Privacy policy | Neovac GmbH

1. Introduction

With the following information, we would like to give you as the "data subject" an overview of the processing of your personal data by us and your rights under the data protection laws. It is generally possible to use our website without entering personal data. However, if you wish to make use of special services of our company via our website, it may be necessary to process personal data. If the processing of personal data is necessary and there is no legal basis for such processing, we will generally obtain your consent.

The processing of personal data, such as your name, address or e-mail address, is always carried out in accordance with the General Data Protection Regulation (GDPR) and in accordance with the country-specific data protection regulations applicable to "NEOVAC GmbH". By means of this privacy policy, we would like to inform you about the scope and purpose of the personal data we collect, use and process.

2. Responsible person

The controller within the meaning of the GDPR is the:

NEOVAC GmbH
Seligenstädter Straße 100
63791 Karlstein
Phone: +49 6188 954 8000
E-mail: info[at]neovac.eu

3. Data protection officer

You can reach the data protection officer as follows:

Michael Mathias
Proba IT Solutions GmbH
Siemensstrasse 100
63755 Alzenau
E-mail: michael.mathias[at]proba-it.de

You can contact our data protection officer directly at any time with any questions or suggestions regarding data protection.

4. Legal basis of the processing

Art. 6 para. 1 lit. a) GDPR (in conjunction with. § Section 25 (1) TDDDG (formerly TTDSG)) serves our company as the legal basis for processing operations for which we obtain consent for a specific processing purpose.

If the processing of personal data is necessary for the performance of a contract to which you are a party, as is the case, for example, with processing operations that are necessary for the delivery of goods or the provision of another service or consideration, the processing is based on Art. 6 para. 1 lit. b) GDPR. The same applies to such processing operations that are necessary for the implementation of pre-contractual measures, for example in cases of inquiries about our products or services.

If our company is subject to a legal obligation which requires the processing of personal data, such as for the fulfillment of tax obligations, the processing is based on Art. 6 para. 1 lit. c) GDPR.

In rare cases, it may be necessary to process personal data in order to protect the vital interests of the data subject or another natural person. This would be the case, for example, if a visitor were injured in our company and their name, age, health insurance data or other vital information would have to be passed on to a doctor, hospital or other third party. The processing would then be based on Art. 6 para. 1 lit. d) GDPR.

Ultimately, processing operations could be based on Art. 6 para. 1 lit. f) GDPR. This legal basis is used for processing operations which are not covered by any of the abovementioned legal grounds, if processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. We are permitted to carry out such processing operations in particular because they have been specifically mentioned by the European legislator. In this respect, it took the view that a legitimate interest could be assumed if you are a customer of our company (Recital 47 Sentence 2 GDPR).

5. Transmission of data to third parties

Your personal data will not be transferred to third parties for purposes other than those listed below.

We only pass on your personal data to third parties if:

1. you have given us your express consent in accordance with Art. 6 para. 1 lit. a) GDPR,

2. the disclosure pursuant to Art. 6 para. 1 lit. f) GDPR is permissible to safeguard our legitimate interests and there is no reason to assume that you have an overriding interest worthy of protection in not disclosing your data,

3. in the event that there is a legal obligation for disclosure pursuant to Art. 6 para. 1 lit. c) GDPR, and

4. this is legally permissible and necessary for the processing of contractual relationships with you in accordance with Art. 6 para. 1 lit. b) GDPR.

In order to protect your data and, if necessary, to enable us to transfer data to third countries (outside the EU/EEA), we have concluded data processing agreements based on the European Commission's standard contractual clauses. If the standard contractual clauses are not sufficient to establish an adequate level of security, your consent may serve as the legal basis for the transfer to third countries in accordance with Art. 49 para. 1 lit. a) GDPR. This may not apply in the case of data transfer to third countries for which the European Commission has issued an adequacy decision pursuant to Art. 45 GDPR.

Your personal data will not be transferred to third parties for purposes other than those listed below.

We only pass on your personal data to third parties if:

1. you have given us your express consent in accordance with Art. 6 para. 1 lit. a) GDPR,

3. in the event that there is a legal obligation for disclosure pursuant to Art. 6 para. 1 lit. c) GDPR, and

4. this is legally permissible and necessary for the processing of contractual relationships with you in accordance with Art. 6 para. 1 lit. b) GDPR.

As part of the processing operations described in this privacy policy, personal data may be transferred to the USA. Companies in the USA only have an adequate level of data protection if they have certified themselves under the EU-US Data Privacy Framework and thus the adequacy decision of the EU Commission pursuant to Art. 45 GDPR applies. We have explicitly stated this for the service providers concerned in the privacy policy. In order to protect your data in all other cases, we have concluded data processing agreements based on the European Commission's standard contractual clauses. If the standard contractual clauses are not sufficient to establish an adequate level of security, your consent may serve as the legal basis for the transfer to third countries in accordance with Art. 49 para. 1 lit. a) GDPR. This may not apply in the case of data transfer to third countries for which the European Commission has issued an adequacy decision pursuant to Art. 45 GDPR.

6. Technology

6.1 SSL/TLS encryption

This site uses SSL or TLS encryption to ensure the security of data processing and to protect the transmission of confidential content, such as contact requests that you send to us as the operator. You can recognize an encrypted connection by the "https://" instead of "http://" in the address line of the browser and by the lock symbol in your browser line.

We use this technology to protect your transmitted data.

6.2 Cookies

Our Internet pages use so-called "cookies". Cookies are small text files and do not cause any damage to your end device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (permanent cookies). Session cookies are automatically deleted at the end of your visit. Permanent cookies remain stored on your end device until you delete them yourself or they are automatically deleted by your web browser.

In some cases, cookies from third-party companies may also be stored on your device when you visit our website (third-party cookies). These enable us or you to use certain services of the third-party company (e.g. cookies for processing payment services).

Cookies have various functions. Many cookies are technically necessary, as certain website functions would not work without them (e.g. the shopping cart function or the display of videos). Other cookies are used to evaluate user behavior or display advertising.

Cookies that are required to carry out the electronic communication process (necessary cookies) or to provide certain functions that you have requested (functional cookies, e.g. for the shopping cart function) or to optimize the website (e.g. cookies to measure the web audience) are stored on the basis of Art. 6 para. 1 lit. f GDPR, unless another legal basis is specified. The website operator has a legitimate interest in the storage of cookies for the technically error-free and optimized provision of its services. If consent to the storage of cookies has been requested, the cookies in question are stored exclusively on the basis of this consent (Art. 6 para. 1 lit. a GDPR); consent can be revoked at any time.

You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general and activate the automatic deletion of cookies when closing the browser. If cookies are deactivated, the functionality of this website may be restricted.

If cookies are used by third-party companies or for analysis purposes, we will inform you about this separately in this privacy policy and, if necessary, request your consent.

6.4 Hosting

We host our website with a specialized service provider within the EU, in detail with

Strato AG, Pascalstraße 10, 10587 Berlin (hereinafter: "Strato").

When you visit our website, Strato records various log files including your IP addresses.

Further information can be found in Strato's privacy policy: https://www.strato.de/datenschutz/.

The use of Strato is based on Art. 6 para. 1 lit. f GDPR. We have a legitimate interest in ensuring that our website is displayed as reliably as possible. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR; the consent can be revoked at any time.

We have concluded a data processing agreement (DPA) with the above-mentioned provider. This is a contract prescribed by data protection law, which ensures that the provider only processes the personal data of our website visitors in accordance with our instructions and in compliance with the GDPR.

6.5 Server log files

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us.

These are:

Browser type and browser version
Operating system used
Referrer URL
Host name of the accessing computer
Time of the server request
IP address

This data is not merged with other data sources.

This data is collected on the basis of Art. 6 para. 1 lit. f GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimization of its website - the server log files must be recorded for this purpose.

7. Consent with cookie notice & compliance

Our website uses the consent technology of Cookie Notice & Compliance for GDPR to obtain your consent to the storage of certain cookies on your end device or to the use of certain technologies and to document this in compliance with data protection regulations.

The provider of the tool is Hu-manity Rights Inc, 300 Carnegie Center, Suite 150, Princeton, NJ, New Jersey 08540, USA (hereinafter "Hu-manity Rights Inc."). When you enter our website, a connection is established to the servers of Hu-manity Rights Inc. in order to obtain your consent and other declarations regarding the use of cookies. Hu-manity Rights Inc. then stores a cookie in your browser in order to be able to assign the consents given or their revocation to you. The data collected in this way is stored until you ask us to delete it, delete the Hu-manity Rights Inc. cookie yourself or the purpose for data storage no longer applies. Mandatory statutory retention obligations remain unaffected.

Cookie Notice & Compliance for GDPR is used to obtain the legally required consents for the use of cookies. The legal basis for this is Art. 6 para. 1 lit. c GDPR.

Further information on the use of Complianz can be found at: https://complianz.io/legal/

8. Contact by e-mail, telephone or fax

If you contact us by e-mail, telephone or fax, we will store and process your inquiry, including all personal data (name, inquiry), for the purpose of processing your request. We will not pass on this data without your consent.

This data is processed on the basis of Art. 6 para. 1 lit. b GDPR if your request is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of the inquiries addressed to us (Art. 6 para. 1 lit. f GDPR) or on your consent (Art. 6 para. 1 lit. a GDPR) if this has been requested.

The data you send to us via contact requests will remain with us until you ask us to delete it, revoke your consent to storage or the purpose for data storage no longer applies (e.g. after your request has been processed). Mandatory statutory provisions - in particular statutory retention periods - remain unaffected.

9. Your rights as a data subject

9.1 Right to information Art. 15 GDPR

You have the right to receive free information from us at any time about the personal data stored about you and a copy of this data in accordance with the statutory provisions.

9.2 Right to rectification Art. 16 GDPR

You have the right to request the rectification of inaccurate personal data concerning you. You also have the right to request the completion of incomplete personal data, taking into account the purposes of the processing.

9.3 Deletion Art. 17 GDPR

You have the right to demand that we delete the personal data concerning you immediately, provided that one of the reasons provided by law applies and insofar as the processing or storage is not necessary.

9.4 Restriction of processing Art. 18 GDPR

You have the right to demand that we restrict processing if one of the legal requirements is met.

9.5 Data portability Art. 20 GDPR

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from us to whom the personal data has been provided, provided that the processing is based on consent pursuant to Art. 6 para. 1 lit. a) GDPR or Art. 9 para. 2 lit. a) GDPR or on a contract pursuant to Art. 6 para. 1 lit. b) GDPR and the processing is carried out by automated means, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

Furthermore, when exercising your right to data portability pursuant to Art. 20 (1) GDPR, you have the right to obtain that the personal data be transferred directly from one controller to another controller, insofar as this is technically feasible and provided that this does not adversely affect the rights and freedoms of other persons.

9.6 Objection Art. 21 GDPR

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Art. 6 (1) (e) (data processing in the public interest) or (f) (data processing on the basis of a balancing of interests) GDPR.

This also applies to profiling based on these provisions within the meaning of Art. 4 No. 4 GDPR.

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or if the processing serves the establishment, exercise or defense of legal claims.

In individual cases, we process personal data for the purpose of direct advertising. You can object to the processing of your personal data for the purpose of such advertising at any time. This also applies to profiling insofar as it is associated with such direct advertising. If you object to processing for direct marketing purposes, we will no longer process the personal data for these purposes.

You also have the right to object, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out by us for scientific or historical research purposes or for statistical purposes in accordance with Art. 89 para. 1 GDPR, unless such processing is necessary for the performance of a task carried out in the public interest.

You are free to exercise your right to object in connection with the use of information society services, notwithstanding Directive 2002/58/EC, by means of automated procedures using technical specifications.

9.7 Revocation of consent under data protection law

You have the right to withdraw your consent to the processing of personal data at any time with effect for the future.

9.8 Complaint to a supervisory authority

You have the right to lodge a complaint about our processing of personal data with the supervisory authority responsible for data protection.

10. Storage duration, deletion and blocking

We process and store your personal data only for the period of time required to achieve the purpose of storage or if this is provided for by the legal regulations to which our company is subject.

If the storage purpose no longer applies or if a prescribed storage period expires, the personal data will be routinely blocked or deleted in accordance with the statutory provisions.

The criterion for the duration of the storage of personal data is the respective statutory retention period. After this period has expired, the corresponding data is routinely deleted, provided that it is no longer required for contract fulfillment or contract initiation.

11. Updating and amending the privacy policy

This privacy policy is valid as of September 2025.

It may become necessary to amend this privacy policy as a result of the further development of our website and services or due to changes in legal or official requirements.

The current privacy policy can be viewed at any time on the website at:

> https://neovac.eu/privacy-policy

can be retrieved and printed out by you.

You can contact our data protection officer directly at any time with any questions or suggestions regarding data protection. E-mail: michael.mathias[at]proba-it.de