Privacy Policy
Data Protection Information Video Surveillance
Version: August 2026
1. General Information
Introduction
We appreciate your interest in our website. Protecting your personal data is important to us. Below, we explain what data we process when you visit our website, for what purpose this is done, and what rights you have in this regard.
Data processing is always carried out in accordance with the General Data Protection Regulation (GDPR) and applicable German data protection regulations (in particular the BDSG and TDDDG). In general, our website can be used without providing personal data; however, certain functions—such as contacting us or subscribing to the newsletter—may require data processing. If there is no legal basis for this, we will obtain your consent.
Data Controller
The data controller within the meaning of the GDPR is:
AVILUS GmbH
Osterfeldstraße 82
85737 Ismaning, Germany
Represented by: Niclas Bähr, Max Söpper, Henning Boysen
Data Protection Officer
If you have any questions or suggestions regarding data protection, you can contact our Data Protection Officer as follows:
Stephan Krischke, datenschutz@avilus.com
Definitions
This Privacy Policy uses the terms defined in the GDPR, including “personal data,” “processing,” “controller,” “processor,” and “consent,” as legally defined in Article 4 of the GDPR. A detailed explanation of these terms can be found in the text of the GDPR.
Your Rights as a Data Subject
Subject to the statutory requirements, you have the following rights: the right to access the personal data stored about you (Article 15 of the GDPR), the right to rectification of inaccurate data (Article 16 of the GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), and the right to object to processing based on a balancing of interests, in particular to processing for direct marketing purposes (Art. 21 GDPR). You may revoke any consent you have given at any time with future effect.
You also have the right to lodge a complaint with a data protection supervisory authority.
Legal Bases for Processing
We process personal data on the following legal bases: with your consent (Art. 6(1)(a) GDPR in conjunction with § 25 TDDDG), to fulfill or initiate a contract (Art. 6(1)(b) GDPR), to comply with legal obligations (Art. 6(1)(c) GDPR), and to protect legitimate interests (Art. 6(1)(f) GDPR), provided that your interests do not override these in individual cases.
Our services are intended for adults. Persons under the age of 16 may not provide us with any personal data without the consent of their legal guardians.
Disclosure of Data to Third Parties
Your data will only be disclosed to third parties to the extent permitted by law, if you have given your consent, if it is necessary for the performance of a contract, or if we have a legitimate interest in doing so. In connection with the services described below, data may also be transferred to countries outside the EU/EEA, in particular to the United States. To the extent possible, we base such transfers on an adequacy decision by the European Commission (e.g., the EU-U.S. Data Privacy Framework) or on EU Standard Contractual Clauses pursuant to Article 46 of the GDPR.
Retention Period and Deletion
We store personal data only for as long as is necessary for the respective processing purpose or as required by statutory retention obligations. If the purpose for storage no longer applies or a statutory retention period expires, the relevant data is routinely deleted or blocked.
2. Technology
Hosting
We host our website on the platform provided by Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA. When you visit our website, your data (including your IP address in server log files) is processed on Webflow’s servers.
The legal basis is our legitimate interest in the reliable, secure, and high-performance provision of our website (Art. 6(1)(f) GDPR). The service provider is certified under the EU-US Data Privacy Framework, meaning that an adequacy decision by the European Commission pursuant to Art. 45 GDPR is in place.
Further information: https://webflow.com/legal/privacy
Content Delivery Networks (CDN)
To deliver our website content more quickly and securely, we use several Content Delivery Networks (CDNs). These networks deliver content via geographically distributed servers and process technical data such as your IP address:
- Amazon CloudFront – Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg (Parent company: Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109, USA)
- Cloudflare – Cloudflare Germany GmbH, c/o Design Offices München Atlas, Rosenheimer Straße 143C, 81671 Munich (Parent company: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA)
- bunny.net – BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia
- jsDelivr – Prospect One, Królewska 65A/1, PL-30-081 Kraków, Poland
The legal basis is our legitimate interest in ensuring the high performance and security of our website (Art. 6(1)(f) GDPR). Amazon Web Services, Inc. and Cloudflare, Inc. are certified under the EU-U.S. Data Privacy Framework, meaning that an adequacy decision by the European Commission pursuant to Art. 45 GDPR applies in each case; bunny.net and jsDelivr process data within the EU.
Further information: https://aws.amazon.com/privacy/
Further information: https://www.cloudflare.com/privacypolicy/
Further information: https://bunny.net/privacy/
Further information: https://www.jsdelivr.com/terms/privacy-policy-jsdelivr-net
Server Log Files
Every time you visit our website, our system automatically collects data transmitted by your browser: browser type and version, operating system used, referrer URL, subpages accessed, date and time of access, a truncated (anonymized) IP address, and the Internet service provider. This data is used to ensure the website functions without technical errors and to secure it, as well as, if necessary, for law enforcement purposes in the event of a cyberattack. This data cannot be used to identify you personally; the log file data is stored separately from other data.
The legal basis is our legitimate interest in system security and stability (Art. 6(1)(f) GDPR).
Cookies and Consent Management
Cookies are small files that your browser stores on your device. We use technically necessary cookies to enable the operation of our website, as well as—with your consent—additional cookies to improve user-friendliness and for analysis.
To obtain and document your consent, we use the “Consent Pro” cookie consent tool provided by Finsweet, 1001A E Harmony Rd. #15, Fort Collins, CO 80525, USA. In doing so, your consent(s) or their revocation, your IP address, and the time of your visit, among other things, are processed and stored in a cookie on your device.
The legal basis for technically necessary cookies is Article 6(1)(f) of the GDPR; for all other cookies, it is your consent pursuant to Article 6(1)(a) of the GDPR. The collection of consent itself is carried out to fulfill our legal obligation under Article 7 of the GDPR in conjunction with Section 25 of the TDDDG. The service provider is certified under the EU-U.S. Data Privacy Framework, meaning that an adequacy decision by the European Commission pursuant to Article 45 of the GDPR is in place.
You can also delete cookies or restrict their storage at any time via your browser settings (e.g., via the help pages for Chrome, Safari, Firefox, or Microsoft Edge).
Further information: https://finsweet.com/legal/eu-swiss-privacy-policy
3. Additional Content
Contact Form
If you contact us via our contact form, we process the data you provide (e.g., name, email address, inquiry) solely for the purpose of handling your request. The form is technically provided and processed via the native form function of our website builder, Webflow, Inc. (see Chapter 2, “Hosting,” for the address).
The legal basis is our legitimate interest in responding to your inquiry (Art. 6(1)(f) GDPR) or, if your inquiry is aimed at entering into a contract, Art. 6(1)(b) GDPR. Your data will be deleted as soon as your inquiry has been fully processed and there are no legal retention obligations that prevent this.
Newsletter
You can subscribe to our newsletter on our website. Registration is handled via the native form function of Webflow, Inc. (see Chapter 2, “Hosting,” for the address). The data provided during registration (in particular your email address) is transmitted to the Salesforce CRM system for contact management and stored there; we do not currently send out a regular newsletter. The provider of the CRM system is SFDC Ireland Limited, Level 1, Block A, Nova Atria North, Sandyford Business District, Dublin 18, Ireland, a company of the Salesforce Group (parent company: Salesforce, Inc., 415 Mission Street, San Francisco, CA 94105, USA).
The legal basis is your consent pursuant to Art. 6(1)(a) of the GDPR. The service provider is certified under the EU-U.S. Data Privacy Framework, meaning that an adequacy decision by the European Commission pursuant to Article 45 of the GDPR is in place. You may withdraw your consent at any time with future effect, e.g., by contacting us using the contact information provided in the legal notice.
Further information: https://www.salesforce.com/de/company/privacy/
Handling of Applicant Data
We collect and process the personal data of job applicants. Such data processing may also take place electronically, for example, when applicants submit application materials to us via email or through a web form on our website. On our website, we offer you the option to submit applications for advertised job openings to us via email.
Your data will only be stored in an applicant database beyond the scope of the current application process if you have given us your separate consent to do so.
The legal basis for the processing of your personal data in this application process is primarily Article 6(1)(b) of the GDPR. According to this provision, the processing of data necessary in connection with the decision regarding the establishment of an employment relationship is permitted. This also includes, if applicable, the use of the online applicant portal. If special categories of personal data within the meaning of Article 9 of the GDPR are processed (e.g., health data), the legal basis is Section 26(3) of the Federal Data Protection Act (BDSG) or Article 9(2)(b) of the GDPR in conjunction with Article 6(1)(b) of the GDPR. In the event that your application documents are disclosed to third parties, in particular to companies affiliated with us, or if your data is stored beyond the scope of the current application process, the processing of your data is based on Article 6(1), first sentence, (a) of the GDPR in conjunction with Section 26(2) of the BDSG. There is no legal or contractual obligation to provide your data; however, processing your application is not possible without the provision of this information.
Data from applicants will be deleted 6 months after a rejection. If you have consented to the continued storage of your personal data, we will transfer your data to our applicant pool. There, the data will be deleted after 24 months.
4. Plug-ins and Services
Google Tag Manager
We use Google Tag Manager to centrally manage various analytics and marketing tags on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, a company of the Google Group (parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Tag Manager itself does not set any cookies, but it can load additional services that, in turn, process data.
The legal basis is your consent (Art. 6(1)(a) GDPR). The service provider is certified under the EU-U.S. Data Privacy Framework, meaning that an adequacy decision by the European Commission pursuant to Art. 45 GDPR is in place.
Further information: https://policies.google.com/privacy?hl=de
Google Fonts
We use the Google Fonts service to ensure consistent font display. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). When you visit our pages, a connection is established with Google’s servers and your IP address is transmitted.
The legal basis is your consent (Art. 6(1)(a) GDPR). The service provider is certified under the EU-U.S. Data Privacy Framework, meaning that an adequacy decision by the European Commission pursuant to Art. 45 GDPR is in place.
Further information: https://policies.google.com/privacy?hl=de
YouTube
On certain subpages (e.g., news articles), we embed videos from YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (operating company: YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA). When you visit a page with an embedded video, a connection is established to YouTube/Google servers at , during which your IP address, among other things, is transmitted—this can occur even before you interact with the video, simply by loading the page. In addition, thumbnails (including via the domains ggpht.com and ytimg.com) as well as advertising and tracking services (including via googleads.g.doubleclick.net) may be loaded subsequently.
The legal basis is your consent (Art. 6(1)(a) GDPR). The service provider is certified under the EU-U.S. Data Privacy Framework, meaning an adequacy decision by the European Commission pursuant to Art. 45 GDPR is in place.
Further information: https://policies.google.com/privacy?hl=de
Cloudflare Turnstile
To protect our website from malicious automated access (bots), such as in the case of forms, we use the Cloudflare Turnstile service. The provider is Cloudflare Germany GmbH, c/o Design Offices München Atlas, Rosenheimer Straße 143C, 81671 Munich (parent company: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). This may involve the processing of, among other things, your IP address as well as browser and device information.
The legal basis is our legitimate interest in preventing misuse (Art. 6(1)(f) GDPR) or, to the extent that cookies not strictly necessary for this purpose are set, your consent (Art. 6(1)(a) GDPR). The service provider is certified under the EU-U.S. Data Privacy Framework, meaning that an adequacy decision by the European Commission pursuant to Art. 45 GDPR is in place.
Further information: https://www.cloudflare.com/privacypolicy/
Embedly
We use the Embedly service to embed third-party content (e.g., linked posts) in individual posts on our website. The provider is Embedly LLC, 611 South DuPont Highway, Suite 102, Dover, DE 19901, USA. In doing so, your IP address and browser/device information, among other things, may be transmitted to Embedly and transferred to the United States.
The legal basis is your consent (Art. 6(1)(a) GDPR). For the transfer to the U.S., we have, to the extent possible, agreed to EU Standard Contractual Clauses pursuant to Art. 46 GDPR (see also Chapter 1, “Disclosure of Data to Third Parties”).
Further information: https://embed.ly/legal/privacy
5. Social Media Presence
To enable us to communicate with you via social media and keep you informed about our company, we maintain our own profiles on these platforms. When you visit one of these profiles, we are jointly responsible with the respective platform provider for the processing operations triggered thereby, in accordance with Article 26 of the GDPR; we are not the original provider of these pages, but merely use them within the scope of the options offered by the providers.
As a precaution, we would like to point out that your data may also be processed outside the EU/EEA and that the providers regularly analyze usage behavior for their own advertising or analytical purposes, over which we have no control. Since we do not have access to the providers’ data sets, we recommend that you exercise rights such as the right to access, rectification, or erasure directly with the respective provider.
The legal basis is our legitimate interest in maintaining up-to-date communication with you, as well as the legitimate interest of the respective provider (Art. 6(1)(f) GDPR). If you are required to provide separate consent to the respective provider, the legal basis in this regard is Art. 6(1)(a) GDPR in conjunction with Art. 7 GDPR.
The (joint) controller for data processing in Europe is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.
Further information: https://www.linkedin.com/legal/privacy-policy
The (joint) controller for data processing in Europe is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
Further information: https://instagram.com/legal/privacy/
YouTube Channel
In addition to embedded videos (see above, “YouTube”), we maintain our own YouTube channel. The (joint) data controller in Europe is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Further information: https://policies.google.com/privacy?hl=de