Skip to content

Privacy policy

Controller

Aviando GmbH
Römerstraße 245
69126 Heidelberg
Germany
Email: hallo@aviando.io

Data protection officer

The external data protection officer of Aviando GmbH is Lutz Wehner. You can reach him and our privacy team at datenschutz@aviando.io.

Definitions

This policy uses the terms of the GDPR. Personal data is any information relating to an identified or identifiable natural person. Processing is any operation performed on such data, such as collecting, storing, using, transmitting or erasing it. The controller is whoever determines the purposes and means of processing. A processor processes data on the controller's behalf. A third party is neither the data subject, nor the controller, nor a processor. Consent is your freely given, informed and unambiguous agreement to a specific processing operation.

Legal bases at a glance

We only process personal data on one of the following bases. Each processing operation below states which one applies.

Section 25 TDDDG applies in addition to storing information on your device and accessing it.

Hosting

This site is operated by Novosky (owner Lucas Teichmann, Mainz, Germany) as the technical service provider and hosted in the Microsoft Azure region Germany West Central (Frankfurt am Main; Microsoft Ireland Operations Ltd.). Processing on our behalf is safeguarded by agreements under Art. 28 GDPR.

Access data / server logs

When you access this site, the following data is recorded in server logs:

Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in operational security and attack detection). Retention: 30 days in health logs, 90 days in security logs.

Contact

When you reach out by email, we process the data you submit to respond to your request and any follow-up. Legal basis: Art. 6 (1)(b) GDPR (initiation of a contractual relationship) or (f) (legitimate interest in responding). We keep your enquiry until it has been dealt with conclusively and no further questions are expected. After that we erase the data, unless statutory retention periods apply (see "Retention and erasure").

Meeting bookings

You can book meetings via booking links to Google Calendar (Google Ireland Ltd.). When you open a booking link and book a slot, the data required for scheduling (name, email address, preferred time, optional message) is transmitted directly to Google and processed there. Using the links is voluntary - you can always reach us by email instead. Legal basis: Art. 6 (1)(b) GDPR (initiating an appointment). Data may be transferred to the United States; Google is certified under the EU-US Data Privacy Framework. More at policies.google.com/privacy.

Applications and speculative applications

For applications, our careers page and the "Speculative application" page link to a form provided by Jotform (Jotform Inc., 4 Embarcadero Center, San Francisco, CA 94111, USA). The form is not embedded in our website; it opens at Jotform in a new tab. Your data is transmitted only there, and only when you submit it.

We process the application data you provide, in particular your name, contact details and the content and attachments of your application (such as cover letter, CV and references). The purpose is to conduct the application procedure. Legal basis: Section 26 (1) BDSG in conjunction with Art. 88 GDPR (decision on entering into an employment relationship) and Art. 6 (1)(b) GDPR. If you voluntarily provide special categories of personal data, processing is based on Art. 9 (2)(b) GDPR or on your consent.

Data may be transferred to the United States on the basis of the EU Standard Contractual Clauses (SCC). Once the procedure has concluded we erase application documents no later than six months after a rejection, unless you have agreed to longer storage or statutory retention obligations apply. Using the form is voluntary - you can always apply by email instead. More at jotform.com/privacy.

Cookies and consent management

On your first visit, we show a cookie banner and obtain your consent for three categories separately:

Your consent selection is stored only locally in your browser (LocalStorage key aviando_consent).

Reach measurement (Google Analytics 4)

We use Google Analytics 4 (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) for reach measurement - but only if you have consented to the "Statistics" category. Processed data: truncated IP address, referrer, viewed pages, dwell time, device / browser used, approximate city-level location. We use neither demographic reports nor cross-device tracking and have reduced data retention to the legal minimum. Google processes this data on our behalf under the Google Ads Data Processing Terms (processing under Art. 28 GDPR). More at policies.google.com/privacy.

Google Maps

On the Contact page we embed Google Maps for our Düsseldorf and Cologne offices - but only after your consent (cookie category "Marketing" or per-map via "Show map"). Provider: Google Ireland Ltd. Processed data: IP address, cookies, browser information, and - if you have granted location access in your browser - location data. Legal basis: Art. 6 (1)(a) GDPR in conjunction with Sec. 25 (1) German TDDDG. Google's privacy notice: policies.google.com/privacy.

YouTube videos

On some pages we embed videos hosted on YouTube. No connection to YouTube is established when the page loads; you first see a preview area only. The player is loaded once you click it and have agreed to external content being loaded (cookie category "Marketing" or via "Load video"). We use YouTube's privacy-enhanced mode (youtube-nocookie.com). During playback YouTube processes, among other things, your IP address, browser information and data about your use of the player; if your browser is signed in to Google, Google may link the playback to your account. Provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland; a transfer to Google LLC in the USA is possible (Data Privacy Framework, see "Transfers to third countries"). Legal basis: Art. 6 (1)(a) GDPR in conjunction with Sec. 25 (1) German TDDDG; you can withdraw your consent at any time via the cookie settings. Google's privacy notice: policies.google.com/privacy.

Salesforce / Pardot (Marketing Cloud Account Engagement)

Aviando uses Salesforce (Salesforce, Inc., Salesforce Tower, 415 Mission Street, San Francisco, CA 94105, USA, or its EU subsidiary) as its CRM system and Salesforce Marketing Cloud Account Engagement (Pardot) to process enquiries. When you submit our contact form, the data you provide (first name, last name, email address, company, phone number, topic and your message) is sent to Salesforce and stored there to handle your request. Data transfers to the US take place under the EU-US Data Privacy Framework and EU Standard Contractual Clauses (SCCs) with additional safeguards. Legal basis: Art. 6 (1)(b) GDPR (contractual onboarding) and Art. 6 (1)(f) GDPR (legitimate interest in efficient enquiry and CRM management). More at salesforce.com/company/privacy.

Spam protection (Cloudflare Turnstile)

Our contact form is protected against automated submissions (bots, spam) by Cloudflare Turnstile. When you submit the form, a verification request is sent to Cloudflare (Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA); it processes in particular your IP address and technical information about your browser and device to assess whether the request comes from a human. Turnstile works without tracking cookies and does not use the data for advertising. Data transfers to the US take place under the EU-US Data Privacy Framework and EU Standard Contractual Clauses (SCCs). Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in protection against spam and abuse). More at cloudflare.com/privacypolicy.

Other services

Should additional services be added in the future (e.g. embedded videos, booking widgets, newsletter providers), this privacy notice will be updated accordingly. We will inform you on the website about all material changes.

External fonts

This website uses the Poppins and Roboto typefaces. The font files are served from our own server (self-hosted); loading them establishes no connection to Google or any other third party and transmits no data to them.

Recipients of your data

Besides the services named individually above, your data may reach the following categories of recipient:

Processing on our behalf

Where external providers process personal data on our behalf, they do so under a contract pursuant to Art. 28 GDPR. They are bound by our instructions, obliged to maintain confidentiality, and may not use the data for their own purposes. We select them carefully and review their technical and organisational measures.

Transfers to third countries

Some of the services named above may process data outside the European Economic Area, in particular in the United States. Third countries may not offer a level of data protection comparable to the EU. A transfer therefore only takes place where one of the following safeguards is in place: an adequacy decision by the European Commission (such as the EU-US Data Privacy Framework for certified US companies), EU Standard Contractual Clauses, binding corporate rules, or a recognised certification. Each service above states which safeguard its transfer relies on.

Retention and erasure

We store personal data only for as long as it is needed for the respective purpose. Each processing operation above states the period where it can be named concretely. Once the purpose ceases to apply, the data is erased. This does not apply where statutory retention periods exist, in particular under Section 257 HGB and Section 147 AO (regularly six and ten years respectively). In those cases the data is blocked from further use and erased once the period expires.

Data security

We take technical and organisational measures reflecting the state of the art to protect your data against loss, destruction, access, alteration or unauthorised disclosure. This website is transmitted entirely encrypted via TLS. Our measures are reviewed continuously and adapted to technical developments.

No obligation to provide data

Entering into a contract with us does not depend on you providing personal data beyond what is legally or contractually required. Without certain details, however, we may be unable to deliver individual services, or able to do so only in part - without an email address we cannot answer an enquiry, for example. Where a detail is required, we indicate this in the relevant form.

No automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR. No decisions are taken based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

Statutory disclosure obligations

We may be required to transmit personal data to public authorities, law enforcement or supervisory bodies where this is prescribed by law or becomes necessary to pursue legal claims. The legal basis in those cases is Art. 6 (1)(c) GDPR.

Your rights

Under GDPR you have the right to information (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Where processing is based on your consent, you may withdraw it at any time with effect for the future (Art. 7 (3) GDPR); the lawfulness of processing carried out until then remains unaffected. The easiest way to withdraw consent for statistics and marketing is the "Cookie settings" link in the footer. Send requests to the email address above.

Independently of this, Art. 77 GDPR gives you the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data, for example with the authority competent for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg), Heilbronner Straße 35, 70191 Stuttgart, Germany, PO box: Postfach 10 29 32, 70025 Stuttgart, email: poststelle@lfdi.bwl.de, www.baden-wuerttemberg.datenschutz.de.

Changes to this privacy policy

We update this privacy policy whenever the processing changes, for example because a service is added or removed, or where a change in the law requires it. The version published on this page is the one that applies.

Last updated: September 2026