# Privacy policy

As of 10 October 2026. This policy explains which personal data we process when you visit this website, for what purpose and on which legal basis. The German version is authoritative.

## 1. Controller

VANAHEIM Holding GmbH, Steinhöft 9, 20459 Hamburg, Germany, email: info@vanaheimholding.com, represented by its managing director Mark C. Reinold.

## 2. Hosting and server logs

The website is operated by Vercel Inc., server functions run in the Frankfurt am Main region. When you visit, Vercel processes technically necessary data such as IP address, time, page requested, browser and operating system in order to deliver the website and protect it from attacks. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in secure and stable operation. A data processing agreement is in place with Vercel. Where data is transferred to the USA, this is based on the EU-US Data Privacy Framework or standard contractual clauses.

## 3. Cookieless analytics

We use Vercel Web Analytics and Vercel Speed Insights. Neither uses cookies or cross-device profiles. They record aggregated data such as pages viewed, referrer, country, device type and load times. Visitors are only distinguished by a daily rotating, non-traceable hash. The legal basis is Art. 6(1)(f) GDPR, our interest in a fast and user-friendly website. As no information is stored on or read from your device, no consent under Section 25 TDDDG is required.

## 4. Contact by email, phone or form

When you write to us, call us or present a project through the form, we process your details and your message, including attached documents, in order to answer your request. The legal basis is Art. 6(1)(b) GDPR where your request relates to a contract, otherwise Art. 6(1)(f) GDPR.

Form submissions are stored in a database at Supabase Inc. in the Frankfurt am Main region. An uploaded presentation (PDF or PPTX, at most 20 MB) is kept in non-public storage at the same provider and can only be retrieved through time-limited links. The notification to us and your confirmation are sent via Resend. To prevent abuse we store a truncated value of your IP address, hashed with a secret key, for at most 48 hours. Data processing agreements are in place with both providers. Where data is transferred to the USA, this is based on the EU-US Data Privacy Framework or standard contractual clauses.

We delete form data and files once the request is resolved and no statutory retention periods apply, at the latest after twelve months. Files that are not a valid PDF or PPTX are deleted immediately; the related details and abandoned uploads within 48 hours at the latest.

## 5. Fonts and external content

All fonts are served from our own server. No content is loaded from Google Fonts, social networks or ad networks. Links to LinkedIn are plain links; data only flows when you follow them.

## 6. Browser storage

If you choose to reduce motion in the footer, your browser remembers that choice in local storage. The setting never leaves your device. The legal basis is Section 25(2) No. 2 TDDDG, as storing it is strictly necessary for the function you asked for.

## 7. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests. Write to info@vanaheimholding.com. You may also lodge a complaint with a supervisory authority, such as the Hamburg Commissioner for Data Protection and Freedom of Information.

## 8. Changes

We update this policy when the website or the law changes. The version published here applies.