Legal
Privacy notice
1. Controller and contact
The controller under the General Data Protection Regulation (GDPR) is VELVO Bau GmbH, Promenade13 Office Center, Rheinpromenade 13, 40789 Monheim am Rhein, represented by managing director Anastasija Maas. Your contact for privacy matters is Anastasija Maas, available at info@velvobau.com or 02173 9939292. Naming this contact does not constitute appointment as a data protection officer.
2. What data we process
This website has no user accounts and no dedicated visitor or inquiry database. This does not mean that no personal data is processed: visiting the site involves technical connection data, and contacting us involves the information you submit. Please do not send special categories of personal data, such as health information, unless necessary for your inquiry.
3. Hosting and technical logs
The website and its server-side contact function are hosted through Replit, Inc., USA. Requests involve the IP address, time, requested address, HTTP status and transmitted browser, device and, where applicable, referrer information. Replit and its infrastructure providers may maintain access and security logs. Our contact API logs the request method, path, status, duration and errors; routine request logging does not store form contents. The purposes are delivery, availability, troubleshooting and protection against abuse. The legal basis is Article 6(1)(f) GDPR, reflecting our legitimate interest in a secure, functioning website. Hosting-log retention depends on the Replit service and contractual settings; a uniform retention period confirmed for this account is not currently available.
4. Contact by form, email or phone
We process your name, email address, optional project location, message, chosen language and other information you voluntarily provide. For telephone inquiries, we process the conversation and contact information necessary to handle the matter; this website does not record calls. We use these details to answer inquiries and, where relevant, prepare a contract. The legal basis is Article 6(1)(b) GDPR for pre-contractual or contractual matters and otherwise Article 6(1)(f) GDPR, our legitimate interest in responding to inquiries. The privacy checkbox acknowledges that you have read these notices; it is not consent to advertising. Form entries are not saved in browser storage or a dedicated inquiry database; the server processes them for email delivery to info@velvobau.com. If sending is unavailable or fails, the form displays an error rather than confirming success.
5. Email delivery through Resend
Resend (Plus Five Five, Inc., USA) is the intended service for delivering form messages. Once sending is configured and you submit an inquiry, Resend receives its contents, your name and email address, optional project location, language, sender and recipient information and technical delivery data. It maintains delivery logs. Ireland (eu-west-1) is the intended sending region; actual activation must be confirmed in the Resend account. Even when sending from Ireland, Resend states that it stores customer and email data in the USA. The sending region therefore does not imply exclusive EU storage. Resend states a general 30-day retention period for email and log data on Free, Pro and Scale plans, and seven days for backups; Enterprise agreements may differ. This does not determine how long the delivered message remains in our mailbox. The legal bases are those for contact handling in section 4.
6. Recipients, processors and international transfers
Inquiries are accessible to the VELVO personnel responsible for handling them and to providers needed for hosting, email delivery and operation of the recipient mailbox. We do not sell inquiry data or disclose it for advertising. Replit and Resend are US providers, so processing or access outside the European Economic Area is possible. Their published Article 28 GDPR processing agreements include EU Standard Contractual Clauses for relevant transfers under Article 46 GDPR. Resend additionally refers to the EU-US Data Privacy Framework. These provider statements do not replace verification of the contracts and transfer conditions applicable to our account. You may request information about safeguards and, where applicable, a copy at our contact address above. Provider information and subprocessor details are linked at the end of this page.
7. Abuse prevention
The form does not embed an external CAPTCHA. The server checks a hidden control field, the elapsed time since opening the form and the number of requests per IP address. The IP address and request times are processed in API-server memory; the rate-limiting window is ten minutes. This is not used to create advertising or usage profiles. The legal basis is Article 6(1)(f) GDPR and our legitimate interest in preventing automated and abusive inquiries.
8. Browser storage and preferences
The website uses localStorage under “velvo-consent” to remember your privacy-notice or cookie-settings choice, its version, timestamp and expiry for up to 180 days. The animation-pause preference is saved under “velvo-motion-paused” in sessionStorage for the browser session. These entries contain no visitor identifier assigned by us and are not used for advertising. Saving expressly chosen settings relies on section 25(2)(2) of the German TDDDG; insofar as personal data is involved, Article 6(1)(f) GDPR applies to implementing and managing your choice. You can change it through “Cookie settings” in the footer and delete storage through your browser. No optional analytics or marketing services are currently active. Such services would require separate information and, where necessary, consent under section 25(1) TDDDG and Article 6(1)(a) GDPR.
9. Images, fonts, analytics and automated decisions
Images and fonts are delivered with the website. No external font, map, video or social-media embeds are loaded. We do not use our own analytics, advertising or marketing trackers on this site. Technical operational and security processing by hosting and delivery providers is unaffected. We do not conduct automated decision-making with legal or similarly significant effects under Article 22 GDPR or related profiling.
10. Retention and deletion
We retain correspondence only as long as necessary to handle the inquiry, a subsequent business relationship or legal obligations. Once an inquiry is concluded and no further retention grounds apply, the data is deleted. Commercial or tax retention requirements may impose periods of six, eight or ten years depending on the document type, on the basis of Article 6(1)(c) GDPR and applicable law. Further retention may be necessary to establish, exercise or defend legal claims under Article 6(1)(f) GDPR. Provider retention of technical logs and delivery data and browser-storage periods are described in the corresponding sections.
11. Your rights and objections
Subject to statutory conditions, you have rights of access (Article 15 GDPR), rectification (16), erasure (17), restriction (18) and portability (20). Where processing relies on consent, you may withdraw it at any time for the future without affecting previous lawful processing. Where processing relies on Article 6(1)(f), you may object under Article 21 on grounds relating to your particular situation. Any direct-marketing processing can be opposed at any time without giving reasons. Contact info@velvobau.com to exercise these rights. We generally respond within one month under Article 12(3) GDPR.
12. Complaints to a supervisory authority
Under Article 77 GDPR, you may complain to a supervisory authority, particularly where you habitually live or work or where you believe an infringement occurred. For businesses in North Rhine-Westphalia, the relevant authority is in particular the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany. Contact and complaint information is available at www.ldi.nrw.de.
13. Security, required information and updates
The website uses encrypted HTTPS connections. Despite safeguards, absolute security cannot be guaranteed, particularly for ordinary email. Providing contact details is not generally required by law or contract; however, without the mandatory form fields we cannot identify and answer a form inquiry. These notices will be updated when functionality or service providers change. Last updated: 29 October 2026.