Privacy Policy

The website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Requests process IP address, time, requested file, referrer, browser and operating-system information to deliver content and maintain security and stability.

The legal basis is our legitimate interest under Article 6(1)(f) GDPR. Transfers to the US rely on the EU-US Data Privacy Framework or safeguards such as Standard Contractual Clauses.

We also use Vercel Speed Insights to evaluate the website’s loading times and technical performance. For each page view, performance data such as Web Vitals and the requested route, as well as general device and region information, is sent to Vercel. This analysis helps us improve website performance. The legal basis is our legitimate interest under Article 6(1)(f) GDPR in maintaining a fast and reliable website.

When you contact us by form, email or phone, we process your name, contact details, message and optional information to respond. The legal basis is Article 6(1)(b) GDPR for contractual or pre-contractual enquiries, otherwise Article 6(1)(f) GDPR.

We delete enquiries when resolved unless retention duties apply. IP-based rate limiting protects the service against abuse on the basis of Article 6(1)(f) GDPR.

When you join the waitlist, we use your email address to inform you about availability and product news on the basis of consent under Article 6(1)(a) GDPR. You may withdraw consent by email at any time.

Providing consent is voluntary. We retain the address until withdrawal or the purpose ends, subject to legal obligations.

Contact confirmations, waitlist and order notifications are sent through Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. Resend processes email addresses, message or order details, and technical delivery information.

Depending on the message, processing is based on Article 6(1)(a), (b) or (f) GDPR. US transfers rely on the provider’s applicable EU-US Data Privacy Framework participation or Standard Contractual Clauses.

For orders, we process name, email, billing and shipping address, products, price, payment status and communications to perform the contract under Article 6(1)(b) GDPR.

Tax and commercial records are generally retained for the applicable statutory periods, usually six or ten years.

Payments are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Stripe processes contact, billing and delivery details, payment and transaction data, and device and fraud-prevention information. We do not receive complete card or account details.

Processing is based on Article 6(1)(b) GDPR and fraud prevention additionally on Article 6(1)(f). Transfers outside the EEA rely on adequacy decisions or Standard Contractual Clauses.

Public content from our business account is fetched server-side through the Instagram Graph API provided by Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland. No Instagram embed is loaded merely by opening the page, but media may be served from URLs provided by Meta, which can disclose your IP address to Meta.

This is based on our legitimate interest in current company communications under Article 6(1)(f) GDPR. External social links are governed by the respective provider’s privacy policy.

Only with your consent, we use Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It measures page views, navigation, device and browser data, approximate region, and interactions such as link, button, waitlist and checkout events. We do not send names, email addresses or form contents.

The legal bases are consent under section 25(1) TDDDG for storing or accessing information and Article 6(1)(a) GDPR for subsequent processing. Google may process data in the US under the EU-US Data Privacy Framework and supplementary Standard Contractual Clauses. Analytics cookies such as `_ga` may be stored for up to two years by default.

You can change your choice at any time through “Cookie Settings” in the footer. Analytics is not loaded without consent.

Only with your consent, we use the Meta Pixel and the Conversions API provided by Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland. They let us measure which adverts lead to page views, product views, waitlist and contact enquiries, and orders, and enable Meta to optimise and evaluate our advertising.

The data processed includes the requested URL, the time and type of the event, product and order values, your IP address, browser and device information, and the Meta cookies `_fbp` and `_fbc`. For waitlist, contact and order events we additionally transmit your email address and, for orders, your name, city, postal code and country — exclusively as an irreversible SHA-256 hash so that Meta can match you to a user account (known as advanced matching).

The Conversions API sends these events to Meta directly from our server as well. Each event carries a shared identifier so that Meta merges the browser-side and server-side deliveries instead of counting them twice.

Storing or accessing information on your device is governed by section 25(1) TDDDG; subsequent processing is based on Article 6(1)(a) GDPR. For the measurement of advertising events, we and Meta are joint controllers under Article 26 GDPR; Meta provides the essential content of that arrangement. Meta may process data in the US under the EU-US Data Privacy Framework and supplementary Standard Contractual Clauses.

You can change your choice at any time through “Cookie Settings” in the footer. Without consent, neither the Meta Pixel is loaded nor are events sent through the Conversions API.

Your analytics choice is stored as `ventova-ga-consent` in your browser’s local storage. This is necessary to apply your choice without asking on every page view. The legal bases are section 25(2)(2) TDDDG and Article 6(1)(f) GDPR.

Font files are delivered by the website itself. Loading a page therefore does not establish a direct connection to Google Fonts.

Recipients are service providers required for hosting, communications, payments and technical delivery, and authorities where legally required. Transfers outside the EEA rely on adequacy decisions, the EU-US Data Privacy Framework or EU Standard Contractual Clauses where necessary.

Subject to statutory conditions, you have rights of access, rectification, erasure, restriction, portability and objection. You may withdraw consent at any time for the future.

You may complain to a data-protection authority. In Bavaria, the competent authority is the Bavarian State Office for Data Protection Supervision, Promenade 18, 91522 Ansbach, Germany.