Privacy Policy

1. Controller

The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) is:

Data protection officer

A data protection officer has not been appointed, as the statutory requirements for a mandatory appointment are currently not met. For any data protection enquiries, please use the contact details above.

2. General information & legal bases

We process personal data of our users only insofar as this is necessary to provide a functional website as well as our content and services. Processing generally takes place only with the user's consent or where processing is permitted by statutory provisions.

The legal bases for processing include in particular:

• Art. 6(1)(a) GDPR - consent of the data subject.
• Art. 6(1)(b) GDPR - processing for the performance of a contract or to take pre-contractual steps.
• Art. 6(1)(c) GDPR - processing to comply with a legal obligation.
• Art. 6(1)(f) GDPR - processing to protect legitimate interests, provided the interests or fundamental rights of the data subject do not override these.

3. Hosting & provision of the website

This website is operated as a static website on our own servers located in Germany (server administration via the Plesk hosting platform). Personal data collected on this website (e.g. server log files, contact form enquiries) is processed exclusively on servers in Germany.

Operating the website serves the purpose of a secure, fast, and reliable provision of our online presence (Art. 6(1)(f) GDPR). Where consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR.

Where a data centre service provider is used for server operation, this is done on the basis of a data processing agreement (DPA) pursuant to Art. 28 GDPR.

4. Server log files

Each time the website is accessed, the web server automatically collects information that your browser transmits, in so-called server log files. These are typically:

• IP address of the requesting device
• date and time of access
• name and URL of the file accessed
• website from which access was made (referrer URL)
• browser used and, where applicable, the operating system of your device
• HTTP status code and the volume of data transferred

This data is processed on the basis of Art. 6(1)(f) GDPR. We have a legitimate interest in the technically error-free presentation and security of our website and in defending against attacks. We do not merge this data with other data sources to identify individual persons.

5. Contact form

If you send us an enquiry via the contact form, the data you provide in the form is processed. This includes:

• name
• business email address
• company (if provided)
• country
• content of your message

This data is processed to handle your enquiry and for the purpose of any follow-up questions. The legal basis is Art. 6(1)(b) GDPR where your enquiry is aimed at concluding or performing a contract; otherwise Art. 6(1)(f) GDPR based on our legitimate interest in responding to enquiries.

The form submission is processed on our own server in Germany and forwarded by email to our mailbox (kontakt@cortavion.de). No external form service providers are involved. The data transmitted is stored until you request its deletion, withdraw your consent, or the purpose of storage no longer applies. Mandatory statutory retention periods remain unaffected.

Cookies and consent banner

This website does not use any tracking or analytics cookies. On your first visit, a consent banner is displayed through which you can consent to, or decline, the loading of external web fonts (see section 6). Your choice and your display preference (light/dark theme) are stored exclusively in your browser's local storage and are not transmitted to us or to third parties. The storage of these technically necessary settings is based on Section 25(2) no. 2 of the German TDDDG and Art. 6(1)(f) GDPR.

6. Web fonts (Google Fonts)

This website uses so-called web fonts provided by Google for the uniform display of fonts. On the main pages, these fonts are only loaded after you have given your consent via the consent banner. When loaded, your browser establishes a connection to Google's servers, by which Google becomes aware that our website has been accessed via your IP address.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG); otherwise Art. 6(1)(f) GDPR based on our legitimate interest in a uniform presentation of our online presence. You may withdraw your consent at any time with effect for the future by deleting the consent setting in your browser's local storage.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

7. Recipients & transfers to third countries

Your personal data is only transferred to third parties insofar as this is legally permitted or you have consented. Recipients may in particular be processors who support us in providing the website (e.g. the hosting provider).

Where data is transferred to service providers based in the USA or other third countries outside the EU/EEA, this is only done provided an adequate level of data protection is ensured. This may be ensured in particular by the recipient's certification under the EU-US Data Privacy Framework or by concluding the EU Standard Contractual Clauses (Art. 46 GDPR).

This website is hosted on servers in Germany; no transfer to third countries takes place in this respect. Only the consent-based loading of Google Fonts (section 6) may involve a transfer to servers of the Google group of companies; Google LLC is certified under the EU-US Data Privacy Framework.

8. Retention period

We process and store personal data only for the period necessary to achieve the respective processing purpose, or where this is provided for by statutory retention obligations. Once the purpose ceases to apply or the periods expire, the data is routinely deleted or blocked.

• Server log files: generally deleted after 14 days at the latest.
• Contact form enquiries: until your enquiry has been fully processed and any statutory retention periods have expired.

9. Your rights as a data subject

With regard to the personal data concerning you, you have the following rights:

• Access (Art. 15 GDPR) - you may request information about the data processed concerning you.
• Rectification (Art. 16 GDPR) - you may request the correction of inaccurate data or the completion of your data.
• Erasure (Art. 17 GDPR) - you may request the deletion of your data, provided the statutory conditions are met.
• Restriction of processing (Art. 18 GDPR) - you may request the restriction of processing.
• Data portability (Art. 20 GDPR) - you may request to receive your data in a structured, commonly used, and machine-readable format.
• Withdrawal of consent (Art. 7(3) GDPR) - you may withdraw consent given at any time with effect for the future.

Right to object (Art. 21 GDPR)

Insofar as we process personal data on the basis of legitimate interests pursuant to Art. 6(1)(f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation. Please address any such objection to the contact details of the controller stated above.

10. Right to lodge a complaint

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes the GDPR.

The competent authority is generally the supervisory authority of the federal state in which the company has its registered office.

The Hessian Commissioner for Data Protection and Freedom of Information (HBDI), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany, https://datenschutz.hessen.de

11. Data security

We take appropriate technical and organisational measures to protect your personal data against accidental or intentional manipulation, loss, destruction, or access by unauthorised persons. Data is transmitted on this website in encrypted form using the TLS protocol (recognisable by "https" in your browser's address bar).

Our security measures are continuously reviewed and adapted in line with technological developments.

12. Changes to this privacy policy

We reserve the right to amend this privacy policy so that it always complies with current legal requirements, or to implement changes to our services in the privacy policy. The new privacy policy will then apply to your next visit.

Last updated: August 2026