Privacy Policy

Privacy Notice

Envalior is committed to processing the personal information of website users, business partners, job candidates and other persons who interact with us in compliance with applicable laws, specifically GDPR (herein-after: “You”). We have implemented various technical and organizational measures to protect any personal data that it processes. This document summarizes how Envalior collects, stores, uses, discloses, or transfers (hereinafter “processes” or "processing") your data. What personal data we collect from you depends on the purpose of your interaction with us.

This document also constitutes the information for data subjects according to Articles 13-14 GDPR.

1. General data processing information

Personal data is only collected if you communicate it to us yourself. Apart from that, no personal data is collected. Any processing of your personal data that goes beyond the scope of the statutory permission is only possible based on your express consent.

• Processing purpose: Contract execution.
• Categories of recipients: Public authorities in the event of priority legislation; external service providers or other contractors; other external bodies in so far as the data subject has given his consent or a transmission is permitted due to a prevailing interest.
• Third-country transfers: As part of contractual execution, we use processors residing outside of the European Union.
• Storage duration: The duration of data storage depends on the statutory storage requirements and is usually 10 years.

2. Specific website data processing information

2.1 Newsletter 

When you subscribe to our newsletter, You provide us with your email address and optionally also  with other information. We use this data to interact with you regarding our product offerings. We retain the data that you disclose in your newsletter application until you cancel your subscription to our newsletter. You can unsubscribe at any time using a link in the newsletter, or by notifying us by Email. In case you opt out of receiving any email newsletter from us, we may store your contract information on a special list that is specifically designed to prevent any further communication with you.

We also use your email address, which we receive in connection with the sale of a product or service, exclusively for direct advertising in the form of our newsletter for products or services that we sell that are like the ones you ordered if you have not objected to receiving such communication. You may object to the use of your email address at any time free of charge. Your objection (and thus the cancellation of our newsletter) can be communicated by sending the appropriate message to our email address (see below).

2.2 Website Logging

When you visit our websites, your browser transmits certain technical data to our web server. We record that data when you interact with our web server:

• Date and time of your request.
• Name of the requested file or information.
• Page from which the file was requested.
• Access status (file transferred, file not found, etc.).
• Type and version of the browser and the operating system you use.
• IP address of the requesting computer.
• Quantity of data transferred.

For technical and security reasons, in particular to maintain the integrity of our services, we store this data for a defined period of time. The anonymized data will also be processed for statistical purposes in an aggregated manner. 

2.3 Use of Cookies 

This website uses cookies in your browser to store the settings required to display the content of this website. Further details are contained in our cookie information. You can prevent the use of cookies by disabling that functionality in your browser; however, our site may not work without certain functional cookies being enabled.

3. Other Data Processing Procedures

3.1 Job Applicants and Candidates 

• Affected data: Application information.
• Processing Purpose: Implementation of application process.
• Categories of recipients: Public authorities in the event of priority legislation; external service providers or other contractors; other external bodies in so far as the data subject has given his consent or a transmission is permitted due to a prevailing interest.
• Third-country transfers: As part of contractual execution, processors located outside of the European Union are used.
• Duration of data storage: Application data will generally be deleted within four months after communication of the decision unless consent has been given for a longer period of data storage.

3.2 Customers and Prospects 

• Affected data: Data communicated for contract execution; if necessary, additional data for processing based on your express consent.
• Processing Purpose: Contract execution.
• Categories of recipients: Public authorities in the event of priority legislation; external service providers or other contractors; other external bodies in so far as the data subject has given his consent or a transmission is permitted due to a prevailing interest.
• Third-country transfers: As part of contractual execution, processors could also be used outside the European Union.
• Duration of data storage: The duration of data storage depends on the statutory storage requirements and is usually 10 years. 

3.3 Employees

• Affected data: Data communicated for contract execution; if necessary, additional data for processing based on your express consent.
• Processing Purpose: Contract execution.
• Categories of recipients: Public authorities in the event of priority legislation, external service providers or other contractors; other external bodies in so far as the data subject has given his consent or a transmission is permitted due to a prevailing interest.
• Third-country transfers: As part of contractual execution, processors could also be used outside the European Union.
• Duration of data storage: The duration of data storage depends on the statutory storage requirements and is usually 10 years. 

3.4 Suppliers

• Affected data: Data communicated for contract execution; if necessary, additional data for processing based on your express consent.
• Processing Purpose: Contract execution.
• Categories of recipients: Public authorities in the event of priority legislation; external service providers or other contractors; other external bodies in so far as the data subject has given his consent or a transmission is permitted due to a prevailing interest.
• Third-country transfers: As part of contractual execution, processors could also be used outside the European Union.
• Duration of data storage: The duration of data storage depends on the statutory storage requirements and is usually 10 years. 

3.5 Use of Videoconferencing Software

• Affected data: Data provided for the use of the videoconferencing software or webinar software (first name, surname, e-mail address; optionally: sound transmission, image transmission, questions when using chat functions); if technically necessary, processing of data from your system to establish the connection to the provider of the conference software.
• Purpose / Legal basis: Conducting video conferences and webinars.
• Categories of recipients: Public authorities in the event of priority legislation. External service providers or other contractors. Other external bodies in so far as the data subject has given his consent or a transmission is permitted due to a prevailing interest.
• Third-country transfers: As part of contractual execution, processors could also be used outside the European Union. 
• Duration of data storage: The duration of data storage depends on the statutory storage requirements and is usually 10 years. 

4. Transfer and Disclosure of Personal Data

We transfer your personal data to the following partners and sub-processors (listed in section 4) as follows:

• Affiliates: When we disclose your personal information to our Affiliates (the members of the Envalior group of Companies), we assume joint controllership and responsibility with the respective Affiliate(s) for such processing in accordance with Article 26 GDPR.

• Sales partners: As necessary to conduct business with you, we may disclose your personal data to third parties (for example, affiliates, distributors, partners, and agents). These companies are considered our sub-processors, and they process your personal data under our supervision, and they are our sub-processors.

• Suppliers and Service Providers: We contract with suppliers or service partners to perform certain activities for us or on our behalf, such as packaging, shipping, or IT-related services (e.g., cloud platform providers). We employ consultants who assist us in running our business. These providers are considered our sub-processors, and they process your personal data under our supervision and are bound to confidentiality.

• Other Third Parties: We may transfer your personal data to other third parties to perform certain services on our behalf. We contract with external advisors who help us establish a legal claim or defend ourselves against a legal claim. They are also our sub-processors and bound to confidentiality.

We may transfer personal data outside of your country of residence. Personal information you provide us with may be accessible globally to other registered users of our systems. In case we process your personal data outside of the European Union, we generally require a sub-processor to execute the EU Standard Contractual Clauses with us or to implement binding corporate rules in its organization.

5. Envalior Sub-Processors

The following table identifies the Sub-Processors used by Envalior, the reason, and the country of residence of the sub processor.

6. Automated Decision-Making and Profiling

Envalior does not use tools for automated decision-making or profiling (as defined by Article 4 GDPR) on human beings.

7. Data Retention

We store personal data in accordance with applicable law and retention periods as required by applicable laws. After the expiration of the statutory retention period, personal data is being routinely deleted.

8. Security

To protect your personal data from untheorized access or disclosure, we use adequate organizational, physical, and technical protection measures.

9. Your rights

Towards us, you have the rights stipulated by the data processing laws that apply to you. You have the right to inquire with us to which extent we store and process your personal data. You can request us to transfer your personal data in accordance with GDPR. You have the right to request us to correct any personal information that we have inaccurately recorded. You have the right to request us to delete your personal data in the absence of a retention obligation. You can also at any time withdraw your consent to our processing of your personal data or instruct us to stop processing your personal data regarding which we do not require further contractual or statutory processing rights.

10. Children

Envalior does not solicit or knowingly collect, process, or use any information on our website from individuals whom we know to be under 16 years of age without having previously obtained the verifiable consent of a legal guardian. If required, legal guardians can access the information provided by their child and/or demand that this information be erased by contacting us.

11. Contact Information

The data controller according to GDPR or other global data privacy laws is Envalior GmbH, Flughafenstraße 101, 40474 Düsseldorf, Germany.

Our Data Privacy Officer can be reached at privacy <at> envalior.com. If you would like to contact us anonymously, please use our SpeakUp portal. Furthermore, you can raise any potential concern with the responsible data privacy authority in your country of residence.

Last update of this document: January  2025