Privacy policy

A. General information

1. Controller

The controller responsible for processing personal data on this website is:

ELEVAYTE Systems UG (haftungsbeschränkt)
represented by its managing director Jonas Trettin
Rüdigerstraße 16
40472 Düsseldorf

Telephone: +49 211 54553000
Email: [email protected]
Website: www.elevayte.de

2. Privacy contact

If you have questions about privacy or wish to exercise your rights, you can contact Jonas Trettin using the contact details above. We have not appointed a data protection officer because the statutory conditions requiring one are not currently met.

3. Your rights

Where the relevant statutory conditions are met, you have, in particular, the right to:

  • access the personal data we process about you (Article 15 GDPR),

  • have inaccurate data corrected and incomplete data completed (Article 16 GDPR),

  • request the erasure of your data (Article 17 GDPR),

  • have the processing of your data restricted (Article 18 GDPR),

  • receive the data you have provided in a portable format (Article 20 GDPR), and

  • object to processing based on legitimate interests on grounds relating to your particular situation (Article 21 GDPR).

You may withdraw any consent you have given at any time with effect for the future. This does not affect the lawfulness of processing carried out before you withdrew consent.

You may also lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2-4, 40213 Düsseldorf, www.ldi.nrw.de.

4. Retention periods

We retain personal data only for as long as it is needed for the respective purpose. We then erase or anonymize it unless statutory retention obligations or legitimate interests, such as the establishment, exercise or defense of legal claims, require otherwise. Specific periods are set out under the relevant processing activities below.

5. Recipients and transfers to third countries

We use service providers where necessary to operate the website and handle inquiries. We enter into the required agreements with processors under Article 28 GDPR. Where data is processed outside the European Economic Area, we base the transfer on an adequacy decision, in particular the EU-US Data Privacy Framework, or on the European Commission’s standard contractual clauses. Details are provided under each service below.

B. Data processing on this website

1. Website access and hosting

When you access this website, your browser transmits technically necessary connection data. This may include your IP address, date and time, requested address, volume of data transferred, referrer, browser, operating system and HTTP status. Processing is necessary to deliver the website and ensure its stability and security. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of our website.

The website runs in a Kubernetes cluster operated by us in German data centers provided by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen. Neither the website application nor the ingress in front of it creates HTTP access logs containing personal data. Separately, Cloudflare, our upstream security and content delivery service, processes connection data as described below.

2. Cloudflare

We use services provided by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, for DNS, TLS encryption, fast delivery of cached content and protection against attacks and abusive access. In particular, Cloudflare processes IP addresses, requested addresses, dates and times, and information about browsers, devices and connections. Requests may be routed through Cloudflare servers outside the European Economic Area.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to provide a secure, resilient and fast website. For transfers to the USA, Cloudflare relies on its certification under the EU-US Data Privacy Framework and, where necessary, standard contractual clauses. For further information, see the Cloudflare privacy policy.

3. Cookies and similar technologies

Our website application does not set cookies or store identifiers in your browser’s local storage. Our Plausible analytics and embedded Adobe Fonts do not set cookies either. As part of its security functions, Cloudflare may use technically necessary cookies or similar information on your device. This occurs only where necessary to provide and secure the website you have requested. The legal basis for access to your device is § 25(2), no. 2 TDDDG; subsequent processing is based on Article 6(1)(f) GDPR.

4. Adobe Fonts

We load the Navigo font family through Adobe Fonts to give our website a consistent appearance. The provider for users in the European Economic Area is Adobe Systems Software Ireland Limited, 4-6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland. When font files are loaded, your browser connects to Adobe. This transmits technically necessary information such as your IP address, the domain accessed, and details of your browser and operating system. According to Adobe, the service does not set cookies or store your IP address.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to display our website reliably and in line with our brand. For further information, see the Adobe Fonts privacy information and the Adobe privacy policy.

5. Audience measurement with Plausible Analytics

We use Plausible Analytics to understand how our website is used and which content is relevant to visitors. We run the software in our own cluster in Germany. It records the page visited, referring website, browser, operating system, device type, approximate location at city or regional level, time spent, page views and clicks on outbound links. When a form is submitted successfully, we also record a “Lead” event with the form type and the page from which it was submitted. Form contents are not sent to Plausible.

Plausible does not use cookies or create permanent or cross-site user profiles. The IP address and user agent are used to generate an identifier that changes daily and are not stored as raw data. Processing takes place within the European Union. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to measure and improve our website while minimizing the data used. We delete analytics data as soon as it is no longer needed for this purpose.

6. Contact and inquiry forms

You can write to us through a short inquiry form or the contact form on our website. In the short inquiry form, we process your sector, name and email address and, optionally, your company name. In the contact form, we process your email address and message and, optionally, your title, company, first name, last name and telephone number. Required fields are marked. Acknowledging the privacy policy serves only to inform you about processing; it does not constitute consent.

Where your inquiry concerns a contract or steps prior to entering into a contract, the legal basis is Article 6(1)(b) GDPR. In all other cases, we process the information under Article 6(1)(f) GDPR on the basis of our legitimate interest in responding to your inquiry and conducting our business communications.

The website does not store your form data permanently. Application logs record only the technical outcome, a reason for any error, the form type and the page accessed, but not the form data entered. To limit abusive submissions, we hold your IP address in the memory of the respective website server for no more than ten minutes. It is then automatically discarded.

6.1 Sending email through Resend

We use Resend, a service provided by Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA, to send your inquiry to our mailbox. The form data you enter and technical delivery data are processed in the USA. According to Resend, email content and delivery logs are stored for up to 30 days on standard plans; backups may remain for a further seven days. Resend relies on the EU-US Data Privacy Framework and standard contractual clauses for the transfer. For further information, see the Resend privacy policy and the Data Processing Addendum.

6.2 Handling inquiries in Microsoft 365

Your inquiry is received and handled in our Microsoft 365 mailbox. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. In operating its services, Microsoft may use affiliates and subprocessors outside the European Economic Area. Such transfers are subject to the adequacy decision for the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses. For further information, see the Microsoft Products and Services Data Protection Addendum and the Microsoft privacy statement.

We delete inquiries that do not lead to a business relationship no later than twelve months after we have finished handling them. If a business relationship is established, or the information is needed to meet statutory retention obligations or for legal claims, we retain it for the period required in each case.

7. Form protection with Cloudflare Turnstile

We use Cloudflare Turnstile to protect our forms against automated submissions and abuse. The Turnstile script loads when you open a page containing a form; the check is completed when you submit it. For this purpose, Cloudflare processes, in particular, your IP address, TLS and browser characteristics, user agent, site key, referring address and the result of the check. The information entered in the form is not sent to Turnstile.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to protect our forms and systems against spam and automated abuse. Where Turnstile stores or accesses information on your device, this takes place under § 25(2), no. 2 TDDDG because the check is necessary for the secure form submission you have requested. The information about Cloudflare above also applies. For further information, see the Cloudflare privacy policy.

8. Links to social networks

Our footer links to our profiles on Facebook and Instagram, X and LinkedIn. This website does not include social plugins, like buttons or embedded posts from these networks. Only when you click a link do you leave our website, at which point the respective provider processes your data under its own responsibility. Plausible records only that an outbound link was clicked, including its destination.

9. Automated decisions

In connection with this website, we do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. No profiling within the meaning of Article 22 GDPR takes place.

10. Security and updates to this policy

We use appropriate technical and organizational measures to protect personal data against loss, manipulation and unauthorized access. Data transmitted through this website is encrypted using TLS. However, no method of data transmission or storage offers absolute security.

We update this privacy policy when the website, the services we use or legal requirements change. Last updated: October 3, 2026.