LEGAL
Privacy policy
As of: 1 January 2026. This statement describes how Caventi (Voldeq GmbH) processes personal data.
Controller
The controller within the meaning of the DSGVO is:
Voldeq GmbH, Lätternweg 47, 3052 Zollikofen, Switzerland. Commercial register Bern, UID CHE-381.670.996.
Data protection contact: [email protected].
Note on our roles: For this website, for enquiries and for the accounts of our customers, we are the controller. For the personal data that an employer, as a customer, processes in the application (in particular employee data and acknowledgements of operating instructions), the employer is responsible and Caventi acts as a processor (see the section "Processing on behalf of customers").
Scope
This statement applies to the website caventi.eu and the associated application. It describes which personal data we process, for what purpose, on what legal basis and which rights you have.
Which data we process
Depending on how you interact with us, we process the following categories:
- Server and log data: When the website is accessed, our hosting provider processes technically necessary data such as IP address, date/time, requested resource and user agent, in order to ensure delivery and security.
- Analytics data (only with consent): If you agree, we collect pseudonymous usage data with PostHog (e.g. pages visited, clicks, device/browser) for reach measurement and product improvement.
- Enquiry and lead data: For a demo request or trial access, we process name, company, work email, number of employees and country.
- Account and application data: To use the application, we process name, email, language, role/membership, session and login data (passwordless magic-link login) as well as interface settings.
- Employee acknowledgements (as a processor): When an employee confirms reading an operating instruction, their identifier/name, document version, language and timestamp are logged. The employer is responsible for this.
- Contact data: When you write to us by email, we process your details to handle the enquiry.
Purposes and legal bases
We process personal data on the basis of the EU General Data Protection Regulation (GDPR) in conjunction with the Federal Data Protection Act (BDSG). Depending on the processing, we rely on contract, legitimate interest, consent or legal obligation.
| Purpose | Legal basis |
|---|---|
| Provision and security of the website | Legitimate interest (Art. 6 Abs. 1 lit. f DSGVO) |
| Reach measurement/analytics (PostHog) | Consent (§ 25 Abs. 1 TDDDG; Art. 6 Abs. 1 lit. a DSGVO) |
| Handling of demo/trial/contact enquiries | Initiation/performance of a contract (Art. 6 Abs. 1 lit. b DSGVO) or consent |
| Provision of the account and the application | Performance of a contract (Art. 6 Abs. 1 lit. b DSGVO) |
| Fulfilment of legal obligations | Legal obligation (Art. 6 Abs. 1 lit. c DSGVO) |
| Acknowledgements on behalf of the employer | Processing on behalf of the employer (Art. 28 DSGVO); the employer is the controller |
Recipients and processors
We only pass on data insofar as this is necessary for the provision of the service. Contracts under Art. 28 DSGVO are in place with all processors. We provide a current list of sub-processors on request.
| Recipient | Purpose | Location |
|---|---|---|
| Google Cloud (Compute Engine, Cloud Storage) | Hosting of the application and data | Germany (Frankfurt, europe-west3) |
| Firebase Hosting (Google) | Delivery of the website | EU/USA |
| PostHog Inc. | Web/product analytics (only with consent) | USA |
| Cal.com, Inc. | Appointment booking for demos | USA |
| Twilio SendGrid | Transactional emails (login/invitation links) | USA/EU |
| OpenAI | Reading of safety data sheets (text) | USA |
Public data sources
For the technical enrichment of substance data, we query public sources (GESTIS/IFA-DGUV, ECHA, PubChem and the BAuA). These queries are made using substance designations/CAS numbers and contain no personal data.
Transfer to third countries
Some services (e.g. PostHog, OpenAI, Cal.com, possibly Google) process data in the USA. Insofar as the respective provider is certified under the EU-US Data Privacy Framework, we base the transfer on the adequacy decision of the EU Commission. In addition and as a fallback, we agree the EU Standard Contractual Clauses (SCC) together with supplementary protective measures; you can obtain a copy of the Standard Contractual Clauses on request at [email protected]. We only trigger the US data transfer for analytics after your consent.
Storage period and deletion
We process personal data only for as long as is necessary for the respective purpose or for legal obligations, and we delete or anonymise it afterwards.
- Server and log data: technically necessary logs (including IP address) are kept only briefly for delivery and abuse prevention, and are deleted or anonymised regularly, at the latest after 30 days.
- Analytics data (PostHog): pseudonymous usage data is deleted or aggregated after no more than 12 months.
- Sessions and magic-link tokens: short-lived; expired/used tokens are regularly deleted automatically.
- Enquiry/lead data: until the enquiry is handled and for the duration of the business initiation.
- Account data: for the duration of the contract; on account deletion, identity data is deleted or anonymised.
- Acknowledgements of operating instructions: These occupational-safety records are subject to retention obligations. When a person is deleted, the link is anonymised; the record itself is retained.
- Contact and email correspondence: until your request has been handled, and thereafter within statutory retention periods.
Your rights
You have, in particular, the following rights:
- information about the data processed about you,
- rectification of inaccurate data,
- erasure or destruction,
- restriction of processing,
- data portability/release of data,
- objection to processing based on legitimate interests, and
- withdrawal of consent given, with effect for the future.
Right to object (Art. 21 DSGVO)
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is based on Art. 6 Abs. 1 lit. f DSGVO (legitimate interest). We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
Self-service in the application
Logged-in users can export their personal data in the application under "Account" as a machine-readable file and have their account deleted. For all other matters, you can reach us at [email protected].
Right to complain
You have the right to complain to a data protection supervisory authority, in particular in the member state of your place of residence, workplace or the alleged infringement.
Processing on behalf of customers
Insofar as an employer uses the application and thereby processes employee data, the employer is the controller and Caventi the processor. The basis is a data processing agreement (AVV/DPA) under Art. 28 DSGVO. Affected employees address their concerns to their employer; we support the employer in fulfilling them.
No automated decision in individual cases
A decision based solely on automated processing with legal effect or similarly significant impact does not take place. The technical derivations of the application are decision support; responsibility for measures remains with the employer.
Data security
We take appropriate technical and organisational measures: strict tenant separation (Row-Level-Security), encryption of the transmission (TLS), hashed session and login tokens, multi-factor authentication for operator access, EU data storage and encrypted, off-site backups.
Changes to this statement
We adapt this statement when the processing or the legal situation changes. The version published on this page at the time applies.