Privacy | TerraVac

This policy explains which personal data we process when you visit terravac.de or contact us. We only use the services listed here and do not use any advertising or tracking cookies.

1. Controller and contact

TerraVac GmbH, Weinbergstraße 7, 97753 Karlstadt, Germany, represented by its Managing Director Hanno Großeschmidt.

Please send any questions about data protection and requests regarding your rights to datenschutz@terravac.de.

We have not appointed a data protection officer, as we are not legally required to do so.

2. Hosting and server logs

Our website is operated by Webflow, Inc., 398 11th Street, Floor 2, San Francisco, CA 94103, USA. Webflow processes the data as our processor under a contract pursuant to Art. 28 GDPR. Webflow also delivers the website's images and videos.

Each time the website is accessed, the server automatically records:

IP address,
date and time of access,
page accessed and previously visited page (referrer),
browser and operating system.

We need this data to deliver the website, ensure its security and defend against attacks. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR. Webflow stores the logs only as long as necessary to deliver and secure the website and deletes them afterwards.

The connection to the website is encrypted using TLS.

3. Redirection via Cloudflare

If you access terravac.eu or one of our other domains, Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, redirects you to terravac.de via an encrypted connection. In doing so, Cloudflare processes your IP address and technical connection data. Cloudflare acts as our processor under a contract pursuant to Art. 28 GDPR.

The legal basis is our legitimate interest in secure and consistent availability under all our domains (Art. 6(1)(f) GDPR). If you access terravac.de directly, Cloudflare is not involved.

4. Web analytics with Plausible

To understand which pages are read, we use Plausible Analytics, provided by Plausible Insights OÜ, Estonia. Plausible does not set cookies or create user profiles. Your IP address is not stored; it is only used to generate an anonymous identifier that changes daily. We only see aggregated figures such as page views, country of origin and referring pages.

The data is processed in the EU. Plausible acts as our processor. The legal basis is our legitimate interest in designing the website according to our visitors' needs (Art. 6(1)(f) GDPR).

5. Cookies and fonts

We do not use any cookies that require consent. Where Webflow uses technically necessary browser storage, for example for language selection, this is based on Section 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG). A cookie banner is therefore not required.

To ensure a consistent appearance, we currently use fonts from Google Fonts, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you open a page, your browser loads the fonts from Google's servers. Google thereby receives your IP address and technical information such as your browser and the page accessed. Google processes this data as an independent controller. The legal basis is our legitimate interest in a consistent and legible presentation of the website (Art. 6(1)(f) GDPR). For more information, see Google's Privacy Policy.

6. Contact by email or phone

If you write to us or call us, we process your name, your contact details and the content of your enquiry in order to respond to it. Emails are stored in Microsoft 365; Microsoft acts as our processor, with processing in the EU.

The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract or steps prior to entering into one; otherwise it is our legitimate interest in responding to your enquiry (Art. 6(1)(f) GDPR). We delete the data once your enquiry has been dealt with, unless we are legally required to retain it. We retain business correspondence for six years and accounting records for eight years (Section 257 German Commercial Code (HGB), Section 147 German Fiscal Code (AO)).

7. Job applications

If you apply for a job with us, we process your details and documents in order to decide on filling the position. The legal basis is the initiation of an employment relationship (Art. 6(1)(b) GDPR). Only the people involved in the selection process have access.

Our job postings and application form are provided for us by Personio (Personio SE & Co. KG, Munich, Germany). Personio processes your application as our processor, with processing in the EU.

If no employment relationship results, we delete your data six months after the end of the application process. We only keep it longer with your consent, for example for future vacancies.

8. Links to LinkedIn and other websites

Our website contains only simple links, for example to our LinkedIn profile or to the seal of the German certification body for the research allowance (Bescheinigungsstelle Forschungszulage). No plugins are embedded; no data is transferred to these providers when you visit our website. Only when you click on a link do the privacy policies of the respective provider apply.

9. Transfers to the USA

Webflow and Cloudflare are based in the USA. Through Google Fonts, your IP address may be transferred to Google LLC in the USA. All three companies are certified under the EU-U.S. Data Privacy Framework; there is therefore an adequacy decision of the European Commission for these transfers (Art. 45 GDPR). In addition, the EU Standard Contractual Clauses have been agreed in our contracts with Webflow and Cloudflare (Art. 46(2)(c) GDPR). All other services mentioned process data in the EU.

10. Your rights

You have the right to

access your data (Art. 15 GDPR),
rectification (Art. 16 GDPR),
erasure, unless we are required to retain the data (Art. 17 GDPR),
restriction of processing (Art. 18 GDPR),
data portability (Art. 20 GDPR),
withdraw any consent given, with effect for the future (Art. 7(3) GDPR).

An informal email to datenschutz@terravac.de is sufficient. We will respond within one month.

Right to object (Art. 21 GDPR): Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless there are compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint: You may lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, poststelle@lda.bayern.de.

We do not use automated decision-making, including profiling (Art. 22 GDPR).

11. Changes

We update this policy when we change services or add new ones. The version published here applies.

‍