Privacy Policy

01. Controller and Scope

The controller responsible for processing your personal data within the meaning of Art. 4(7) GDPR is:

This Privacy Policy applies to all websites of the Axiora Vision group: www.axioravision.com, it.axioravision.com, consulting.axioravision.com and cybersecurity.axioravision.com (together, the “Website”). Axiora Vision offers IT services, integrated consulting (including cost & commercial management and environmental studies) and cybersecurity services.

Further details about the provider can be found in our Impressum (Legal Notice).

02. Data Protection Officer

You can contact our data protection officer at: [Name of the data protection officer or “Data Protection Officer”], [postal address, if different from the address above], [email address, e.g. privacy@axioravision.com].

Before publishing, add the contact details of the data protection officer if one has been appointed (in Germany this is mandatory, for example, where at least 20 persons are regularly involved in the automated processing of personal data, § 38 BDSG). If no data protection officer has been appointed, delete this section; questions about data protection can then be sent to info@axioravision.com.

03. Hosting and Server Log Files

Our Website is hosted by Netlify, Inc., San Francisco, California, USA (“Netlify”), which acts as our processor under a data processing agreement pursuant to Art. 28 GDPR. Netlify delivers the pages through a global content delivery network.

Each time you open a page, your browser automatically transmits the following data, which are recorded in server log files:

• IP address of the requesting device
• Date and time of the request
• Address (URL) of the page or file requested
• Referrer URL (the page from which you came, if transmitted by your browser)
• User agent (browser type and version, operating system)

We process these data to deliver the Website, to ensure its stability and security, and to detect and defend against attacks and misuse. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and error-free provision of the Website. The data are not combined with other data sources and are not used to identify individual visitors.

As Netlify is based in the USA, data may be transferred to the USA. The transfer is based on the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR) where the recipient is certified under it, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Log data are deleted after [retention period for log files, e.g. 30 days] at the latest, unless their further retention is required to investigate a specific security incident; in that case they are deleted once the incident has been resolved.

04. Contact Form and Email Enquiries

You can send us an enquiry using the contact form on our Website. The form contains the following fields:

• Full name (optional)
• Company name (optional)
• Email address (required)
• Service required (required, selected from a list)
• Project budget (optional, selected from a list of ranges)
• Project details (required, free text)

The form also contains a hidden field that must remain empty. It is used only to detect automated spam submissions and does not collect any personal data.

When you submit the form, your entries are transmitted over an encrypted connection to our hosting provider Netlify (section 03) and stored in Netlify's form service, which only authorised members of our team can access. Together with your entries, the website sends the website and page from which you submitted the form and your approximate location (city, region and country), which Netlify derives from your IP address. Netlify also records technical data of the submission, such as the time, your IP address and your browser's user agent, to deliver the service and filter spam. We use the approximate location to forward your enquiry to the right regional team; the legal basis is Art. 6(1)(f) GDPR, our legitimate interest in handling enquiries efficiently.

[Only if the Google Sheet is used:] Netlify then forwards your enquiry, including the technical data, over an encrypted connection to a Google Apps Script web application, which stores your entries, the website, page and approximate location (but not your IP address) in a Google Sheets spreadsheet that only authorised members of our team can access. The service provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which acts as our processor under a data processing agreement (Art. 28 GDPR). Data may be processed by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; this transfer is based on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and, in addition, on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

If the form cannot be transmitted in this way, it opens the email program on your device with a pre-filled message to info@axioravision.com instead. Nothing is sent until you send that email yourself. You can also write to us directly by email at any time.

Emails are received and stored through our email service provider [name and registered office of the email provider], which acts as our processor (Art. 28 GDPR).

We use the data you provide solely to handle your enquiry and any follow-up questions. Where your enquiry relates to the performance of a contract or to steps prior to entering into a contract, the legal basis is Art. 6(1)(b) GDPR. In all other cases, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in responding effectively to enquiries addressed to us.

Please do not include confidential, security-sensitive or special categories of personal data (for example, health data) in the form or in unencrypted emails.

If your enquiry does not lead to a contract, we delete the data [retention period for enquiries, e.g. 6 months] after your enquiry has been completed. If a contract is concluded, or if the correspondence must be retained as a commercial or tax record, we store it for the statutory retention periods (generally 6 years for business correspondence under § 257 of the German Commercial Code (HGB) and up to 10 years for accounting records under § 147 of the German Fiscal Code (AO)) and then delete it.

05. No Cookies, No Tracking

Our Website does not use cookies, local storage or similar technologies, and it does not store or access any information on your device beyond what is strictly necessary to display the pages you request (§ 25(2) of the German Telecommunications Digital Services Data Protection Act, TDDDG). For this reason, we do not ask for consent and do not show a cookie banner.

We do not use web analytics, tracking pixels, advertising networks or social media plugins, and we do not create user profiles.

All fonts are hosted on our own Website. When you visit, no connection is made to Google Fonts or any other external font or content service.

If we introduce technologies that require your consent in the future, we will ask for your consent beforehand and update this Privacy Policy.

06. Recipients of Personal Data

Within our organisation, only the team members who need your data to handle your enquiry have access to it. We do not sell personal data. Personal data may be disclosed to the following recipients:

• Processors who support us under data processing agreements: Netlify (hosting and contact form, sections 03 and 04), Google (contact form, if used, section 04) and our email service provider (section 04)
• Other companies or offices of the Axiora Vision group, where your enquiry concerns a service they provide (Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR, based on our legitimate interest in forwarding enquiries to the responsible team)
• Professional advisers such as lawyers, auditors and tax advisers, who are bound by professional secrecy, where this is necessary
• Public authorities and courts, where we are legally obliged to disclose data (Art. 6(1)(c) GDPR)

07. International Data Transfers

Transfers to Netlify and Google in the USA are described in sections 03 and 04.

The Axiora Vision group also has offices outside the European Union and the European Economic Area, in Saudi Arabia, India and the Philippines. The European Commission has not adopted an adequacy decision for these countries. If we share your enquiry with one of these offices, we do so only where necessary to handle your enquiry and on the basis of the EU Standard Contractual Clauses concluded within the group (Art. 46(2)(c) GDPR), supplemented by additional safeguards where required.

You can request a copy of the appropriate safeguards by contacting us at info@axioravision.com.

Before publishing, confirm that Standard Contractual Clauses have been concluded between the group companies before any enquiry data are shared with the offices outside the EU, or delete the second paragraph of this section if enquiries are never shared with them.

08. Retention Periods

We store personal data only for as long as necessary for the purposes described in this Privacy Policy, or as long as statutory retention obligations require. In summary:

• Server log files: deleted after [retention period for log files, e.g. 30 days] at the latest (section 03)
• Enquiries that do not lead to a contract: deleted [retention period for enquiries, e.g. 6 months] after completion (section 04)
• Correspondence and records that must be retained for commercial or tax purposes: 6 to 10 years under § 257 HGB and § 147 AO

Once the purpose no longer applies and no retention obligation exists, the data are deleted or anonymised.

09. Your Rights

Under the GDPR, you have the following rights with regard to your personal data:

• Right of access to your personal data and to information about how they are processed (Art. 15 GDPR)
• Right to rectification of inaccurate or incomplete data (Art. 16 GDPR)
• Right to erasure of your data (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR, see section 10)

Where processing is based on your consent (Art. 6(1)(a) GDPR), you can withdraw your consent at any time with effect for the future (Art. 7(3) GDPR). The withdrawal does not affect the lawfulness of processing carried out before it.

To exercise your rights, simply contact us at info@axioravision.com. We may ask you to verify your identity before responding to your request.

10. Right to Object

11. Right to Lodge a Complaint

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement.

The supervisory authority responsible for us is: [name and address of the competent data protection supervisory authority, e.g. the data protection authority of the federal state in which the company has its registered office].

12. Provision of Data and Automated Decision-Making

You are neither legally nor contractually obliged to provide personal data to us. The processing of server log data is technically necessary to display the Website. If you do not complete the required fields of the contact form (email address, service required and project details), we cannot process your enquiry through the form; you can contact us by email instead.

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

13. Data Security

All pages of our Website and all contact form submissions are transmitted using TLS encryption (HTTPS). You can recognise an encrypted connection by the padlock symbol and the “https://” prefix in your browser’s address bar.

We also take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access, and we review these measures regularly. Please note that ordinary emails are generally not encrypted end to end.

14. Links to Other Websites

The four Axiora Vision domains (www.axioravision.com, it.axioravision.com, consulting.axioravision.com and cybersecurity.axioravision.com) are all covered by this Privacy Policy.

Our Website may also contain links to websites of third parties. When you follow such a link, the operator of that website is responsible for processing your data. Please refer to the privacy policy of the respective website.

15. Changes to This Privacy Policy

We may update this Privacy Policy if our Website, our services or the legal requirements change. The current version is always available on this page; the date of the last update is shown at the top.

16. Contact Us

If you have any questions about this Privacy Policy or about how we process your personal data, please contact: