Privacy policy

This is a translation for your convenience. In case of doubt, the German version is the binding one: Datenschutzerklärung.

We would like to inform you of the circumstances under which we collect data from you and the purposes for which it is collected, processed or used.

We take your privacy very seriously and treat your personal data confidentially and in accordance with statutory provisions.

Controller

Unless stated otherwise in this privacy policy, the controller for data processing pursuant to Art. 4 no. 7 GDPR is:

CEPHORIA GmbH
Marktler Straße 61
84489 Burghausen, Germany
Phone: +49 8677 767926-0
Email: info@cephoria.com

Your data

When you visit our website and each time a file is retrieved, our web server collects log information about these events (e.g. browser type, operating system, IP address). It is not possible for us to attribute the recorded data to a specific natural person. The data collected serves only statistical evaluation and the improvement of the website. We do, however, reserve the right to review the server log files subsequently should there be concrete indications of unlawful use.

We store personal data that you have provided to us voluntarily (e.g. for enquiries or online applications) only for as long as it is needed to fulfil the purposes for which it was submitted, or for as long as required by law.

We will not pass on the personal data we have collected to third parties without your express consent.

Contacting us

When you contact us (e.g. via the contact form, by email or by telephone) and within existing user and business relationships, the details provided by the enquiring person are processed to the extent necessary to answer the enquiry and any measures requested. First name, surname, your enquiry and your email address are recorded and used for this purpose. Further details are optional and are used on the basis of our legitimate interest (Art. 6 (1) sentence 1 (f) GDPR). Your consent to the processing of the data is obtained as part of the submission process, with a reference to this privacy policy. The data is not passed on to third parties.

External hosting

This website is hosted by an external service provider. The personal data collected on this website is stored on the servers of that host. This may include, in particular, IP addresses, contact enquiries, meta and communication data, contract data, contact details, names, website access data and other data generated via a website.

We use the following host:
Netlify, Inc.
512 2nd Street, Suite 200
San Francisco, CA 94107, USA

The host is used for the purpose of providing this website securely, quickly and reliably, and constitutes a legitimate interest within the meaning of Art. 6 (1) (f) GDPR. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider. As the provider is based in the USA, a transfer of data to the USA cannot be ruled out; the basis for this is the European Commission's standard contractual clauses as part of that agreement.

The host is engaged for the purpose of performing our contract with our potential and existing customers (Art. 6 (1) (b) GDPR) and in the interest of providing our online offering securely, quickly and efficiently through a professional provider (Art. 6 (1) (f) GDPR). Our host will process your data only to the extent necessary to fulfil its performance obligations and will follow our instructions with regard to this data.

Cookies and consent

Cookies are small text files stored on your device when you visit a website. We distinguish two cases:

Technically necessary cookies enable the basic functions of the website and the submission of forms. They are required for operation; the legal basis is section 25 (2) no. 2 TDDDG in conjunction with Art. 6 (1) (f) GDPR.

All other cookies and comparable technologies — in particular for audience measurement — are used solely with your consent (Art. 6 (1) (a) GDPR in conjunction with section 25 (1) TDDDG). On your first visit you receive a notice with a choice. As long as you do not consent, the services concerned are not loaded. Your decision is stored locally in your browser and you can change or withdraw it at any time via the Cookie settings link at the bottom of the page. The lawfulness of processing carried out until withdrawal remains unaffected.

Data transfer to third countries

Where data is processed in a third country (that is, outside the European Union or the European Economic Area), or where processing takes place in the course of using third-party services (e.g. Microsoft, Google), or where data is transferred to other persons or companies, this is done only in accordance with statutory requirements.

Where you have given express consent, or where there is a contractual or statutory obligation to transfer, data is processed only in third countries with a recognised level of data protection. This is established either through the European Commission's standard contractual clauses, through certifications, or under the EU-US Data Privacy Framework (DPF).

Through the DPF, the European Commission has recognised the level of data protection of certified companies in the USA. Below you can see which of the services we use fall under the DPF and are classified as secure.

Social networks

We use social networks for marketing purposes. The network used is LinkedIn. Please also note our separate privacy information on this:

Privacy information on the use of LinkedIn

Storage period

Unless a more specific storage period is stated within this privacy policy, your personal data remains with us until the purpose for the processing no longer applies. If you assert a legitimate request for erasure or withdraw your consent to processing, your data will be deleted unless we have other legally permissible grounds for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, deletion takes place once those grounds no longer apply.

Integrated third-party providers

Google Tag Manager

We use Google Tag Manager to manage the analytics services used on this website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Tag Manager itself does not collect personal data and does not set cookies; it serves solely to deliver other services. It is only loaded after you have given the corresponding consent.

Google Analytics 4

This website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics uses cookies and similar technologies to analyse the use of this website on a pseudonymised basis. This covers in particular the pages viewed, time spent, the source of the visit, submitted forms and technical details of browser and device. Your IP address is processed in truncated form and is not stored permanently; it is not combined with other data held by Google. The "Google Signals" feature is disabled and the retention period for usage data is limited to 14 months.

The purpose of the processing is the statistical evaluation of website usage in order to improve our content and our offering. The sole legal basis is your consent pursuant to Art. 6 (1) (a) GDPR in conjunction with section 25 (1) TDDDG. Without your consent, Google Analytics is not loaded and no connection to Google is established. You may withdraw your consent at any time via the cookie settings at the bottom of the page; the lawfulness of processing carried out until withdrawal remains unaffected. A transfer of data to the USA cannot be ruled out; the basis for this is the EU-US Data Privacy Framework, under which Google LLC is certified. Further information can be found in Google's privacy policy: https://policies.google.com/privacy.

Microsoft Teams

We use Microsoft Teams. The provider is Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. Details on the data processing can be found in the Microsoft Teams privacy statement: https://privacy.microsoft.com/en-us/privacystatement. Should this involve a transfer of data to the third country USA, the basis for this is the EU-US Data Privacy Framework.

Zoho CRM

We use Zoho CRM on this website. The provider is Zoho Corporation Pvt. Ltd., Estancia IT Park, Plot No. 140 151, GST Road, Vallancherry Village, Chengalpattu Taluk, Kanchipuram District 603 202, India (hereinafter "Zoho CRM").

Zoho CRM allows us, among other things, to manage existing and potential customers and customer contacts and to organise sales and communication processes. Using the CRM system also allows us to analyse and optimise our customer-related processes. Customer data is stored on Zoho CRM's servers. Details on the features of Zoho CRM can be found here: https://www.zoho.com/crm/help/getting-started/key-features.html.

Zoho CRM is used on the basis of Art. 6 (1) (f) GDPR. The website operator has a legitimate interest in managing customers and customer communication as efficiently as possible. Where consent has been requested, processing takes place solely on the basis of Art. 6 (1) (a) GDPR and section 25 (1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user's device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be withdrawn at any time.

The transfer of data to third countries outside the European Union is based on the European Commission's standard contractual clauses. Details can be found here: https://www.zoho.com/privacy/dpa/DPA_zoho_com.pdf. Should a transfer of data to the USA take place, the basis for this is the EU-US Data Privacy Framework. Details can be found in the privacy policy of Zoho CRM: https://www.zoho.com/privacy.html and https://www.zoho.com/gdpr.html.

Zoho Campaigns

This website uses Zoho Campaigns for sending newsletters. The provider is Zoho Corporation Pvt. Ltd., Estancia IT Park, Plot No. 140 151, GST Road, Vallancherry Village, Chengalpattu Taluk, Kanchipuram District 603 202, India (hereinafter "Zoho Campaigns").

Zoho Campaigns is a service with which, among other things, the sending of newsletters can be organised and analysed. The data you enter for the purpose of receiving the newsletter is stored on Zoho Campaigns' servers.

Zoho Campaigns enables us to analyse our newsletter campaigns. For example, we can see whether a newsletter message was opened and which links were clicked. This allows us, among other things, to determine which links were clicked particularly often. We can also see whether certain predefined actions were carried out after opening or clicking (conversion rate). If you do not want any analysis by Zoho Campaigns, you must unsubscribe from the newsletter. We provide a link for this in every newsletter message. Zoho Campaigns also allows us to divide newsletter recipients into different categories ("clustering"). Recipients can be grouped, for example, by age, gender or place of residence. This makes it possible to tailor the newsletters more closely to the respective target groups.

Detailed information on the features of Zoho Campaigns can be found here: https://www.zoho.com/campaigns/features.html. The privacy policy of Zoho Campaigns can be found at https://www.zoho.com/privacy.html and https://www.zoho.com/gdpr.html. The data processing takes place on the basis of your consent (Art. 6 (1) (a) GDPR). You may withdraw this consent at any time with effect for the future. The basis for the transfer of data to the USA is the EU-US Data Privacy Framework.

Data processing on our behalf

Where necessary, we have concluded data processing agreements with the providers named above. Such an agreement is required under data protection law and ensures that the contracting party may process the personal data of our website visitors and similar data only in accordance with our instructions and in compliance with the GDPR.

Currency of this policy

This policy is dated 23 August 2026. In view of the ongoing technical development of IT technology and IT law, we reserve the right to make additions or changes to this privacy policy.

Your rights as a data subject

Under the EU General Data Protection Regulation you have the following rights:

If your personal data is processed, you have the right to obtain information about the data stored about you (Art. 15 GDPR). Should inaccurate personal data be processed, you have the right to rectification (Art. 16 GDPR). If the statutory conditions are met, you may request erasure or restriction of processing and object to processing (Art. 17, 18 and 21 GDPR). If you have consented to the data processing, or if a contract for data processing exists and the processing is carried out by automated means, you may have a right to data portability (Art. 20 GDPR).

Should you exercise the rights set out above, we will examine whether the statutory conditions for doing so are met.

To exercise your rights, please contact the company data protection officer (datenschutz[at]kreutzpointner.de). CEPHORIA GmbH has engaged Kreutzpointner GmbH as an external service provider for data protection management; the data protection officer is based there.

Data protection supervisory authority

As a data subject you have the right, under the conditions of Article 57 (1) (f) of the General Data Protection Regulation, to lodge a complaint with the competent supervisory authority.

The supervisory authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht
Postfach 1349
91504 Ansbach, Germany

Phone +49 981 180093-0
Email poststelle[at]lda.bayern.de