Legal

Privacy policy

This English version is provided for convenience only; the German version is legally binding. We operate our website in accordance with the following principles:

We are committed to complying with the statutory data protection provisions and always endeavour to observe the principles of data avoidance and data minimisation.

‍

1. Name and address of the controller and the data protection officer

‍

a) The controller

The controller within the meaning of the General Data Protection Regulation (GDPR), other national data protection laws of the member states of the European Union and other data protection provisions is:

Vestiga Consulting GmbH
Reitmorstraße 50
80538 Munich, Germany
Phone: +49 89 125010901
Email: info@vestiga-consulting.de
Website: vestiga-consulting.de

‍

b) The data protection officer

You can contact the controller's data protection officer as follows:

SiDIT GmbH, www.sidit.de, Email: info@sidit.de

‍

2. Definitions

We have designed our privacy policy according to the principles of clarity and transparency. Should there nevertheless be any uncertainty regarding the use of certain terms, the relevant definitions can be found here.

‍

3. Legal basis for data processing

‍

a) Processing of personal data under the GDPR

We only process your personal data, such as your first and last name, your email address and IP address, where there is a legal basis for doing so. Under the GDPR, the following provisions in particular may apply:

  • Art. 6(1)(a) GDPR: The data subject has given consent to the processing of their personal data for one or more specific purposes.
  • Art. 6(1)(b) GDPR: Processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract.
  • Art. 6(1)(c) GDPR: Processing is necessary for compliance with a legal obligation to which the controller is subject.
  • Art. 6(1)(d) GDPR: Processing is necessary in order to protect the vital interests of the data subject or of another natural person.
  • Art. 6(1)(e) GDPR: Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
  • Art. 6(1)(f) GDPR: Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data,

in particular where the data subject is a child.

In the relevant sections of this privacy policy, we will always inform you again of the legal basis on which your personal data is processed.

‍

b) Consent of persons with parental responsibility pursuant to Art. 8(1) sentence 2 alt. 2 GDPR

A holder of parental responsibility must consent to all data processing on this website that requires the consent of a minor who has not yet reached the age of 16.

Information on the individual processing operations, their purposes and the categories of data concerned for which the data subject's consent is required can be found in this privacy policy.

You can withdraw your consent at any time by sending a declaration of withdrawal in text form to the controller's contact details. Processing carried out before the withdrawal remains lawful.

‍

c) Processing of information pursuant to Section 25(1) TDDDG

We also process information pursuant to Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) by storing information on your terminal equipment or accessing information already stored on it. This may include both personal information and non-personal data, e.g. cookies, browser fingerprints, advertising IDs, MAC addresses and IMEI numbers. Terminal equipment means any device directly or indirectly connected to the interface of a public telecommunications network for sending, processing or receiving messages, Section 2(2) no. 6 TDDDG.

As a rule, we process this information on the basis of your consent, Section 25(1) TDDDG.

Where an exception under Section 25(2) nos. 1 and 2 TDDDG applies, we do not require consent. Such an exception applies if we access or store the information solely in order to transmit a message over a public telecommunications network, or where this is strictly necessary for us to provide a digital service you have expressly requested. You can withdraw your consent at any time.

Please note that withdrawing your consent does not affect the lawfulness of processing carried out on the basis of that consent before its withdrawal.

‍

4. Disclosure of personal data

The disclosure of personal data is also a form of processing within the meaning of section 3 above. However, we would like to inform you separately here about disclosure to third parties. Protecting your personal data is very important to us. For this reason, we are particularly careful when it comes to passing your data on to third parties.

Data is therefore only disclosed to third parties where there is a legal basis for the processing. For example, we pass personal data on to persons or companies acting as processors on our behalf pursuant to Art. 28 GDPR. A processor is anyone who processes personal data on our behalf – in particular under our instructions and control.

In accordance with the requirements of the GDPR, we conclude a contract with each of our processors obliging them to comply with data protection regulations, thereby ensuring comprehensive protection of your data.

‍

5. Storage period and erasure

We erase your personal data as soon as it is no longer necessary for the purposes for which it was collected or otherwise processed, unless processing is required for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims.

‍

6. SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, such as enquiries you send to us as the website operator, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the browser's address bar changing from “http://” to “https://” and by the lock symbol in your browser bar.

When SSL/TLS encryption is activated, the data you transmit to us cannot be read by third parties.

‍

7. Collection and storage of personal data, and the nature and purpose of its use

‍

a) External hosting

Our website is hosted by Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA. For this reason, all personal data collected on our website is stored on our host's servers, unless an external third-party service is integrated. This may include IP addresses, email addresses, communication data and similar information. Details of the specific personal data concerned are provided below for each of the functions and services we describe. Where we use an external third-party service, this is made clear in the description of the respective service or tool.

The host processes your data only on our instructions and only to the extent necessary to provide the services on the website. The host does not process the data for its own purposes. We have concluded a data processing agreement with the host.

‍

b) When visiting the website

When you access our website, the browser used on your device automatically sends information to our website's server. This information is temporarily stored in a so-called log file. The following information is collected without any action on your part and stored until it is automatically deleted:

  • IP address of the requesting computer
  • Date and time of access
  • Name and URL of the file retrieved
  • Website from which access is made (referrer URL)
  • Browser used and, where applicable, your computer's operating system and the name of your access provider

We process this data for the following purposes:

  • Ensuring a smooth connection to the website
  • Ensuring convenient use of our website
  • Evaluating system security and stability
  • Error analysis
  • Other administrative purposes

Data that allows conclusions to be drawn about your identity, such as your IP address, is deleted after 7 days at the latest. If we store the data beyond this period, it is pseudonymised so that it can no longer be attributed to you.

The legal basis for this processing is Art. 6(1)(f) GDPR. Our legitimate interest follows from the purposes of data collection listed above. Under no circumstances do we use the collected data to draw conclusions about you personally.

‍

c) Amazon CloudFront

To deliver our website, we use the content delivery network Amazon CloudFront provided by Amazon Web Services, Inc., P.O. Box 81226, Seattle, WA 98108-1226, USA.

Amazon CloudFront allows us to deliver our content to visitors with lower latency and high data transfer rates. To do so, data from our website is duplicated on various Amazon servers around the world and made available there. When you access our content, you are routed to the location with the lowest latency so that we can deliver our content to you as efficiently as possible. Only if you visit the website from outside the EU will it be served from the nearest server outside the EU.

When content is retrieved from an Amazon server, data about your use of our website (e.g. IP address, browser information or similar) may be transmitted to Amazon.

The CDN is used on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR, namely in greater website reliability, increased protection against data loss and faster page loading.

We have concluded a data processing agreement and/or the Standard Contractual Clauses (SCC) with Amazon Web Services.

Further information on data protection when using Amazon CloudFront can be found at:
https://docs.aws.amazon.com/de_de/AmazonCloudFront/latest/DeveloperGuide/data-protection-summary.html

You can view the Amazon Web Services privacy notice here:

https://d1.awsstatic.com/legal/privacypolicy/AWS_Privacy_Notice_German_2023.06.30.pdf

‍

d) Contact form

We provide a form on our website so that you can contact us at any time. To use the contact form, you must provide a name so that we can address you personally and a valid email address for contacting you, so that we know who the enquiry is from and can process it.

If you send us enquiries via the contact form, the information you provide in the form, including your contact details and your IP address, is processed pursuant to Art. 6(1)(b) and (f) GDPR in order to take pre-contractual steps at your request or to pursue our legitimate interest, namely the conduct of our business.

Enquiries and the associated data are deleted no later than 3 months after receipt, unless they are required for a further contractual relationship.

‍

e) jQuery

We use the JavaScript library jQuery provided by the OpenJS Foundation (The OpenJS Foundation, 548 Market St. PMB 57274, San Francisco, CA 94104, USA) on our website. It is a collection of JavaScript programs and routines offering versatile solutions to common problems.

The JavaScript routines are provided and downloaded via a connection to servers in the USA.

Accordingly, it cannot be ruled out that the IP addresses of our website visitors are processed by jQuery.

jQuery is used on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR, namely to ensure the functionality of the website and to be able to restore it as quickly and easily as possible if problems occur.

We have concluded a data processing agreement and/or the Standard Contractual Clauses (SCC) with jQuery.

Further information on jQuery's data protection can be found at:
https://images.prismic.io/openjsf/ba00b254-685f-4e54-b1ca-17984b0f3e55_OpenJS-Foundation-Privacy-Policy-2019-11-15.pdf

‍

f) OpenStreetMap

Our website embeds a map from the OpenStreetMap service to show you our location. The map data is provided by the OpenStreetMap Foundation (OSMF), St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom.

The map is only loaded once you reach the part of the page where it is displayed. The map tiles are then retrieved from OSMF servers, and your IP address and technical information such as browser type and the date and time of access are transmitted to the OSMF. The map does not set any cookies.

The map is used on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR in presenting our location attractively and making our office easy to find. The European Commission has issued an adequacy decision for the United Kingdom.

If you click “Plan route” in the map window, you will be redirected to Google Maps. Only then is data transmitted to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Further information on data protection at OpenStreetMap can be found at: https://osmfoundation.org/wiki/Privacy_Policy

‍

8. Rights of the data subject

You have the following rights:

‍

a) Access

Pursuant to Art. 15 GDPR, you have the right to request information about your personal data processed by us. This right of access includes information about

  • the purposes of processing
  • the categories of personal data
  • the recipients or categories of recipients to whom your data has been or will be disclosed
  • the planned storage period or at least the criteria for determining it
  • the existence of a right to rectification, erasure, restriction of processing or objection
  • the existence of a right to lodge a complaint with a supervisory authority
  • the source of your personal data, where it was not collected from you
  • the existence of automated decision-making, including profiling, and, where applicable, meaningful information about its details

‍

b) Rectification

Pursuant to Art. 16 GDPR, you have the right to the immediate rectification of inaccurate or incomplete personal data stored by us.

‍

c) Erasure

Pursuant to Art. 17 GDPR, you have the right to request the immediate erasure of your personal data held by us, unless further processing is necessary for one of the following reasons:

  • the personal data is still necessary for the purposes for which it was collected or otherwise processed
  • for exercising the right of freedom of expression and information
  • for compliance with a legal obligation which requires processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
  • for reasons of public interest in the area of public health in accordance with Art. 9(2)(h) and (i) and Art. 9(3) GDPR
  • for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89(1) GDPR, insofar as the right referred to in section a) is likely to render impossible or seriously impair the achievement of the objectives of that processing
  • for the establishment, exercise or defence of legal claims

‍

d) Restriction of processing

Pursuant to Art. 18 GDPR, you may request the restriction of the processing of your personal data for one of the following reasons:

  • You contest the accuracy of your personal data.
  • The processing is unlawful and you oppose the erasure of the personal data.
  • We no longer need the personal data for the purposes of processing, but you require it for the establishment, exercise or defence of legal claims.
  • You have objected to processing pursuant to Art. 21(1) GDPR.

‍

e) Notification

If you have requested the rectification or erasure of your personal data or a restriction of processing pursuant to Art. 16, Art. 17 or Art. 18 GDPR, we will communicate this to all recipients to whom your personal data has been disclosed, unless this proves impossible or involves disproportionate effort. You may ask us to inform you about these recipients.

‍

f) Data portability

You have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format.

You also have the right to request that this data be transmitted to a third party, provided that the processing is carried out by automated means and is based on consent pursuant to Art. 6(1)(a) or Art. 9(2)(a) GDPR or on a contract pursuant to Art. 6(1)(b) GDPR.

‍

g) Withdrawal of consent

Pursuant to Art. 7(3) GDPR, you have the right to withdraw your consent at any time. Withdrawing your consent does not affect the lawfulness of processing carried out on the basis of that consent before its withdrawal. We may no longer continue any data processing that was based on the consent you have withdrawn.

‍

h) Complaint

Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data infringes the GDPR.

‍

i) Objection

Where your personal data is processed on the basis of legitimate interests pursuant to Art. 6(1)(f) GDPR, you have the right under Art. 21 GDPR to object to the processing of your personal data on grounds relating to your particular situation, or where the objection relates to direct marketing. In the latter case, you have a general right to object, which we will implement without you having to specify a particular situation. If you wish to exercise your right of withdrawal or objection, an email to info@vestiga-consulting.de is sufficient.

‍

j) Automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision

  • is necessary for entering into or performing a contract between you and us
  • is authorised by Union or Member State law to which we are subject and which lays down suitable measures to safeguard your rights and freedoms and legitimate interests
  • is based on your explicit consent

However, such decisions may not be based on special categories of personal data under Art. 9(1) GDPR, unless Art. 9(2)(a) or (g) GDPR applies and suitable measures have been taken to safeguard your rights and freedoms and legitimate interests.

In the cases referred to in (i) and (iii), we take suitable measures to safeguard your rights and freedoms and legitimate interests, including at least the right to obtain human intervention on our part, to express your point of view and to contest the decision.

‍

9. Changes to this privacy policy

If we change this privacy policy, this will be indicated on the website.


Last updated: 6 November 2026

‍

Created on 22 October 2026 based on template privacy policy v58.