Skip to content

Privacy policy

Welcome to Validatis GmbH. Here you can find out more about how we process your personal data.

Data protection is a matter of trust, and your trust is very important to us. We respect your privacy and your personal rights. Protecting personal data and collecting, processing and using it in compliance with the law are therefore important concerns for us.

1. Scope, name and address of the controller

This privacy policy applies to the use of our website and to any other processing of the data subject's personal data. The controller within the meaning of the General Data Protection Regulation (hereinafter GDPR), other national data protection laws of the member states and other data protection provisions is:

Validatis GmbH
Amsterdamer Straße 192
50735 Cologne
Germany

Phone: +49 221 98 2324-0
Email: dsb(at)validatis.de

2. Contact details of the data protection officer

You can request information about the personal data we hold about you at any time. You have the right to have inaccurate personal data about you corrected. You can also withdraw your consent to the controller collecting and storing your personal data at any time. In these cases, please send an email to

Validatis GmbH
Data Protection Officer Norman Höhling
Amsterdamer Straße 192
50735 Cologne
Germany

Email: dsb(at)validatis.de

You can find more information about us in our legal notice.

3. General information on data processing

3.1. Scope of the processing of personal data

We need your personal data for a wide range of purposes. We process your data to initiate and carry out our business relationship and because of regulatory requirements in whose implementation we are involved. This data includes information such as names, addresses or telephone numbers. Information we process about you:

Basic information

  • Surname
  • First name
  • Gender
  • Nationality

Contact details

  • Postal address
  • Telephone number
  • Email address

Other customer master data

  • Company master data (commercial register details, company name, company address, VAT ID)

Where we obtain the data subject's consent for processing operations involving personal data, Art. 6(1)(a) GDPR serves as the legal basis.

Where personal data is processed because this is necessary for the performance of a contract to which the data subject is party, Art. 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations that are necessary to take steps prior to entering into a contract.

Where processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Art. 6(1)(1)(c) GDPR serves as the legal basis.

Where processing of personal data is necessary to protect the vital interests of the data subject or of another natural person, Art. 6(1)(1)(d) GDPR serves as the legal basis.

Where we obtain personal data for our databases from publicly accessible sources, Art. 6(1)(f) GDPR serves as the legal basis. Publicly accessible sources include public registers and official announcements (for example in the commercial register), other generally accessible sources (for example press publications or announcements on the internet) and contractual and cooperation partners, including address brokers.

3.3. Erasure of data and storage period

The data subject's personal data is erased or blocked as soon as the purpose of storage no longer applies. Data may also be stored beyond this if this is provided for by the European or national legislator in EU regulations, laws or other provisions to which the controller is subject. The data is also blocked or erased when a storage period prescribed by these provisions expires, unless further storage of the data is necessary for the conclusion or performance of a contract.

4. Your rights as a data subject

If your personal data is processed, you are a data subject within the meaning of the GDPR and have the following rights against us:

4.1. Right of access

You can ask us to confirm whether we process personal data concerning you. If we do, you can request information about the following:

  1. the purposes for which the personal data is processed;
  2. the categories of personal data that are processed;
  3. the recipients or categories of recipients to whom the personal data concerning you has been or will be disclosed;
  4. the planned period for which the personal data concerning you will be stored or, if specific information on this is not possible, the criteria used to determine the storage period;
  5. the existence of a right to rectification or erasure of the personal data concerning you, a right to restriction of processing by the controller or a right to object to such processing;
  6. the existence of a right to lodge a complaint with a supervisory authority;
  7. all available information about the source of the data if the personal data is not collected from the data subject;
  8. the existence of automated decision-making, including profiling, in accordance with Art. 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved and the significance and envisaged consequences of such processing for the data subject.

You have the right to request information on whether the personal data concerning you is transferred to a third country or to an international organisation. In this context, you can request to be informed of the appropriate safeguards pursuant to Art. 46 GDPR relating to the transfer.

4.2. Right to rectification

You have the right to rectification and/or completion if the personal data concerning you that is processed is inaccurate or incomplete. We will make the rectification without undue delay.

4.3. Right to restriction of processing

You can request the restriction of processing of the personal data concerning you under the following conditions:

  1. if you contest the accuracy of the personal data concerning you, for a period enabling us to verify the accuracy of the personal data;
  2. the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead;
  3. we no longer need the personal data for the purposes of the processing, but you need it for the establishment, exercise or defence of legal claims; or
  4. if you have objected to the processing pursuant to Art. 21(1) GDPR and it has not yet been established whether our legitimate grounds override yours.

Where processing of the personal data concerning you has been restricted, this data may, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a member state.

4.4. Right to erasure

4.4.1. Obligation to erase

You can request that the personal data concerning you be erased without undue delay where one of the following grounds applies:

  1. The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed.
  2. You withdraw the consent on which the processing was based pursuant to Art. 6(1)(1)(a) or Art. 9(2)(a) GDPR, and there is no other legal basis for the processing.
  3. You object to the processing pursuant to Art. 21(1) GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21(2) GDPR.
  4. The personal data concerning you has been unlawfully processed.
  5. The personal data concerning you must be erased for compliance with a legal obligation under Union or member state law to which the controller is subject.
  6. The personal data concerning you has been collected in relation to the offer of information society services referred to in Art. 8(1) GDPR.
4.4.2. Exceptions

The right to erasure does not apply to the extent that processing is necessary

  1. for exercising the right of freedom of expression and information;
  2. for compliance with a legal obligation to which we are subject under Union or member state law, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in us;
  3. for reasons of public interest in the area of public health in accordance with Art. 9(2)(h) and (i) and Art. 9(3) GDPR;
  4. for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89(1) GDPR, in so far as the right referred to in section a) is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
  5. for the establishment, exercise or defence of legal claims.

4.5. Right to data portability

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller to whom the personal data has been provided, where

  1. the processing is based on consent pursuant to Art. 6(1)(1)(a) GDPR or Art. 9(2)(a) GDPR or on a contract pursuant to Art. 6(1)(1)(b) GDPR, and
  2. the processing is carried out by automated means.

In exercising this right, you also have the right to have the personal data concerning you transmitted directly from one controller to another, where technically feasible. This must not adversely affect the rights and freedoms of others.

The right to data portability does not apply to processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

4.6. Right to object

You have the right to object to the processing of personal data concerning you that is based on Art. 6(1)(1)(e) or (f) GDPR. In this case, we will no longer process the personal data concerning you unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

You have the right to withdraw your consent under data protection law at any time. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.

Please note that you can withdraw any consent you have given at any time, also in part, with effect for the future.

The best way to do this is by email to:

Validatis GmbH
Data Protection Officer
Amsterdamer Straße 192
50735 Cologne

Email: dsb(at)validatis.de

4.8. Automated individual decision-making

You have the right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision

  1. is necessary for entering into, or performance of, a contract between you and the controller,
  2. is authorised by Union or member state law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests, or
  3. is based on your explicit consent.

However, these decisions must not be based on special categories of personal data referred to in Art. 9(1) GDPR, unless Art. 9(2)(a) or (b) GDPR applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place.

In the cases referred to in (1) and (3), the controller implements suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.

4.9. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

The supervisory authority with which the complaint has been lodged informs the complainant of the progress and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

5. Contract data

Your personal data, where it is necessary for establishing, shaping the content of or changing the contractual relationship (contract data), is used exclusively for processing the contract.

For example, to bill paid services, your name and address must be passed on to the billing service provider. Without your express consent or a legal basis, your personal data will not be passed on to third parties outside the processing of the contract.

On the order of the competent authorities, we may in individual cases provide information about contract data where this is necessary for the purposes of criminal prosecution, for averting danger by the police authorities of the federal states, for fulfilling the statutory tasks of the federal and state offices for the protection of the constitution, the Federal Intelligence Service or the Military Counterintelligence Service, or for enforcing intellectual property rights.

Should such requests arise, we examine them carefully within the means available to us and only pass on your data if the legal obligation proves to be binding on us.

The legal basis for the data processing is then the fulfilment of the controller's legal obligations under Art. 6(1)(c) GDPR and the relevant special laws, whose application we reserve.

6. User-dependent services

Some of our services require the use of personal data. These include:

  • Registration with a user profile
  • Participation in prize draws

The legal basis for the data processing is a contract or the initiation of a contract with the data subject under Art. 6(1)(b) GDPR. After registration, consent is also given. The legal basis for the data processing is then the data subject's consent pursuant to Art. 6(1)(a) GDPR.

7. Provision of the website

7.1. General information on data processing on our website

Each time you use our websites, we collect the access data that your internet browser transmits automatically, so that you can visit the websites. The access data includes in particular:

  • Browser type and version
  • Operating system used
  • Website from which you visit us (referrer URL)
  • Website you visit
  • Date and time of your access
  • Your internet protocol data (IP address)
  • Amount of data transferred
  • Access status (file transferred, file not found, etc.)

This anonymous data (with the exception of the IP address) is stored separately from any personal data you may have provided and therefore does not allow any conclusions to be drawn about a specific person. It may be evaluated for statistical purposes in order to optimise our website and our offers. After evaluation, this data is deleted by us and our service providers.

Processing this access data is necessary to enable you to visit the website and to ensure the continuous functionality and security of our systems. The legal basis is Art. 6(1)(1)(b) GDPR. We expressly reserve the right to rely on statutory permissions and legal bases

7.2. Anonymised usage profiles

Unless stated otherwise here, you do not need to provide any personal data to use our website. Each time a user accesses the websites referred to above and each time a file is retrieved, data about this process is stored in a log file. We use this data to technically enable your visit to our site. We also use this data for statistical purposes to improve the design and layout of our website. This data is not used on a personal basis.

In detail, the following data record is stored for each retrieval:

  • Name of the retrieved file
  • Date and time of the retrieval
  • Amount of data transferred
  • Notification of whether the retrieval was successful
  • Description of the type of web browser used
  • Requesting domain
  • Country of origin of the domain

7.3. Contacting us

You have various ways of getting in touch with us. These include the contact form, in which we process data exclusively for the purpose of communicating with you in the context of initiating and performing a contract, so that we can answer your questions about our products in advance and clarify questions that arise during use. The legal basis is Art. 6(1)(b) GDPR.

You can also voluntarily provide us with further data as part of your enquiry. We store this data and use it to answer your enquiry. Some services of our portal are offered in cooperation with partner companies. In order to offer this partner service, it may be necessary for us to share your personal data with these partner companies. Even in this case, however, the data is used exclusively to answer your enquiry, including by our partner. Providing this data voluntarily constitutes consent to the use of the data in the sense described above. We log your consent to the collection and use of data.

The data we collect when you use the contact form is deleted automatically once your enquiry has been dealt with completely, unless we still need your enquiry to fulfil contractual or legal obligations (see the section “Storage period”).

7.4. Use of personal data

If you contact us by email, fax or telephone, we may ask you for some personal details. In each case we ask for the data we need to handle your enquiry properly, but at least your surname and first name, email address and telephone number. The legal basis is our legitimate interest in the processing pursuant to Art. 6(1)(f) GDPR.

You can also voluntarily provide us with further data as part of your enquiry. We store this data and use it to answer your enquiry. Some services of our portal are offered in cooperation with partner companies. In order to offer this partner service, it may be necessary for us to share your personal data with these partner companies. Even in this case, however, the data is used exclusively to answer your enquiry, including by our partner. The use of the data in the sense described above. We log your consent to the collection and use of data. The legal basis for the data processing is the data subject's consent pursuant to Art. 6(1)(a) GDPR.

7.5. Contact by email

You can contact us via the email address provided on our website. In this case, the user's personal data transmitted with the email is stored. The data is used exclusively for handling the conversation.

If you contact us by email, this also constitutes the necessary legitimate interest in processing the data.

Where the user has given consent, the legal basis for processing the data is Art. 6(1)(a) GDPR.

The legal basis for processing data transmitted in the course of sending an email is Art. 6(1)(f) GDPR. If the email contact aims at the conclusion of a contract, the additional legal basis for the processing is Art. 6(1)(b) GDPR.

In this case, all personal data stored in the course of contacting us is deleted.

7.6. Contact form

Our website has a contact form that can be used to contact us electronically. If a user takes advantage of this option, the data entered in the form is transmitted to us and stored.

The following data is stored at the time the message is sent:

  1. Email address
  2. Name of the contact person
  3. Telephone / mobile number
  4. Details of your company name / company
  5. IP address of the requesting computer
  6. Date and time of contact
  7. Comment (optional)

Your consent to the processing of the data is obtained when you submit the form, and reference is made to this privacy policy. Alternatively, you can contact us via the email address provided. In this case, the user's personal data transmitted with the email is stored.

We use customer relationship management software, which allows us to plan and monitor our sales activities.

We process the personal data from the form solely to handle your enquiry. If you contact us by email, this also constitutes the necessary legitimate interest in processing the data.

The other personal data processed during submission serves to prevent misuse of the contact form and to ensure the security of our information technology systems.

The legal basis for processing the data is the initiation of a contract at the request of the data subject, Art. 6(1)(1)(b), second alternative, GDPR.

The legal basis for processing data transmitted in the course of sending an email is Art. 6(1)(1)(f) GDPR.

To send emails, we use Mailgun, a service of Mailgun Technologies, Inc., 112 E Pecan St #1135, San Antonio, TX 78205, USA. Mailgun delivers your enquiry with the details listed above to us by email; if you request a whitepaper, we use it to send you the download link, without open or click tracking. We use Mailgun's EU region; the data is processed in the European Union. We have concluded a data processing agreement with Mailgun pursuant to Art. 28 GDPR. Mailgun is certified under the EU-US Data Privacy Framework (Art. 45 GDPR); where data is transferred to the USA beyond this, the transfer is based on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).

7.7. Applications by email and application form

Our website has an application form that can be used to apply electronically.

To provide the application form, we use the careers page of the HR and applicant management software Talention. If an applicant takes advantage of this option, the data entered in the form is transmitted to Talention and stored.

You can find more information in Talention's privacy policy:

https://www.talention.de/datenschutzerklaerung

If an applicant takes advantage of this option, the data entered in the form is transmitted to us and stored. This data is:

  1. First name
  2. Surname
  3. Email address
  4. CV
  5. References and certificates
  6. Cover letter

Your consent to the processing of your data is obtained when you submit the form, and reference is made to this privacy policy.

Alternatively, you can send us your application by email. In this case, we record your email address and the data you provide in the email.

After you have sent your application, you will receive an email from us confirming receipt of your application documents.

Your data is not passed on to third parties. The data is used exclusively for processing your application.

We process the personal data from the application form solely to handle your application. If you contact us by email, this also constitutes the necessary legitimate interest in processing the data.

The other personal data processed during submission serves to prevent misuse of the application form and to ensure the security of our information technology systems.

7.8. Newsletter and Astralys waitlist

You can subscribe to our newsletter and join the waitlist for Astralys to be informed when it launches. For this we only need your email address. We use the double opt-in procedure: after signing up, you receive an email with a confirmation link, and only after you confirm do we send you newsletters or information about Astralys.

Sending and hosting

To manage sign-ups and send emails, we use the open-source software listmonk, which we operate ourselves on servers of teuto.net Netzservice GmbH in Germany; we have concluded a data processing agreement with teuto.net pursuant to Art. 28 GDPR. The emails are sent via Mailgun (for the provider, data processing and transfers to third countries, see 7.6).

Evaluation of opens and clicks

Our emails contain a tracking pixel and links that we use to record whether and when you opened an email and which links you clicked. This information is linked to your email address. We use it to understand which content is of interest and to improve our emails.

Customer management

Your email address and the status of your sign-up are transferred to our customer management system Twenty (see 8.1), so that we can see a person's enquiries and sign-ups together.

The legal basis for sending emails and evaluating opens and clicks is your consent pursuant to Art. 6(1)(1)(a) GDPR and, for the tracking pixel, Section 25(1) TDDDG. Logging the sign-up and confirmation serves as proof of your consent (Art. 6(1)(1)(c) GDPR in conjunction with Art. 7(1) GDPR).

Unsubscribing and storage period

You can withdraw your consent at any time with effect for the future, via the unsubscribe link in every email or by email to info(at)validatis.de. After you unsubscribe, you will no longer receive emails and we will no longer evaluate opens and clicks. We keep your email address and the proof of consent for up to three years after you unsubscribe so that we can prove earlier consent (Art. 6(1)(1)(f) GDPR); we do not use them for any other purpose.

8. Cookies and similar technologies

Cookies are small text files stored by your browser. Similar technologies include entries in your browser's local storage. On your first visit, we use a cookie banner to ask which categories you allow.

Necessary: we store your choice in your browser's local storage so that we do not ask you again on every visit. This storage is strictly necessary for the service you have requested (Section 25(2) no. 2 TDDDG); it serves as proof of your consent (Art. 6(1)(1)(c) GDPR in conjunction with Art. 7(1) GDPR).

Statistics: we only use PostHog with your consent (see 8.2). Without consent, PostHog is not loaded and no statistics cookies are set.

You can change your choice or withdraw your consent at any time via “Cookie settings” in the footer of every page. Withdrawal takes effect for the future; the lawfulness of the processing carried out until then remains unaffected. Independently of this, you can delete or block cookies at any time in your browser settings.

8.1. Customer management with Twenty

We use the self-hosted open-source software “Twenty” to manage relationships with customers and prospects and sales activities. In doing so, we process in particular contact and company data and communication histories. Depending on the occasion, the processing is carried out to take steps prior to entering into a contract or to perform a contract pursuant to Art. 6(1)(1)(b) GDPR, on the basis of consent pursuant to Art. 6(1)(1)(a) GDPR, or on the basis of our legitimate interest in efficient customer service and sales organisation pursuant to Art. 6(1)(1)(f) GDPR.

The system is operated on servers of Hetzner Online GmbH within the European Union. Hetzner is engaged as a processor pursuant to Art. 28 GDPR.

The data stored in the CRM is not transferred to Twenty. The data is deleted as soon as it is no longer necessary for the purposes stated and there are no statutory retention obligations or other legitimate grounds for further storage. Consent can be withdrawn at any time with effect for the future by email to info(at)validatis.de.

8.2. Web analytics with PostHog

With your consent, we use PostHog, a web analytics service of PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. The data is stored and processed on servers in the European Union (Frankfurt am Main).

Type of data, purpose of processing

PostHog records which pages you visit and how you interact with the website (for example clicks), the referring page, details of your browser, device and operating system, and your IP address, from which your approximate location is derived. For this, your browser stores a cookie and an entry in local storage with a random identifier; the cookie is valid for a maximum of one year. We do not link this data to your name or email address. We use the analyses to understand how our website is used and to improve content and usability.

The legal basis is your consent pursuant to Section 25(1) TDDDG and Art. 6(1)(1)(a) GDPR, which you give via our cookie banner.

Data processing and transfers to third countries

We have concluded a data processing agreement with PostHog pursuant to Art. 28 GDPR. PostHog is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission pursuant to Art. 45 GDPR). Where data is transferred to the USA beyond this, the transfer is based on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).

Storage period and withdrawal

The data collected is deleted after 12 months. You can withdraw your consent at any time with effect for the future via “Cookie settings” in the footer; the cookie and the stored identifier are then deleted. You can find more information at posthog.com/privacy.

Our website contains external links or hyperlinks to websites of other providers. These must be distinguished from our own content. This third-party content does not originate from us, and we have no influence over the content of third-party pages.

When you select an external link or hyperlink, you are redirected from our website to the website of the third-party provider. In this case, we cannot guarantee that these third-party providers will treat your data confidentially or comply with data protection regulations. Responsibility for this lies solely with the respective website provider.

If we become aware of unlawful content in external links or hyperlinks available on our website, we will remove the links concerned immediately. Please send any such notices to the data protection officer using the contact details above.

10. Changes to and currency of this privacy policy

Any change to the privacy policy is announced here on this website and applies from the date of publication. Should DuMont Business Information GmbH wish to use your data for further purposes, we will ask for your permission. The purpose for which this data is used only changes with your consent.

This privacy policy is currently valid and dated 1 March 2024.

Note:

We make every effort, using all technical and organisational means available, to store your personal data in such a way that it is not accessible to third parties. When communicating by email, we cannot guarantee complete data security, so we recommend sending confidential information by post.

Definitions / glossary

“Anonymisation” is the alteration of personal data in such a way that the individual details about personal or material circumstances can no longer be attributed to an identified or identifiable natural person, or only with a disproportionate amount of time, cost and effort.

“Special categories of personal data” are details about racial and ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health or sex life.

“Third party” means a natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and persons who, under the direct authority of the controller or processor, are authorised to process the data.

“Consent of the data subject” is any freely given, specific, informed and unambiguous indication of the data subject's wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.

“Recipient” is any person or body that receives data. A third party is any person or body outside the controller. Third parties are not the data subject or persons and bodies that collect, process or use personal data on behalf of others in Germany, in another member state of the European Union or in another state party to the Agreement on the European Economic Area.

“Collection” is the obtaining of data about the data subject.

“Erasure” is the rendering unrecognisable of stored personal data.

“Personal data” is any information relating to an identified or identifiable natural person (“data subject”); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number or other specific factors that express their physical, physiological, genetic, mental, economic, cultural or social identity.

“Pseudonymisation” is the replacement of the name and other identifying features with a code for the purpose of preventing or substantially impeding the identification of the data subject.

“Undertaking” is any natural or legal person engaged in an economic activity, irrespective of its legal form, including partnerships or associations regularly engaged in an economic activity.

“Group of undertakings” is a group consisting of a controlling undertaking and the undertakings controlled by it.

“Processing” is the storage, alteration, transfer, blocking and erasure of personal data. In detail, irrespective of the procedures used:

  1. Storage is the recording, capturing or keeping of personal data on a data carrier for the purpose of further processing or use
  2. Alteration is the modification of the content of stored personal data,
  3. Transfer is the disclosure of stored personal data or personal data obtained through data processing to a third party in such a way that
    • the data is passed on to the third party, or
    • the third party inspects or retrieves data held available for inspection or retrieval,
  4. Blocking is the marking of stored personal data in order to restrict its further processing or use.

“Controller” is any person or body that collects, processes or uses personal data for itself or has others do so on its behalf.