Privacy policy

ALVPHA Tech GmbH, Schillerstraße 21, 73054 Eislingen/Fils, Germany. Phone: +49 7161 6275129, email: contact@alvpha-upstream.com.

We process personal data only to the extent necessary to provide a functional website and to handle your enquiries. Depending on the operation, the legal bases are Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (pre-contractual measures and performance of a contract) and Art. 6(1)(f) GDPR (legitimate interest in the secure, stable operation of the website and in responding to business enquiries). You are not obliged to provide data; without the fields marked as required, however, we cannot process an enquiry.

This website is aimed at companies, public authorities and other organisations. No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place.

The website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA, and delivered via its content delivery network. When you access the site, technically necessary data is processed: IP address, date and time, page accessed, data volume, browser type and operating system, and the referring page. This data is used solely for delivery, security (e.g. defending against attacks) and error analysis; it is not combined with other data sources and not used for audience measurement. The legal basis is Art. 6(1)(f) GDPR.

A data processing agreement pursuant to Art. 28 GDPR is in place with Vercel. Vercel is certified under the EU-US Data Privacy Framework (adequacy decision of the EU Commission of 10 July 2023, Art. 45 GDPR); the EU Commission's standard contractual clauses apply in addition (Art. 46(2)(c) GDPR).

Server logs are retained by the hosting provider only briefly for security and operational purposes.

If you contact us by email, we process your details (name, email address, company where applicable, content of the message) to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR where the enquiry is aimed at concluding a contract, otherwise Art. 6(1)(f) GDPR. Our mailboxes are operated by ALL-INKL.COM (Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany) on servers in Germany; a data processing agreement is in place with ALL-INKL. Incoming enquiries to contact@alvpha-upstream.com are recorded in our CRM system HubSpot (section 6) for processing.

Please do not submit confidential files, source code or security details through public contact channels. We agree suitable exchange channels in advance.

To arrange an introductory call we link to a HubSpot scheduling page (meetings-eu1.hubspot.com). This page is not embedded in our website; data is only transferred once you open the link. HubSpot's privacy policy additionally applies to the scheduling page. We process the details you enter (name, email address, selected time, optional information) to prepare and conduct the call on the basis of Art. 6(1)(b) GDPR. The call itself takes place via Google Meet; you receive the dial-in details with the booking confirmation.

We use HubSpot, a service of HubSpot Ireland Ltd., 1 Sir John Rogerson's Quay, Dublin 2, Ireland (parent company: HubSpot, Inc., Cambridge, USA), to handle enquiries and customer communication. Our HubSpot account is operated in the EU data centre. A data processing agreement pursuant to Art. 28 GDPR is in place with HubSpot. Where data is processed by HubSpot, Inc. in the USA in the course of support or operations, this is safeguarded by HubSpot's certification under the EU-US Data Privacy Framework (Art. 45 GDPR) and additionally by standard contractual clauses (Art. 46(2)(c) GDPR).

In HubSpot we store the details from your enquiry, the history of our communication, and notes and tasks for processing. An enquiry does not constitute a newsletter subscription and does not lead to marketing communication without your separate consent. No HubSpot tracking code or HubSpot cookies are used on this website.

You can send us your request via the enquiry form. Required fields are first name, last name, business email address, company, topic and message; the planned timeframe is optional. The details are transmitted to our server in encrypted form and forwarded from there to our CRM system HubSpot (section 6), where they are stored as a contact and enquiry. No HubSpot script is loaded in your browser and no cookies are set; we transmit neither your IP address nor tracking identifiers to HubSpot.

The legal basis is your consent via the checkbox in the form (Art. 6(1)(a) GDPR) and, where your enquiry is aimed at concluding a contract, Art. 6(1)(b) GDPR. You may withdraw your consent at any time with effect for the future, for example by emailing contact@alvpha-upstream.com; the lawfulness of processing carried out until then remains unaffected.

To protect against automated submissions, the form contains a field invisible to humans and a minimum completion time; no additional data is collected for this.

On the page /en/trust-check you can submit a structured self-assessment across seven dimensions of your software inventory. No personal data is required for the evaluation: the only required entries are your role, the trigger and one status per dimension; company name, software context and type of evidence are optional. Please do not enter personal data, confidential information, credentials or source code in the free-text fields.

Your answers are transmitted to our server in encrypted form and sent from there to the Azure OpenAI service of Microsoft (Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) to generate the Trust Snapshot automatically. Processing takes place in an Azure region in the European Union selected by us; a data processing agreement pursuant to Art. 28 GDPR (Microsoft Products and Services Data Protection Addendum) is in place with Microsoft. Microsoft does not use the inputs to train AI models. For abuse detection, Microsoft may store inputs and outputs for up to 30 days unless this monitoring is disabled for our resource. No Microsoft script is loaded in your browser and no cookies are set; your IP address is not transmitted to Microsoft.

The result is displayed to you immediately in your browser. We store neither your answers nor the generated snapshot on our servers and do not pass them to our CRM system. A snapshot ID serves only to let you refer to your result if you voluntarily contact us later. To prevent abuse and limit costs, we count requests per connection briefly in a shortened, non-reversible form (hash of the IP address with a random salt, in memory only, for at most one hour).

The Trust Snapshot is an automatically generated orientation based on your self-assessment and contains no legally binding evaluation; it does not constitute a decision with legal effect within the meaning of Art. 22 GDPR. The legal basis is Art. 6(1)(b) GDPR (provision of the result you requested) and Art. 6(1)(f) GDPR (protection against abuse and cost control).

This website does not set cookies and does not use analytics or tracking services. Language selection is handled solely through separate URL paths (/ and /en).

A short notice is shown on your first visit. When you close it, your browser stores locally (localStorage, key "alvpha-upstream-notice") only the fact that the notice has been displayed. This entry contains no personal data, is not transmitted to us and is strictly necessary for the use you requested (Section 25(2) No. 2 TDDDG). You can delete it at any time in your browser settings.

The website links to company profiles of ALVPHA Tech GmbH on LinkedIn, Facebook, Instagram, X, TikTok, Reddit and YouTube. These are plain links, not embedded plugins or content from these providers. No data is transferred to these platforms when you merely visit our website; only when you open a link do the privacy policies of the respective platform apply.

Should we introduce services requiring consent in the future, we will activate them only after your prior consent and update this policy accordingly.

The fonts used are served locally from our server. No connection is made to servers of Google or other font providers.

Server logs are retained by the hosting provider only briefly. We store enquiry data for as long as necessary to handle the enquiry and for any subsequent business relationship. If no engagement results, we generally delete the data no later than twelve months after the last contact, unless statutory retention obligations (in particular Section 147 AO, Section 257 HGB) require otherwise. If you withdraw consent, we delete the affected data without undue delay unless another legal basis permits continued storage.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on Art. 6(1)(f) GDPR (Art. 21). You may withdraw any consent given at any time with effect for the future (Art. 7(3) GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany, www.baden-wuerttemberg.datenschutz.de.

To exercise your rights, contact contact@alvpha-upstream.com or write to the address given in section 1.

This English version is provided for convenience. The German version is authoritative.