Privacy Policy

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Dr. Ali Behravan GreeNovaX (“GreeNovaX”, “we”)
Owner: Dr.-Ing. Ali Behravan
Engsbachstraße 76
57076 Siegen, Germany
Email: ali.behravan@greenovax.de
Phone: +49 271 23572999

We are not legally required to appoint a data protection officer (Section 38 BDSG) and have not appointed one.

2. Overview

We process personal data only in accordance with the statutory provisions, in particular the GDPR, the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG). This website uses no advertising or marketing cookies, no external analytics services (such as Google Analytics), no social media plugins, no embedded videos or maps no external font services and no AI-based services that process visitors’ personal data. Audience measurement with our self-hosted statistics tool only takes place if you explicitly consent (section 6).

3. Hosting and server log files

This website is hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. When you visit the website, the host automatically records information transmitted by your browser in server log files:

• IP address of the requesting device
• date and time of access
• name and URL of the page or file requested
• referrer URL (previously visited page)
• browser and operating system used
• amount of data transferred and HTTP status code

Processing is based on Art. 6(1)(f) GDPR. Our legitimate interest is the technically error-free, secure and stable provision of the website and the defence against attacks. Log files are deleted automatically after a limited retention period unless further retention is required for evidence purposes. We have concluded a data processing agreement with IONOS pursuant to Art. 28 GDPR; the servers are located in Germany or the European Union.

4. SSL/TLS encryption

For security reasons, this website uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” in your browser’s address bar.

5. Consent management (cookie banner)

On your first visit, a banner asks whether you consent to audience measurement (category “Statistics”). You can choose “Accept all”, “Necessary only” or save your own selection; without your consent, no statistics are collected.

Your choice and its time are stored only locally in your browser’s storage (local storage, entry “gx_consent_v1”) and are not transmitted to us. This storage is strictly necessary to respect your decision (Section 25(2) no. 2 TDDDG; Art. 6(1)(c) in conjunction with Art. 7(1) GDPR). You can delete the entry at any time in your browser settings.

You can withdraw or change your consent at any time with effect for the future via the “Cookie settings” link at the bottom of every page.

6. Audience measurement with Koko Analytics (consent only)

If you consent to the “Statistics” category, we count page views with Koko Analytics. The tool runs as a plugin on our own web server; no data is transferred to its developer or any other third party.

The following is processed: the page visited, the time, the referring page (referrer) and any campaign parameters in the URL. Koko Analytics does not store IP addresses; data is stored only in aggregated form (number of visitors and page views per page and day). No profiles of individual visitors are created.

To distinguish new from returning visitors, Koko Analytics sets the cookie “_koko_analytics_pages_viewed”. It only contains identifiers of pages already visited and expires at midnight of the same day at the latest.

The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). We keep the aggregated statistics for as long as they are needed to evaluate the use of the website.

7. Font

The font used on this website (Manrope) is stored locally on our server. No connection to third-party servers, such as Google’s, is established when pages are loaded.

8. Contact by email or phone

If you contact us by email or phone, we process the data you provide (e.g. name, email address, phone number, company and the content of your enquiry) to handle your request.

The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to the performance of a contract or is necessary to take pre-contractual steps. In all other cases, processing is based on our legitimate interest in handling enquiries effectively (Art. 6(1)(f) GDPR).

Your data is deleted once your enquiry has been fully dealt with, unless statutory retention obligations (in particular under Section 257 HGB and Section 147 AO) apply. Our mailbox is provided by IONOS.

9. LinkedIn company page and external links

We do not embed any LinkedIn content or plugins. Links to LinkedIn are plain links: no data is transferred to LinkedIn when you visit our website. Before a link to LinkedIn or to any other external website (e.g. via the logos of funders and partners) is opened, a notice informs you that you are leaving our website.

When you visit our company page on LinkedIn, LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland, is responsible for data processing. We are jointly responsible with LinkedIn for the statistical analysis of our company page (“Page Insights”, Art. 26 GDPR); LinkedIn has undertaken to assume the main obligations. More information: LinkedIn Privacy Policy.

For other linked websites (e.g. www.efre.nrw), the privacy policy of the respective provider applies once you follow the link.

10. News posts, project pages and photos

In the “News” section and on our project pages we publish reports on our projects, events and collaborations, partly with photos and the names of the people involved in their professional capacity. This is based on our legitimate interest in presenting our activities and in meeting the publicity obligations of funded projects (Art. 6(1)(f) GDPR) or on the consent of the people shown (Art. 6(1)(a) GDPR); for photos of events, Section 23(1) no. 3 KUG also applies. We only publish screenshots from online meetings with the consent of the identifiable persons shown (Art. 6(1)(a) GDPR); consent can be withdrawn at any time with effect for the future.

Images are stored on our own server and are not loaded from LinkedIn. If you appear or are named and do not wish this, you may object at any time – a short message to ali.behravan@greenovax.de is sufficient; we will remove the photo or name promptly.

11. AgentIoT live demo

The AgentIoT live demo is a simulation that runs entirely in your browser. All values shown are generated locally. Your inputs in the demo are not transmitted to us or third parties and are not stored.

12. Security and backups

To protect the website against attacks, we use the security plugin “All-In-One Security (AIOS)”, which runs on our own web server. For failed login attempts in the administration area and for requests identified as security-relevant, the IP address, time and requested address are logged in the website database; in the event of repeated attacks, the IP address may be temporarily blocked. The legal basis is our legitimate interest in the security of the website (Art. 6(1)(f) GDPR). The logs are deleted regularly.

For data backup, we regularly (currently weekly) create backup copies of the website files and database with the UpdraftPlus plugin. The backups are stored on our web server and in Google Drive cloud storage (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) and may contain the log data mentioned above. A transfer to Google LLC in the USA cannot be ruled out; Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). The legal basis is our legitimate interest in being able to restore the website (Art. 6(1)(f) GDPR). Older backups are deleted automatically after a set number of backups.

13. Recipients and transfers to third countries

Apart from us, recipients of personal data are our hosting and email provider IONOS, acting as processor, and – exclusively for backup copies – Google (section 12). A transfer to countries outside the European Union or the European Economic Area can only occur in the context of these backups; Google LLC is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the European Commission exists (Art. 45 GDPR). Beyond this, we do not transfer data to third countries.

14. Your rights

Within the statutory framework, you have the right at any time to:

• access the data we hold about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• withdraw consent with effect for the future (Art. 7(3) GDPR)

To exercise your rights, an informal message to the contact address above is sufficient.

Right to object under Art. 21 GDPR

Where we process your data on the basis of Art. 6(1)(f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.

15. No automated decision-making

No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.

16. Obligation to provide data

You are under no statutory or contractual obligation to provide us with personal data. Without contact details, however, we cannot respond to an enquiry.

17. Changes to this privacy policy

We update this privacy policy whenever changes to the website or the legal situation make this necessary. The current version published on this page applies. In case of doubt, the German version is authoritative.