Privacy Policy
We treat personal data with care. This policy describes what we collect, why, on what legal basis, and how to exercise your rights under the GDPR.
Scope of this policy
This privacy policy applies to this website (devviy.com) and to the hosted demo environments we operate for sales and showcase purposes — for example, the Strandbad demo. These properties are hosted on Vercel as listed below.
Production websites and applications we build and deliver to clients are a separate matter: they are deployed to EU-based infrastructure owned and operated by the respective client (typically a Hetzner, Netcup, or IONOS instance located in Germany or another EU country). On those deployments the client is the data controller and issues their own privacy notice. We are not the controller or processor for those sites unless a separate written agreement says so.
Controller
The controller responsible for the processing of personal data on this website is the entity listed in our Imprint. For any privacy-related question or request, please contact us by email — the address is listed there.
Data we collect
We aim to collect as little personal data as possible. The categories we process are limited to what is necessary to operate this site and respond to your inquiries.
- Contact form submissions: name, email address, selected project type, and the content of your message.
- Server logs generated by our hosting provider: IP address, user agent, timestamp, and requested URL — kept transiently for security and abuse prevention.
- Follow-up correspondence by email or messaging app, if you choose to initiate it.
Purposes and legal bases
We process contact form data to respond to your request on the basis of pre-contractual measures (Art. 6(1)(b) GDPR) or, where no contract is concluded, our legitimate interest in answering inquiries (Art. 6(1)(f) GDPR).
Server logs are processed on the basis of our legitimate interest in the stable and secure operation of this website (Art. 6(1)(f) GDPR).
Cookies and tracking
We use a small number of strictly necessary cookies: one to remember your cookie preferences (devviy_consent_v1, valid for up to 12 months) and, where applicable, technical storage to remember your language choice. These do not require consent under Art. 5(3) of the ePrivacy Directive.
Analytics is opt-in. If, and only if, you grant consent for the analytics category in the cookie banner, this site loads Google Analytics 4, which sets first-party cookies (e.g. _ga, _ga_*) to measure aggregate site usage with IP-anonymization enabled. We do not embed advertising pixels, session-recording tools, or fingerprinting techniques.
You can change or withdraw your consent at any time via the “Cookie settings” link in the footer.
Recipients and subprocessors
We share personal data only with carefully selected service providers who process it on our behalf under data processing agreements where required by Art. 28 GDPR.
International transfers
Some of our subprocessors are based outside the European Economic Area. Where transfers occur, we rely on appropriate safeguards such as the EU Standard Contractual Clauses or equivalent mechanisms recognized under Art. 46 GDPR.
Retention
We retain contact form data only as long as necessary to handle your inquiry and any resulting project relationship, after which it is deleted or anonymized unless statutory retention obligations apply. Server logs are kept for a short period for security purposes and then deleted.
Your rights
Under the GDPR you have the following rights regarding your personal data, which you can exercise at any time by contacting us:
- Right of access (Art. 15 GDPR).
- Right to rectification (Art. 16 GDPR).
- Right to erasure (Art. 17 GDPR).
- Right to restriction of processing (Art. 18 GDPR).
- Right to data portability (Art. 20 GDPR).
- Right to object to processing based on legitimate interests (Art. 21 GDPR).
- Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
Right to complain
You have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or the place of the alleged infringement.
Changes to this policy
We may update this policy to reflect changes in our processing activities or legal requirements. The current version is always available on this page; material changes will be highlighted by an updated revision date.