage under a key beginning with “overloopai_” followed by our customer number. This identifier is used to recognise your browser on subsequent visits. No cookies are set. The entry remains stored until you delete it via your browser settings.

Legal basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG (consent). Section 25 TDDDG covers any storage of information on your terminal equipment, regardless of whether this happens via cookies or via local storage. You can withdraw your consent at any time with effect for the future by adjusting your cookie settings. Without consent, no frame is loaded, no data is transmitted to Overloop and nothing is stored in your browser.

We have instructed Overloop to delete the data collected in this way no later than twelve months after collection. The identifier stored in your browser’s local storage remains in place independently of this until you delete it.

Overloop is established in the EU. However, Overloop uses sub-processors with infrastructure in the United States, so a transfer to third countries cannot be ruled out. Any such transfer takes place on the basis of the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

Further information: https://overloop.com/privacy and https://overloop.com/gdpr

The web fonts used (“Space Grotesk”, “DM Sans”) are delivered locally from our server. No transfer to Google Fonts or other external providers takes place. Both fonts are licensed under the SIL Open Font License 1.1.

This website may contain references to our LinkedIn profile. The provider is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. If you reach LinkedIn via a link on our website, LinkedIn may collect information about your visit. We point out that, as the provider of these pages, we have no knowledge of the content of the data transmitted or of how it is used by LinkedIn. Further information: https://www.linkedin.com/legal/privacy-policy

Our website uses cookies. Cookies are text files which are stored in or by the internet browser on the user’s computer system. We use cookies in order to make our website more user-friendly and to save your cookie settings.

The legal basis for technically necessary cookies is Art. 6(1)(f) GDPR. Where consent has been given, the legal basis for cookies used for analysis or marketing purposes is Art. 6(1)(a) GDPR and Section 25(1) TDDDG (German Digital Services Data Protection Act). You can withdraw or adjust your consent at any time via our cookie banner.

By changing the settings in your internet browser, you can deactivate or restrict the transmission of cookies. Cookies which have already been stored can be deleted at any time.

For security reasons, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address line of the browser changes from “http://” to “https://” and by the padlock symbol in your browser line.

You have the right of access (Art. 15 GDPR), to rectification (Art. 16 GDPR), to erasure (Art. 17 GDPR), to restriction of processing (Art. 18 GDPR), to data portability (Art. 20 GDPR) and to object (Art. 21 GDPR). You also have the right to withdraw your consent at any time (Art. 7(3) GDPR) and to lodge a complaint with a supervisory authority (Art. 77 GDPR).

Competent supervisory authority: Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

We reserve the right to amend this privacy policy so that it always complies with current legal requirements, or in order to reflect changes to our services. The new privacy policy will then apply to your next visit.

If you have any questions about data protection, please contact: hello@valento.io