Privacy Policy

Curavia is a brand of DRIVTO GmbH.

Below you will find information about what types of personal data we process, to what extent, and for what purposes.

• Inventory data (e.g., names and addresses)
• Contact data (e.g., phone numbers and email addresses)
• Usage data (e.g., access times, pages visited)
• Metadata (e.g., browser type, IP address, operating system)
• Content data (e.g., your text inputs in contact forms, etc.)

• Customers
• Prospects
• Users (website/online offerings)

• Information
• Communication
• Customer service
• Services for contract fulfillment
• Direct marketing / Marketing
• (Technical) provision of the online offering
• Security measures to protect the (online) offering
• Reach measurement to improve the offering

• Consent according to Art. 6 Para. 1 lit. a GDPR — the data subject has given consent to the processing of their personal data for one or more specific purposes.
• Contract fulfillment and pre-contractual inquiries according to Art. 6 Para. 1 lit. b GDPR — processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
• Legal obligations according to Art. 6 Para. 1 lit. c GDPR — processing is necessary for compliance with a legal obligation to which the controller is subject.
• Legitimate interest according to Art. 6 Para. 1 lit. f GDPR — processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

Your data generally remains within our company. The transfer or disclosure of your personal data to a third party only takes place

• on the basis of a legal permission,
• through your consent,
• if we are legally obligated to do so, or
• on the basis of a legitimate interest according to Art. 6 lit. f GDPR.

Our data processors are obligated by data processing agreements according to Art. 28 GDPR to comply with the necessary technical and organizational measures to ensure the protection of the rights of data subjects.

The transfer of your personal data to third countries (outside the European Union (EU) / European Economic Area) only takes place to countries for which an adequacy decision by the EU Commission exists, for which appropriate safeguards within the meaning of Art. 46 GDPR exist, that provide an adequate level of protection according to Art. 45 ff. GDPR, subject to officially recognized contractual obligations such as the so-called 'Standard Contractual Clauses', or for which one of the exceptions according to Art. 49 GDPR applies.

Your personal data will be routinely deleted or restricted in processing or blocked at the latest after the expiry of the respective statutory retention periods (e.g., commercial and tax retention periods), provided that this data is no longer necessary for contract fulfillment and/or there is no legitimate interest on our part for further storage.

When visiting our website and using our app, the following information is automatically transmitted from your browser to our provider's server:

• IP address of your device
• Date and time of access
• Name and URL of retrieved files
• Website from which access was made or from where you were directed to our site (referrer URL)
• Browser used and, if applicable, the operating system of your device
• Name of the access provider

This data is not merged with other data sources. The IP address is anonymized.

The collection of this data is carried out to ensure the proper use of the website, to optimize the website and app, and to ensure the security of our IT systems. Our legitimate interest in data processing according to Art. 6 Para. 1 lit. f GDPR also lies in these aforementioned purposes.

This data is regularly deleted automatically. In case of misuse of the website or app, the relevant data, whose further storage is necessary for evidentiary purposes, will be retained until the matter is clarified.

We use the hosting service of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen for the purpose of providing the website on the basis of processing on our behalf. All data collected on our website is processed on Hetzner's servers. Further information on Hetzner's data protection can be found at https://www.hetzner.com/de/legal/privacy-policy

This website uses cookies. These are small text files that are stored in the internet browser or by the internet browser on the user's device. When a user accesses a website, a cookie can be stored on the user's operating system. This cookie contains a characteristic string that enables unique identification of the browser when the website is accessed again.

Session cookies are functionally necessary cookies that do not require consent, as they are automatically deleted when leaving the homepage. The legal basis for this processing is Art. 6 Para. 1 lit. f GDPR.

Permanent cookies remain on the device. This allows, for example, the login status to be checked or preferred content to be displayed. In addition, the data processed here can be used for reach measurements. The legal basis for this processing is Art. 6 Para. 1 lit. a GDPR, thus requiring the user's consent.

The user is informed about the use of cookies for analysis purposes when accessing our website and their consent to the processing of personal data used in this context is obtained. The user can revoke their consent at any time via the cookie settings and object to the processing of their personal data. In addition, the user's objection can also be made via the corresponding settings of their browser.

Our website may use various services from Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland. Google Ads is used to display advertisements in the Google search engine or on third-party websites when the user enters certain search terms on Google (keyword targeting).

The use of the above-mentioned services is based on your consent according to Art. 6 Para. 1 lit. a GDPR and on the basis of our legitimate interest according to Art. 6 Para. 1 lit. f GDPR. You can revoke your consent at any time with effect for the future by accessing the cookie settings and changing your selection there. The lawfulness of the processing carried out on the basis of the consent until the revocation remains unaffected.

The data we send and that is linked to cookies is automatically deleted after 2 months. The maximum lifetime of cookies is 2 years. Data whose retention period has been reached is automatically deleted once a month.

By integrating these Google services, personal data, such as your IP address, can be transferred to Google. Recipients of the data may be Google LLC and Alphabet Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. For the third country transfer to the USA, the European Commission adopted its adequacy decision on July 10, 2023. Google LLC is certified under the EU-US Privacy Framework. Since Google servers are distributed worldwide and a transfer to third countries cannot be completely ruled out, we have also concluded the EU Standard Contractual Clauses with the provider.

The use of our website is generally possible without providing personal data. If you contact us through other means, such as a contact form, email, or telephone, the data collected here will be treated confidentially and will not be passed on to third parties without consent.

The data will be deleted as soon as it is no longer necessary for the purpose for which it was collected. For personal data sent by email, this is the case when the respective conversation with the user has ended.

If a contact form is used, the data entered in the input mask is transmitted to us and stored (name, email address), as well as the user's IP address, date and time of the message, browser and device. The user has the option at any time to object to the processing of personal data. In such a case, the conversation cannot be continued and all personal data stored in connection with the contact will be deleted.

Registration and creation of a profile is necessary to use our portal. We process the data collected during registration on the basis of Art. 6 Para. 1 lit. b GDPR for the fulfillment of a contract or the implementation of pre-contractual measures, as well as on the basis of Art. 6 Para. 1 lit. f GDPR to protect our legitimate interests, in particular to ensure the security and functionality of our portal.

For registration, we use the double opt-in procedure. This means that after you provide your email address, you will receive a confirmation email from us asking you to confirm your registration. Only after successful confirmation will your account be activated.

If you have given us your consent, we use your email address and, if applicable, other contact data that you provide during the registration process to regularly send you information and offers that may be of interest to you. The legal basis for this processing is Art. 6 Para. 1 lit. a GDPR. You have the right at any time to object to the use of your data for direct marketing purposes by email to info@drivto.com. After receiving your objection, we will immediately stop processing your data for this purpose.

Registration for our newsletter is done using the so-called double opt-in procedure. After entering your email address on our website, an email is sent to the specified address asking you to confirm it.

• Email address
• IP address of the calling computer
• Date and time of registration
• Browser and device

Newsletter registration is based on the user's consent according to Art. 6 Para. 1 lit. a GDPR. The purpose of data processing is the proper delivery of the newsletter using the user's email address. In addition, the processing of other personal data during the registration process serves to prevent misuse of the service or email address.

You can cancel your subscription at any time. Every email contains an unsubscribe link that works without login.

The data of our contract and business partners is primarily processed by us to fulfill our contractual obligations and for communication. In addition, processing takes place for proper and economical business management and to protect our rights. Processing therefore takes place for contract fulfillment and pre-contractual inquiries according to Art. 6 Para. 1 lit. b GDPR, from legal obligation according to Art. 6 Para. 1 S. 1 lit. c GDPR or from legitimate interests according to Art. 6 Para. 1 S. 1 lit. f GDPR. The disclosure of data to third parties only takes place if it is necessary to fulfill legal obligations or if this is stated in the contract or this privacy policy.

For communication and information purposes for users and for advertising purposes, we are present on Facebook, Instagram, YouTube and LinkedIn. The processing of data obtained via social media presence is carried out by us only for the purposes mentioned, on the legal basis of the voluntary information provided by the data subject according to Art. 6 Para. 1 lit. a GDPR, the fulfillment of a contract or the implementation of pre-contractual measures according to Art. 6 Para. 1 lit. b GDPR, or the legitimate interest in the effective processing of inquiries according to Art. 6 Para. 1 lit. f GDPR.

The operators of social networks generally process user data for market research and advertising purposes. For more information on processing, objection options, and assertion of data subject rights, please refer to the privacy policies of the respective provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; LinkedIn Ireland Unlimited Company, Wilton Plaza Wilton Place, Dublin 2, Ireland.

As a data subject, you have the option to assert your rights in connection with the General Data Protection Regulation against us. These include the following rights:

• Right of Access according to Article 15 GDPR — you can request information about your data stored with us, in particular about processing purposes, categories of data and recipients, the planned storage period, the existence of a right to rectification, erasure, restriction or objection, the right to lodge a complaint, the origin of your data, and the existence of automated decision-making including profiling.
• Right to Rectification according to Article 16 GDPR — if we have stored incorrect data about you, you can request its correction or completion.
• Right to Erasure according to Article 17 GDPR — you can request the deletion of your personal data stored with us, provided that processing is not necessary for exercising the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defense of legal claims.
• Right to Restriction of Processing according to Article 18 GDPR.
• Right to Data Portability according to Article 20 GDPR — you can receive the data stored about you in a structured, commonly used and machine-readable format or request its transmission to another controller.
• Right of Withdrawal for Consents according to Art. 7 Para. 3 GDPR — you can revoke consent at any time with effect for the future.
• Right to Object according to Article 21 GDPR — where processing is based on legitimate interests, you can object for reasons arising from your particular situation; against direct marketing you have a general right to object.

If you wish to exercise your right of withdrawal or objection, an email to info@drivto.com is sufficient.

You have the right to lodge a complaint with a supervisory authority. You can contact the supervisory authority of your usual place of residence or workplace or our registered office for this purpose.

This privacy policy is currently valid and has the status of August 22, 2024.