Privacy Policy

1. Responsible Party

VYVA GbR Sedat Yasar, Felix-Nekir Frank Sternengasse 15 68307 Mannheim, Germany Email: vyva@outlook.de Phone: +49 151 21995819

2. Scope of This Policy

This privacy policy applies to our public website (vyva.world) and to contacting us, for example via our contact or demo form, or when registering a user account. In that respect we are the controller within the meaning of Art. 4(7) GDPR for the processing of your data. If you use the VYVA platform as a person invited by a company (e.g. as an employee of a customer or as an invited portal user), we process the data entered or uploaded there (e.g. formulation, raw-material or batch data as well as names and contact details of contact persons) exclusively on behalf of and under the instructions of that company. In this case the respective customer company, not VYVA, is the controller for this processing; details are governed by the data processing agreement concluded between VYVA and the customer company (Art. 28 GDPR). Item 7 explains this constellation in more detail.

3. Principles of Data Processing

We collect and use your personal data only to the extent necessary for providing a functional website as well as our content and services, where a legal basis permits it, or where you have consented. The collection and use of any further data (e.g. for analytics tools) only takes place after your prior, explicit consent via our cookie banner.

4. Data Processing When Using Our Website

4.1 Server Log Files

Each time our website is accessed, information is automatically recorded and stored in so-called server log files: • Browser type and version • Operating system used • Referrer URL • IP address of the accessing computer • Time of server request This data is not combined with other data sources and serves to ensure smooth and secure operation of the website and for statistical analysis to improve our offering (Art. 6(1)(f) GDPR). For these statistics, when a page of our public website is requested we evaluate on our server: the page requested, the domain of the referring website (without path or search terms), campaign parameters in the address (utm_*), the language version and the country of origin derived from the IP address. So that visitors are not counted more than once within a day, we derive an anonymous identifier from the IP address, the browser identifier and a random value generated anew each day. The random value is deleted once the day is over, so the identifier can neither be reversed nor linked to any other day. The IP address itself is not stored for this purpose. There is no personal evaluation and no persistent recognition (no fingerprinting); we use neither cookies nor scripts in your browser for this. The country is determined locally on our server using a database from DB-IP (db-ip.com); no data is transmitted to third parties. Of the browser identifier we only store the browser and operating-system family (e.g. “Chrome”, “Windows”) and the device type (desktop, mobile, tablet), without version numbers. Requests from search engines and other automated programs (crawlers) and requests for pages that do not exist (error 404) are recorded separately with the requested path (without parameters), time, country of origin and the detected crawler name or browser family, in order to detect broken links and attack attempts (Art. 6(1)(f) GDPR). The IP address is not stored for this either. These entries are deleted after 100 days. For certain features we also use cookies or comparable storage technologies. We use technically necessary cookies without consent; all other cookies and techniques (e.g. analytics tools, session replay, feedback form) are only activated after you give explicit consent via our cookie banner. You can withdraw your consent at any time with effect for the future via the "Cookie settings" link in the footer. Details on individual cookies can be found in our Cookie Policy. For signed-in users of our platform, error logging, Session Replay (only when an error occurs; the recording shows the page with the displayed content, input and images, except password fields) and the feedback form are part of operating the platform and are active without separate consent via the cookie banner. In addition, for each user account we record per day the number of sign-ins and the time of first and last use; this data is deleted after 13 months.

5. Contact Form and Demo Request

If you contact us via the contact form, the demo request form, or email, we process the data you enter (including name, email address, company if applicable, phone number, role and your message) for the purpose of processing and responding to your inquiry. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measure) or Art. 6(1)(f) GDPR (legitimate interest in processing inquiries addressed to us). We additionally automatically record, for these forms, the page visited, a broadly categorized source of the visit (e.g. search engine, social network, AI assistant), and any UTM campaign parameters contained in the URL, in order to understand through which channels inquiries reach us. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in measuring the effectiveness of our own marketing activities; this does not create cross-device profiles and no data is shared with third parties for advertising purposes. To prevent abuse (automated mass submissions), we evaluate the IP address of the requester for a one-hour window in order to limit the number of requests per IP address. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in protecting our forms and our email sending reputation from abuse. The data is deleted as soon as it is no longer required for achieving the purpose of its collection, at the latest once the respective communication has concluded, unless a legal retention obligation applies.

6. Registration, Login and Invitations

Using the VYVA platform requires a user account. Access is generally granted through an invitation from a customer company; in this context we process the email address provided by the inviting organization as well as the data you provide during registration (including name, your chosen password in hashed, non-reversible form). When you log in, we set a technically necessary session cookie that keeps you logged in for up to 7 days. The legal basis is Art. 6(1)(b) GDPR (performance of the usage agreement) or, where the invitation is issued by a customer company, Art. 6(1)(f) GDPR (legitimate interest in functional access management) in conjunction with our data processing agreement with the respective customer company. Invitation and password-reset emails are sent via our email service provider, Resend (see item 13). Account data is deleted or deactivated once the associated user account is removed by the customer company or the business relationship ends.

7. Using the Platform as an Invited Person (Data Processing)

Once you log in with your user account and use the platform within an organization, we process all content entered or uploaded there (e.g. formulations, raw-material data, batch documentation, test protocols, files and attachments, and any personal data contained within) exclusively as a processor within the meaning of Art. 28 GDPR, on behalf of and under the instructions of the respective customer company. We apply the technical and organizational measures agreed in the data processing agreement with the customer company. For requests for information, correction, or deletion regarding data processed within such an organization, please contact the responsible customer company first; as the controller, it is obliged to respond to your request and can instruct us accordingly.

8. Automated Processing and Artificial Intelligence

Certain features of the VYVA platform (e.g. suggestions for alternative raw materials or automated compliance notices) are based on rule-based algorithms and matching against stored databases, not on generative artificial intelligence that processes personal data or independently generates content about individuals. We do not currently carry out any automated decision-making, including profiling, within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you. Should we introduce features in the future that rely on generative AI or that transmit personal data to an AI provider for processing, we will update this policy accordingly before launch and, where required, inform you separately.

9. Your Rights

You have the following rights regarding your personal data: • Right to information • Right to correction or deletion • Right to restriction of processing • Right to object to processing • Right to data portability • Right to lodge a complaint with a supervisory authority Where your data is processed within an organization as described in item 7, please direct your request to the respective customer company as the controller first.

10. Data Security

We use the widespread TLS (Transport Layer Security) procedure in connection with the highest encryption level supported by your browser when visiting the website. Our servers are located in an ISO/IEC 27001-certified data center in Germany; data stored there is encrypted at rest.

11. Analytics and Tracking Tools

If you have given consent via our cookie banner, we use Google Analytics and/or Google Tag Manager, services provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). These services allow us to analyze usage of our website (e.g. pages visited, time spent, referral source). The legal basis is your consent (Art. 6(1)(a) GDPR). Without your consent, these services are not loaded. This may involve the transfer of personal data to Google servers outside the EU/EEA, including the United States. Further information can be found in Google’s privacy policy at https://policies.google.com/privacy. You can withdraw your consent at any time via the cookie banner or the "Cookie settings" link in the footer, with effect for the future.

12. Error and Performance Monitoring (Sentry)

We use a self-hosted instance of the Sentry service for technical error detection and performance monitoring of our platform; data transmission runs through a tunnel we operate ourselves, not to an external Sentry operator. This captures technical information such as error messages, crash reports and performance metrics; IP addresses and other standard metadata are not transmitted. The legal basis for this plain error and performance capture is our legitimate interest (Art. 6(1)(f) GDPR) in a functional, secure and error-free platform. We additionally use a session replay feature (screen recording on technical errors) and a feedback form with an optional screenshot function. When a technical error occurs, session replay records the session shortly before and after that error as it was displayed in the browser, including displayed text, input and images; password fields are always hidden. Without an error, no recording is transmitted. Recordings are stored exclusively on our own Sentry instance and used only to analyse and fix errors. For visitors to our website, both features are only activated after you have given explicit consent via our cookie banner (Art. 6(1)(a) GDPR); without your consent, neither screen recordings are created nor the feedback form loaded. For signed-in users of our platform, both features are part of operating the platform and are active without separate consent via the cookie banner. You can withdraw your consent at any time via the cookie banner or the "Cookie settings" link in the footer, with effect for the future.

13. Recipients and Processors

We use carefully selected service providers who support us in operating and further developing our website and platform and who process personal data exclusively on our instructions (data processing under Art. 28 GDPR), in particular: • Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany – hosting and infrastructure for our website and application in a data center in Germany • Resend, Inc., USA – sending emails (e.g. responding to contact inquiries, invitations, password resets) • Error and performance monitoring: a self-hosted Sentry instance on our own infrastructure (see item 12), no access by an external provider • Google Ireland Limited – analytics tools, only with your consent (see item 11) Where this involves transferring data to countries outside the EU/EEA (in particular to Resend in the USA), we ensure an adequate level of data protection, for example through EU Standard Contractual Clauses with the respective provider.

14. Retention Period

Unless stated otherwise in this policy, we only store personal data for as long as necessary for the respective purpose or as required by law: • Server log files: a few days to weeks, then deleted or anonymized • Statistical access data (section 4.1): up to 25 months; it can no longer be attributed to any person once the respective day is over • Contact and demo inquiries: until your inquiry has been fully processed, then deleted unless a legal retention obligation applies • IP addresses for abuse prevention (rate limiting): evaluated for a one-hour window • Session cookie (login): up to 7 days or until logout • User accounts and platform data processed on behalf of a customer: until deletion by the customer company or the end of the respective business relationship (see item 7) • Analytics data (Google Analytics, only with consent): according to the retention periods configured there • Error diagnostic data (Sentry): deleted automatically on a regular basis; session replay recordings only arise when an error occurs, and for website visitors only with your consent

15. Data Protection Officer

A data protection officer has not currently been appointed, as the legal requirements for doing so under § 38 BDSG (German Federal Data Protection Act) are not currently met. Should this change, we will appoint a data protection officer without delay and update this policy accordingly.

16. Changes to the Privacy Policy

We reserve the right to occasionally adjust this privacy policy so that it always complies with current legal requirements or to implement changes to our services.