Skip to content
Avana Mindworks
de

Privacy Policy

v1.1.1

1. Controller

Avana Mindworks UG (haftungsbeschränkt) Kleine Kirchgasse 3 67550 Worms Germany Email: legal@avana-mindworks.com

Please see our Imprint for further company details.

2. General information

This Privacy Policy explains how we process personal data and how information is accessed and stored on your device when you use our website (www.avana-mindworks.com). We process personal data only where necessary to provide and secure this website, handle enquiries, or comply with legal obligations. Personal data means any information relating to an identified or identifiable natural person. The following information explains the purposes, categories of data, legal bases, recipients, and retention periods associated with processing on this website.

The website does not use analytics, marketing, or advertising trackers. It does not embed externally hosted fonts, videos, maps, or social media content. The fonts, images, and WebAssembly module used by the site are delivered from our own website.

3. Website delivery and hosting

3.1 Cloudflare

We use Cloudflare Pages, Pages Functions, Cloudflare Workers, D1, and Workers KV provided by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA ("Cloudflare") to host, deliver, secure, and technically optimise this website, to store contact enquiries and delete them on schedule, and to limit abuse. Cloudflare processes this data on our behalf as a processor.

When you access the website, the data processed may include your IP address; the date and time of access; the requested URL or resource; the HTTP method and status code; the referrer URL; browser type and version; operating system and device information; the amount of data transferred; and security, diagnostic, and error information. This processing is necessary to deliver content, establish encrypted connections, detect attacks and abuse, and maintain the stability of the website.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the secure, stable, and efficient delivery of the website, error diagnosis, and the prevention of abuse and attacks.

3.2 Server and security logs

The website does not retain full HTTP request logs and is not connected to Logpush or an external error-tracking service. For form activity, it logs only the event category, language, form ID, and timestamp; email addresses, names, messages, and IP addresses are not written to these application logs. Under Cloudflare's documented standard configuration, the live logs for Cloudflare Pages Functions are not retained. Cloudflare may also process operational security and infrastructure logs for the periods specified in its agreement and documentation.

3.3 Abuse prevention

To protect the contact form, the IP address supplied by Cloudflare is used for a technical rate limit. A counter is stored in Cloudflare Workers KV under a key derived from the IP address and the current time window. The entry is automatically deleted 60 seconds after its last update; because Workers KV uses distributed caching, global visibility of the deletion may be technically delayed. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is preventing automated or abusive form submissions.

4. Contact form

When you submit the contact form, we process your email address, your name and message if you choose to provide them, and the form language, form ID, source page path, the version of the privacy notice displayed when submitting, an internally assigned record identifier, and the server-side time of receipt. The information is sent through our own endpoint to a Cloudflare D1 database. The form does not automatically send an email to a third-party provider.

If your enquiry concerns entering into a contract or relates to our services, the legal basis is Article 6(1)(b) GDPR. For other enquiries, the legal basis is Article 6(1)(f) GDPR; our legitimate interest is to handle and respond to your enquiry appropriately. Where continued retention is necessary to comply with a legal obligation, the legal basis is Article 6(1)(c) GDPR. Consent is not the legal basis for the ordinary handling of the contact form.

Please do not submit health data or any other particularly sensitive personal data through the contact form, including information about religious or philosophical beliefs. We do not request or need this information to handle ordinary enquiries. If you nevertheless send such information without being asked, we will restrict its processing and subsequently delete it unless an exceptional legal permission under Article 9(2) GDPR applies.

5. Newsletter

If you expressly consent by selecting the dedicated, unticked checkbox in the contact form, we also process your email address to send you news about Quantalibrium and Avana Mindworks. For this purpose, we store your email address, the form language, the source page path, the version of the consent wording, the time of your consent, the time the confirmation email was sent, the time of any later confirmation, an internally assigned record identifier, and the status of your subscription. The tokens used for confirmation and unsubscribing are stored in our database only as cryptographic hashes; we also store the confirmation token's expiry time. We do not store an IP address in connection with newsletter subscriptions.

The legal basis for processing personal data is your consent under Article 6(1)(a) GDPR. Consent is voluntary. It is not a condition for using this website or for having an enquiry submitted through the contact form handled or answered.

We use a double opt-in procedure. After subscribing, you receive an email that allows you to confirm your subscription within 30 days. Before confirmation, we send only the email required for the confirmation procedure. Newsletters and other news are sent only after successful confirmation.

We use the Cloudflare Email Service provided by Cloudflare, Inc. to send confirmation emails and subsequent newsletter emails. In doing so, Cloudflare processes in particular the sender and recipient addresses, subject line, message content, technical message identifiers, sending and delivery times, authentication and delivery status, and error and bounce information. The optional feature for subsequently displaying full email content in the activity log is disabled.

For permanently undeliverable addresses, repeated delivery failures, or spam complaints, Cloudflare may add the email address concerned to a suppression list in order to prevent further delivery attempts and ensure the security and reliability of email delivery.

You may withdraw your consent at any time with effect for the future, without affecting the lawfulness of processing carried out before withdrawal. A message to legal@avana-mindworks.com is sufficient. Every newsletter email also contains an unsubscribe option.

When you withdraw consent, we delete your active newsletter subscription without undue delay, including your email address and the confirmation and unsubscribe tokens. Solely as evidence of the consent previously given, we retain a separate consent record for three years from the withdrawal. It contains a pseudonymised verification value derived from the normalised email address using a secret key, the language and source-page path of the subscription, the version of the consent wording, and the times of consent, dispatch of the confirmation email, confirmation, and withdrawal, where available. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is to establish, exercise, or defend potential legal claims relating to newsletter delivery. The record is not used as a suppression list or for renewed delivery and is deleted automatically when the retention period expires. The Cloudflare delivery suppression described in the preceding paragraph applies only to technically undeliverable addresses and not to withdrawals of consent.

6. Communication by email

If you contact us by email, we process in particular the sender and recipient addresses, subject line, message content, attachments, timestamps, and technical delivery, spam, and security information. We use Google Workspace for direct email communication. Our contractual provider and processor is Google Cloud EMEA Limited, based in Ireland. Google and the subprocessors it uses process this data on our behalf in accordance with the contractual data protection terms.

The legal bases depend on the purpose of the communication: Article 6(1)(b) GDPR for pre-contractual or contractual correspondence, Article 6(1)(f) GDPR for other enquiries, and Article 6(1)(c) GDPR where retention is required by law. Our legitimate interest is the reliable and secure handling of business communications.

7. Cookies and local storage on your device

The website itself does not set cookies and does not use localStorage or sessionStorage for analytics, advertising, consent management, language preferences, or form content. If you select light or dark appearance using the dedicated control, the site stores only the value "light" or "dark" under the localStorage key "avana-appearance" and reads it on later visits. The value remains on your device, is not transmitted to us, and can be changed through your browser settings or by toggling the appearance again.

Under section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG), storing and reading this appearance preference does not require consent because it is necessary for the appearance function that you expressly select. We do not use analytics, marketing, or advertising trackers.

Independently of the application code, Cloudflare's security and bot-management layer may set technically necessary cookies on your device to protect the website. In particular, the cookie "__cf_bm" may be used to detect automated access and normally expires after around 30 minutes of inactivity. If a Cloudflare security check is performed, the cookie "cf_clearance" may store, for the configured validity period, that the check was completed successfully so that it does not have to be repeated on every subsequent page view. These cookies are used for security, bot detection, and abuse prevention. We do not use them for advertising, marketing, audience measurement, or cross-site tracking. Storage and access take place without consent under section 25(2) no. 2 TDDDG insofar as they are strictly necessary for the secure provision of the website function requested by the user. The legal basis for the associated processing of personal data is Article 6(1)(f) GDPR. Our legitimate interest is protecting the website against automated access, attacks, and abuse.

8. Recipients and processors

Cloudflare, Inc. and its subprocessors: provision, delivery, and security of the website; Pages Functions; Cloudflare Workers; the D1 database; Workers KV; and the Cloudflare Email Service for sending confirmation and newsletter emails, processing sending and delivery information, and managing delivery suppressions.

Google Cloud EMEA Limited, Google group companies, and their subprocessors: provision of Google Workspace for direct email communication.

Within Avana Mindworks, access to personal data is limited to people who need that access to handle enquiries, manage newsletter subscriptions, perform technical administration, or comply with legal obligations. Public authorities, courts, and legal, tax, or other professional advisers receive personal data only where disclosure is legally required or necessary to establish, exercise, or defend legal claims.

We do not sell personal data or disclose it to third parties for advertising purposes.

9. International data transfers

Cloudflare operates a globally distributed network. Personal data is therefore also processed outside the European Economic Area, particularly in the United States. Cloudflare is certified under the EU-U.S. Data Privacy Framework. The transfer is therefore based on the European Commission's adequacy decision under Article 45 GDPR.

Not all processing takes place in the same way. The database in which your contact-form information and newsletter subscription are stored is configured with the "European Union" jurisdiction restriction. Storage and execution take place exclusively within the European Union, with no replicas outside it. By contrast, the following may be processed outside the European Economic Area: technical connection data when the website is accessed, since Cloudflare's global network normally delivers the website from the location with the lowest latency to the visitor; the counter used to rate-limit the contact form, which is deleted after 60 seconds; and the sending and delivery data for confirmation and newsletter emails sent through the Cloudflare Email Service.

We have entered into a data processing agreement with Cloudflare. On request, we will provide you with a copy of the safeguards used in each case and further information about the protective measures taken.

When Google Workspace is used, personal data is also processed outside the European Economic Area, particularly in the United States. Our contractual provider and processor is Google Cloud EMEA Limited, based in Ireland; Google LLC, based in the United States, is among the subprocessors used. Google LLC is certified under the EU-U.S. Data Privacy Framework, so transfers to the United States are based on the European Commission's adequacy decision under Article 45 GDPR. Where transfers are made to other countries for which no adequacy decision exists, the European Commission's Standard Contractual Clauses and supplementary safeguards are used in accordance with the Google Cloud Data Processing Addendum.

The data region for the Google service Gmail is set to Europe, which means that core-service content is stored within Europe. This does not cover, in particular, support and administrative access or the activities of other subprocessors, which may also take place from outside the European Economic Area. Google provides the current list of subprocessors and the countries concerned as part of the contractual documentation.

We have entered into a data processing agreement with Google in the form of the Google Cloud Data Processing Addendum. On request, we will provide you with a copy of the safeguards used in each case and further information about the protective measures taken.

10. Retention

  • Contact form: a daily deletion job removes form entries from the active D1 database once they are more than six months old. If an enquiry results in a business relationship or records must be retained longer for statutory, evidentiary, or defence purposes, only the information required for that purpose is transferred to the responsible system and retained there for the applicable period.
  • Newsletter subscription and withdrawal: unconfirmed newsletter subscriptions are automatically deleted 30 days after consent was given. The confirmation link is likewise valid for 30 days. Resending the confirmation email or generating a new confirmation link does not extend this deletion period. Confirmed newsletter subscriptions and the associated proof of consent are stored until consent is withdrawn. On withdrawal, we delete the active subscription, including the email address and tokens, without undue delay. We retain the separate, pseudonymised consent record for three years from withdrawal solely to establish, exercise, or defend potential legal claims and then delete it automatically.
  • Cloudflare Email Service sending and delivery data: when sending confirmation and newsletter emails, Cloudflare processes technical sending events, particularly the sender and recipient addresses, subject line, technical message identifier, sending and delivery time, delivery status, authentication results, and error and bounce information. Under the current Cloudflare configuration, these sending events are retained for up to 31 days. The optional email preview feature is disabled, so no full message content is stored through that feature for subsequent display in the activity log.
  • Delivery suppressions: for permanently undeliverable email addresses, repeated delivery failures, or spam complaints, Cloudflare may store the email address concerned in a suppression list to prevent further delivery attempts. It is stored for as long as necessary to avoid further unwanted or technically futile delivery attempts and to protect delivery reliability. Where a suppression is no longer required and can be removed by us, it is lifted.
  • Email communication: we generally delete ordinary enquiries no later than six months after they have been finally resolved. Commercial correspondence is generally retained for six years. Where a communication forms part of an accounting record or other commercial or tax record subject to a longer statutory period, the applicable period is generally eight or ten years.
  • Rate-limit data: the IP-based counter stored in Cloudflare Workers KV is automatically deleted 60 seconds after its last update.
  • Application logs: the application does not retain full HTTP request logs. Form events are visible only in non-persistent live logs while a logging session is active.
  • Deletion-run record: the application stores an operational record of each automated deletion run, containing only the execution time and the respective numbers of records deleted, with no personal data, as a durable record that the deletion process was carried out.
  • D1 recovery data: after deletion from the active D1 database, data may remain technically recoverable until Cloudflare's point-in-time recovery window expires; depending on the Cloudflare plan, this window is up to 30 days.

Once a processing purpose no longer applies, the data is deleted or restricted unless a legal obligation or overriding legitimate interest justifies continued retention. Statutory retention periods begin with the relevant event defined by applicable commercial or tax law.

11. Required and optional provision of data

You do not have to actively provide personal data merely to browse the website, although technically necessary connection data is processed automatically when you access it. When using the contact form, a reachable email address is required so that we can associate your enquiry with a means of contact and respond. Providing your name and a message is optional. Without a reachable contact address, we may be unable to respond. There is no legal obligation to use the contact form. Consent to the newsletter is likewise voluntary; without it we answer your enquiry just the same, and you simply do not receive any news.

12. Automated decision-making and profiling

We do not use automated decision-making, including profiling, within the meaning of Article 22 GDPR in connection with this website. The automated technical rate limit may temporarily reject an excessive number of form submissions; it does not produce legal or similarly significant effects for the individual concerned.

13. Your rights

Subject to the conditions set out in law, you have the following rights in particular:

  • Access to your personal data (Article 15 GDPR).
  • Rectification of inaccurate data and completion of incomplete data (Article 16 GDPR).
  • Erasure of your personal data (Article 17 GDPR).
  • Restriction of processing (Article 18 GDPR).
  • Data portability (Article 20 GDPR).
  • Objection, on grounds relating to your particular situation, to processing based on Article 6(1)(e) or (f) GDPR (Article 21(1) GDPR).
  • Objection at any time and without giving reasons to the processing of your personal data for direct marketing purposes (Article 21(2) GDPR).
  • Withdrawal of consent at any time with effect for the future, without affecting the lawfulness of processing carried out before withdrawal (Article 7(3) GDPR).
  • The right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR).

To exercise your rights, contact legal@avana-mindworks.com. To prevent unauthorised disclosure, we may ask for reasonable proof of identity.

14. Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority. The authority ordinarily responsible for us is:

The State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz) Hintere Bleiche 34 55116 Mainz Germany Email: poststelle@datenschutz.rlp.de

This does not limit your right to contact any other supervisory authority competent under Article 77 GDPR.

15. Data security

We use appropriate technical and organisational measures to protect personal data. These include TLS encryption in transit, restrictive security headers, server-side input validation, payload size limits, a honeypot and IP-based rate limit for the contact form, and access controls based on operational need. Complete security cannot nevertheless be guaranteed for data transmitted over the internet.

16. Changes to this policy

We update this Privacy Policy when the website, the services we use, legal requirements, or our processing operations change. The version published on this page, identified by its effective date and version number, is the current version.