Privacy Policy

The controller responsible for data processing on this website is:

Onveda GmbH
Düsseldorfer Straße 14
40764 Langenfeld, Germany
Phone: +49 2173 2972 20
Email: kontakt@onveda.de

Represented by the managing director, Jens Bohl. Please send questions about data protection and requests regarding your rights to this address.

This policy describes which personal data is processed when you visit onveda.de, for what purpose, and who receives it. Personal data is any information that can be related to you as a person, for example your name, email address or IP address.

Depending on what you do on the website, these recipients are involved:

• Every page view: Hetzner Online GmbH (hosting in Germany).
• Contact form: Google (email delivery and mailbox), Telegram (internal notification).
• Audit checklist download: Telegram (internal notification).
• Chat assistant: Mistral AI SAS, France.
• Map: Google, only after you click "Load map".
• Only with your consent: Matomo and Google Analytics ("Statistics" category), Google Ads conversion tracking ("Marketing" category).

Hosting at Hetzner

The website runs on servers operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located in data centers in Germany. Hetzner processes the data on our behalf and only to the extent needed to run the website.

What is processed when you open a page

To display a page, your browser sends technical information to our server:

• IP address
• Date and time of the request
• The address requested (URL) and, if transmitted, the previously visited page (referrer)
• Browser type, browser version and operating system

The server also writes error and event logs so that we can find faults and fend off attacks. We do not write contact form content such as your name, email address or message into these logs.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and error-free operation of the website.

Encryption

The website is delivered exclusively over an encrypted connection (HTTPS). Requests over HTTP are redirected to HTTPS.

On your first visit, a notice at the bottom of the screen asks which services you allow. "Accept all" and "Necessary only" carry equal weight; under "Customize settings" you choose individually. There are three categories:

• Necessary: always active. This only covers storing your choice itself.
• Statistics: only with your consent. Matomo and Google Analytics (Section 9).
• Marketing: only with your consent. Google Ads conversion tracking (Section 9).

We store your choice in your browser's local storage (localStorage) under the name onveda_cookie_consent. It contains the selected categories, a version number and the time of your choice. The entry remains until you change it or clear the site data in your browser. It is not sent to our server.

Storing your choice is technically necessary (Section 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR). All services in the "Statistics" and "Marketing" categories are based on your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR. TDDDG is the Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, the German Telecommunications Digital Services Data Protection Act.

Change or withdraw your consent

You can withdraw your consent at any time with effect for the future. Processing carried out before the withdrawal remains lawful. Change your choice directly here:

What data we collect

The contact form asks for your name, email address, subject and message. Your phone number is optional. Depending on your request, further optional details may be added, such as your preferred timeline or, for applications, the type of position, a timeframe and a link to your portfolio or GitHub. You can attach a PDF file of up to 10 MB.

The form also transmits the page you came from and, if present, campaign parameters from the address bar (utm_source, utm_medium, utm_campaign). This shows us how an inquiry reached us.

What happens to your inquiry

Our server checks the details and sends them by email to our mailbox. Email delivery and the mailbox are provided by Google (Google Workspace, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). An attached PDF is sent along with the email. You receive an automatic confirmation at the email address you provided.

To prevent abuse, the server counts requests per IP address. This counter is kept only in the server's memory and is deleted after two hours at the latest.

Notification via Telegram

For every new inquiry, we receive a message in the Telegram messenger. It contains your name, email address, phone number, subject, the origin details and the first 500 characters of your message. It notes whether a file was attached; the file itself is not sent to Telegram.

The provider is Telegram, based outside the European Union (Telegram FZ-LLC, Dubai, United Arab Emirates). There is no adequacy decision by the European Commission for this country. Your data may therefore be processed outside the EU, where the level of data protection may be lower. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to see and answer inquiries quickly.

Contact by email or phone

If you email us directly or call us, we process your details to respond to your request. Emails are also stored in our mailbox at Google.

Legal basis and retention

If your inquiry concerns a quote, a project or an existing contract, the legal basis is Art. 6(1)(b) GDPR. In all other cases it is Art. 6(1)(f) GDPR; our legitimate interest is answering your inquiry.

We delete inquiries once they are resolved and no follow-up questions are expected. Data we are required to keep for tax or commercial law reasons, for example relating to a later contract, is deleted once those retention periods expire.

Job applications

If you apply through the form or by email, we process your details and documents to decide on an employment relationship. The legal basis is Art. 6(1)(b) GDPR. If we do not end up working together, we delete your documents after the process is complete, as soon as we no longer need them to defend against possible claims.

On the Software Audit page you can download a checklist as a PDF. To do so, you enter your email address. We receive the email address as a notification via Telegram (provider and non-EU transfer as described in Section 5). No email is sent to you and you are not subscribed to any newsletter.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is knowing who is interested in the audit so that we can get in touch if appropriate. You can object to this at any time.

At the bottom right of the website, you can ask a chat assistant questions. The answers are generated by a language model from Mistral AI SAS, Paris, France.

When you send a message, your browser sends it to our server together with the conversation so far. Our server forwards the text to Mistral and returns the answer. We do not pass your IP address on to Mistral. We do not store chat content on our server; the conversation exists only in your open browser window and is gone once you reload the page.

To prevent abuse, the server counts messages per IP address. This counter is kept only in the server's memory and is deleted after two hours at the latest.

Please do not enter sensitive data in the chat, such as passwords, health data or confidential business information. For a specific request, the contact form is the better choice.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is answering questions about our services outside office hours too. Using the chat is voluntary.

On some pages we show our location on a Google Maps map. The map only loads when you click "Load map". Before that, no request is sent to Google.

After you click, your browser loads the map directly from Google. Google receives, among other things, your IP address, the page you are viewing and information about your browser. Google may set cookies and may also process the data in the USA. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, is also involved. Google LLC is certified under the EU-US Data Privacy Framework.

The legal basis is the consent you give by clicking (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). It applies only to that page view. For details, see Google's privacy policy.

Matomo

We use the open source software Matomo to understand which pages are visited. Matomo runs on our own server (matomo.onveda.ai). The data is not sent to the maker of Matomo or to any other third party.

The Matomo script only loads once you have agreed to the "Statistics" category. Matomo then records visits and sets cookies (by default _pk_id for 13 months and _pk_ses for 30 minutes). It then records, among other things, your IP address, the pages you view, the time, the referrer, links you click to other websites, your browser, operating system and screen size.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

Google Analytics and Google Ads

We use Google Analytics 4 to evaluate how the website is used, and Google Ads conversion tracking to measure whether an ad led to an inquiry or a download. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google LLC in the USA is also involved; Google LLC is certified under the EU-US Data Privacy Framework.

The Google tag (gtag.js from googletagmanager.com) only loads once you have agreed to "Statistics" or "Marketing". Without consent, no request is sent to Google. We use Google Consent Mode to control the two separately: with "Statistics", only Google Analytics is active (with IP addresses shortened); with "Marketing", only Google Ads conversion tracking.

With your consent, Google sets cookies, records page views and interactions, and attributes contact form inquiries and downloads to an ad. Google may then also use this data for personalized advertising.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). For details, see Google's privacy policy.

Fonts and icons

The Inter and Archivo fonts and the Font Awesome icons are hosted on our own server. Loading a page does not send any request to Google Fonts or other providers.

Links to other websites

The website contains links to other services, such as LinkedIn, X (Twitter), Facebook, GitHub, Google Maps or ovenca.com. The share buttons in blog posts are plain links. Data is only sent to the respective provider when you click a link. From then on, that provider's privacy policy applies.

Data may be processed outside the EU in these cases:

• Google (USA): Google Maps after you click, Google Analytics and Google Ads with your consent, and our email mailbox. The basis is the European Commission's adequacy decision on the EU-US Data Privacy Framework.
• Telegram: notifications about contact inquiries and downloads. There is no adequacy decision for the country where the provider is based.

Our website is hosted at Hetzner in Germany. Mistral AI, the provider of the chat assistant, is based in France.

Where this policy does not state a specific period, we store personal data until the purpose no longer applies. If you withdraw consent or request deletion, we delete your data unless a statutory retention obligation applies, for example under commercial or tax law. In that case we restrict processing and delete the data once the period expires.

You are not obliged to provide us with any data. Without a name and email address, however, we cannot answer an inquiry submitted through the form. There is no automated decision-making or profiling within the meaning of Art. 22 GDPR.

You have the following rights with respect to us:

• Access to the data stored about you (Art. 15 GDPR)
• Correction of inaccurate data (Art. 16 GDPR)
• Deletion (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

To exercise these rights, write to kontakt@onveda.de or to the address in Section 1.

Right to object

Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). We will then stop processing the data unless we can demonstrate compelling legitimate grounds, or the processing serves to establish, exercise or defend legal claims. You may object to processing for direct marketing purposes without giving reasons (Art. 21(2) GDPR).

Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia)
Kavalleriestraße 2–4
40213 Düsseldorf, Germany
www.ldi.nrw.de

Last updated: October 2026. If the website or the services we use change, we will update this policy. The version published here applies.