Legal information
We are delighted that you have shown interest in our company. Data protection is a particularly high priority for the management of provalida GmbH. The websites of provalida GmbH can generally be used without providing any personal data. However, if a data subject wishes to use special services of our company via our website, processing of personal data could become necessary. If the processing of personal data is necessary and there is no legal basis for such processing, we generally obtain the consent of the data subject.
The processing of personal data, such as the name, address, e-mail address or telephone number of a data subject, is always carried out in line with the General Data Protection Regulation and in accordance with the country-specific data protection provisions applicable to provalida GmbH. By means of this privacy policy, our company wishes to inform the public about the nature, scope and purpose of the personal data we collect, use and process. Furthermore, this privacy policy informs data subjects of the rights to which they are entitled.
As the controller, provalida GmbH has implemented numerous technical and organisational measures to ensure the most complete protection possible of the personal data processed via this website. Nevertheless, internet-based data transmissions can in principle have security gaps, so that absolute protection cannot be guaranteed. For this reason, every data subject is free to transmit personal data to us by alternative means, for example by telephone.
Below, in accordance with the legal requirements of data protection law (in particular the new version of the German Federal Data Protection Act (BDSG) and the European General Data Protection Regulation ‘GDPR’), we inform you about the nature, scope and purpose of the processing of personal data by our company. This privacy policy also applies to our websites and social media profiles. With regard to the definition of terms such as “personal data” or “processing”, we refer to Art. 4 GDPR.
Our controller (hereinafter “controller”) within the meaning of Art. 4(7) GDPR is:
provalida GmbH
Springorumallee 20a
44795 Bochum
Managing Directors Klaus Wendland, Attila Mozes
Commercial register/No.: HRB No. 11246
Registry court: Bochum
Fax: +49 234 2987979-99
E-mail address: kontakt@provalida.de
Data protection officer
Data protection officer
Springorumallee 20a
44795 Bochum
datenschutz@provalida.de
Below, we inform you about the nature, scope and purpose of the collection, processing and use of personal data.
1. Types of data we process
Usage data (access times, websites visited, etc.), master data (name, address, etc.), contact data (telephone number, e-mail, fax, etc.), contract data (subject matter of the contract, term, etc.), communication data (IP address, etc.),
2. Purposes of processing pursuant to Art. 13(1)(c) GDPR
Processing of contracts, optimising the website technically and economically, enabling easy access to the website, fulfilment of contractual obligations, making contact in the event of legal complaints by third parties, fulfilment of statutory retention obligations, optimisation and statistical analysis of our services, supporting the commercial use of the website, improving the user experience, making the website user-friendly, economic operation of advertising and the website, marketing / sales / advertising, compiling statistics, prevention of spam and misuse, handling of application procedures, customer service and customer care, providing websites with functions and content, security measures, uninterrupted and secure operation of our website,
3. Categories of data subjects pursuant to Art. 13(1)(e) GDPR
Visitors/users of the website, customers, suppliers, prospective customers, applicants, employees, employees of customers or suppliers,
The data subjects are collectively referred to as “users”.
Below, we inform you about the legal bases for the processing of personal data:
• If we have obtained your consent to the processing of personal data, Art. 6(1)(1)(a) GDPR is the legal basis.
• If the processing is necessary for the performance of a contract or to take pre-contractual steps at your request, Art. 6(1)(1)(b) GDPR is the legal basis.
• If the processing is necessary to comply with a legal obligation to which we are subject (e.g. statutory retention obligations), Art. 6(1)(1)(c) GDPR is the legal basis.
• If the processing is necessary to protect the vital interests of the data subject or of another natural person, Art. 6(1)(1)(d) GDPR is the legal basis.
• If the processing is necessary to safeguard our legitimate interests or those of a third party, and your interests or fundamental rights and freedoms do not override them, Art. 6(1)(1)(f) GDPR is the legal basis.
As a matter of principle, we do not pass on any data to third parties without your consent. Should this nevertheless be the case, the disclosure takes place on the basis of the legal bases mentioned above, e.g. when passing on data to online payment providers for the performance of a contract, or on the basis of a court order or a legal obligation to hand over the data for the purposes of criminal prosecution, averting danger or enforcing intellectual property rights. We also use processors (external service providers, e.g. for web hosting of our websites and databases) to process your data. If data is passed on to processors within the framework of a data processing agreement, this is always done in accordance with Art. 28 GDPR. We select our processors carefully, monitor them regularly and have reserved the right to issue instructions regarding the data. In addition, the processors must have implemented appropriate technical and organisational measures and comply with the data protection provisions of the new version of the BDSG and the GDPR
The adoption of the European General Data Protection Regulation (GDPR) created a uniform basis for data protection in Europe. Your data is therefore predominantly processed by companies to which the GDPR applies. Should processing nevertheless take place by third-party services outside the European Union or the European Economic Area, these must meet the special requirements of Art. 44 et seq. GDPR. This means that the processing takes place on the basis of special guarantees, such as the officially recognised determination by the EU Commission of a level of data protection equivalent to that of the EU, or compliance with officially recognised special contractual obligations, the so-called “standard contractual clauses”. Insofar as, due to the invalidity of the so-called “Privacy Shield”, we obtain your express consent to the transfer of data to the USA pursuant to Art. 49(1)(1)(a) GDPR, we hereby point out the risk of secret access by US authorities and the use of the data for surveillance purposes, possibly without any legal remedies for EU citizens.
Unless expressly stated in this privacy policy, your personal data will be deleted or blocked as soon as you withdraw the consent given for processing or the purpose for storage no longer applies or the data is no longer required for the purpose, unless its further retention is required for evidentiary purposes or statutory retention obligations prevent deletion. These include, for example, commercial law retention obligations for business letters under § 257(1) German Commercial Code (HGB) (6 years) and tax law retention obligations for receipts under § 147(1) German Fiscal Code (AO) (10 years). When the prescribed retention period expires, your data will be blocked or deleted, unless storage is still required for the conclusion or performance of a contract.
We do not use automated decision-making or profiling.
• If you use our website for information purposes only (i.e. without registering and without otherwise transmitting information), we only collect the personal data that your browser transmits to our server. When you view our website, we collect the following data: IP address; the user's internet service provider; date and time of access; browser type; language and browser version; content of the request; time zone; access status/HTTP status code; amount of data; websites from which the request originates; operating system. The IP address is fully anonymised for statistical purposes. This data is not stored together with any other personal data of yours.
• This data serves the purpose of delivering our website to you in a user-friendly, functional and secure manner with functions and content, as well as optimising it and analysing it statistically.
• The legal basis for this is our legitimate interest in data processing, which also lies in the above purposes, pursuant to Art. 6(1)(1)(f) GDPR.
• For security reasons, we store this data in server log files for a period of 90 days. After this period has expired, it is automatically deleted, unless we need to retain it for evidentiary purposes in the event of attacks on the server infrastructure or other legal infringements. The legal basis for this is likewise Art. 6(1)(1)(f) GDPR.
• We currently do not use any cookies for analytics or advertising purposes on this website. We only use technically necessary cookies and comparable storage technologies (e.g. local storage) insofar as they are required to operate the website, for example to save your choice in the cookie notice or to submit forms.
• Cookie notice: On your first visit, we inform you via a cookie notice and ask which optional services you consent to. Your decision is saved in your browser so that the notice does not reappear every time a page is loaded. You can change or withdraw your settings at any time via the cookie notice.
• Legal bases: For technically necessary cookies and storage technologies, the legal basis is § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) in conjunction with Art. 6(1)(1)(f) GDPR. Our legitimate interest lies in the secure and functional operation of the website. Should we use optional cookies in the future, we will only do so with your consent pursuant to § 25(1) TDDDG and Art. 6(1)(1)(a) GDPR.
• Here you can find information on deleting cookies for each browser:
Microsoft Edge: https://support.microsoft.com/de-at/help/4027947/windows-delete-cookies
Chrome: https://support.google.com/chrome/answer/95647
Safari: https://support.apple.com/de-at/guide/safari/sfri11471/mac
Firefox: https://support.mozilla.org/de/kb/cookies-und-website-daten-in-firefox-loschen
• We process master data (e.g. company, title/academic degree, names and addresses as well as contact details of users, e-mail), contract data (e.g. services used, names of contact persons) and payment data (e.g. bank details, payment history) for the purpose of fulfilling our contractual obligations (knowing who the contractual partner is; establishing, defining the content of and processing the contract; checking the plausibility of the data) and services (e.g. contact by customer service) pursuant to Art. 6(1)(1)(b) GDPR. The entries marked as mandatory in online forms are required for the conclusion of the contract.
• As a matter of principle, this data is not passed on to third parties unless this is necessary to pursue our claims (e.g. handing over to a lawyer for debt collection) or to perform the contract (e.g. passing the data on to payment providers), or there is a legal obligation to do so pursuant to Art. 6(1)(1)(c) GDPR.
• We may also process the data you provide to inform you about other interesting products from our portfolio or to send you e-mails with technical information.
• The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. For master and contract data, this is the case when the data is no longer required to perform the contract and no further claims can be asserted under the contract because they have become time-barred (warranty: two years / standard limitation period: three years). Due to commercial and tax law requirements, we are obliged to store your address, payment and order data for a period of ten years. However, when the contract ends, we restrict processing after three years, i.e. your data is only used to comply with statutory obligations. Information in the user account remains until the account is deleted.
• We offer a contact form on our website. Mandatory fields are your name, your e-mail address and your message; you may optionally provide your company and your telephone number. Your details are sent to us by e-mail and may additionally be stored in our website's database. When you contact us by fax, post or e-mail, your details are likewise processed for the purpose of handling your enquiry.
• Where you have given your consent, the legal basis for processing the data is Art. 6(1)(1)(a) GDPR. The legal basis for processing data transmitted in the course of a contact enquiry or e-mail, a letter or a fax is Art. 6(1)(1)(f) GDPR. The controller has a legitimate interest in processing and storing the data in order to be able to respond to user enquiries, to preserve evidence for liability reasons and, where applicable, to comply with its statutory retention obligations for business letters. If the contact is aimed at concluding a contract, an additional legal basis for the processing is Art. 6(1)(1)(b) GDPR.
• We may store your details and enquiry in our customer relationship management system (“CRM system”) or a comparable system.
• The data are deleted as soon as they are no longer required to achieve the purpose for which they were collected. For personal data from the input form of the contact form and data sent by e-mail, this is the case when the respective conversation with you has ended. The conversation has ended when it can be inferred from the circumstances that the matter in question has been conclusively resolved. Enquiries from users who have an account or contract with us are stored until two years after the end of the contract. Where statutory archiving obligations apply, deletion takes place once they expire: at the end of the retention period under commercial law (6 years) and tax law (10 years).
• You may withdraw your consent to the processing of personal data under Art. 6(1)(1)(a) GDPR at any time. If you contact us by e-mail, you may object to the storage of your personal data at any time.
• When you contact us by telephone, your telephone number is processed to handle and deal with your enquiry and is temporarily stored in, or shown on, the RAM / cache of the telephone device / display. It is stored for liability and security reasons, so that the call can be proven, and for business reasons, so that we can call you back. In the case of unauthorised advertising calls, we block the numbers.
• The legal basis for processing the telephone number is Art. 6(1)(1)(f) GDPR. If the contact is aimed at concluding a contract, an additional legal basis for the processing is Art. 6(1)(b) GDPR.
• The device cache stores calls for 90 days and successively overwrites or deletes old data; when the device is disposed of, all data are deleted and the storage medium is destroyed if necessary. Blocked telephone numbers are reviewed annually to check whether the block is still necessary.
• You can prevent your telephone number from being displayed by calling with your number withheld.
• To measure reach, we use the WordPress plugin Independent Analytics. It runs entirely on our own web server at our hosting provider. No data is transmitted to the provider of the plugin or to any other third party, and no cookies or similar storage technologies are used on your device.
• When a page is accessed, we record the page visited, the date and time, the page you came from (referrer), any campaign parameters in the link (UTM parameters), the device type, browser and operating system, country and city, and links clicked. Country and city are derived from your IP address on our server. The IP address itself is not stored.
• To combine several page views into one visit, the plugin creates an irreversible hash value from the IP address, the browser identifier and a secret key. The key is renewed daily, so visits on different days cannot be linked to one another. We cannot attribute the data to any individual and do not combine it with other data.
• We evaluate the data exclusively in aggregated form to see which content is in demand and how visitors find our website. Logged-in editors are not recorded. The data is deleted automatically after two years.
• The legal basis is our legitimate interest in designing our website to meet demand and in evaluating it statistically (Art. 6(1)(1)(f) GDPR). You can object to this processing at any time, for example by email to kontakt@provalida.de.
• We do not use Google Analytics or comparable analytics services from external providers.
• When a page is accessed, we record the page visited, the date and time, the page you came from (referrer), any campaign parameters in the link (UTM parameters), the device type, browser and operating system, country and city, and links clicked. Country and city are derived from your IP address on our server. The IP address itself is not stored.
• To combine several page views into one visit, the plugin creates an irreversible hash value from the IP address, the browser identifier and a secret key. The key is renewed daily, so visits on different days cannot be linked to one another. We cannot attribute the data to any individual and do not combine it with other data.
• We evaluate the data exclusively in aggregated form to see which content is in demand and how visitors find our website. Logged-in editors are not recorded. The data is deleted automatically after two years.
• The legal basis is our legitimate interest in designing our website to meet demand and in evaluating it statistically (Art. 6(1)(1)(f) GDPR). You can object to this processing at any time, for example by email to kontakt@provalida.de.
• We do not use Google Analytics or comparable analytics services from external providers.
• On our service pages you can request free white papers. Mandatory fields are your name and your e-mail address. We use these data to send you the white paper by e-mail. The legal basis is your consent under Art. 6(1)(1)(a) GDPR, which you give by submitting the form.
• You may optionally also consent to us contacting you about the topic in question. Here too, the legal basis is Art. 6(1)(1)(a) GDPR. Without this additional consent, we use your data exclusively to send the white paper.
• Your details are sent to us by e-mail and may additionally be stored in our website's database and in our CRM system. We delete them as soon as they are no longer required for the purpose or you withdraw your consent.
• To improve our offering, we anonymously count how often the white paper section of a page is displayed, how often a white paper is requested and how often the download link in our e-mail is opened. We store only totals per white paper and month, no IP addresses or other personal data, and we do not store any information on your device. The legal basis is Art. 6(1)(1)(f) GDPR; our legitimate interest lies in evaluating which content is useful to our visitors.
• You may withdraw your consent at any time with effect for the future, for example by e-mail to kontakt@provalida.de.
• You can subscribe to our free newsletter on our website. Roughly once a month, it provides news from our service areas, changes affecting vendors, licences and technologies, and new articles on our website. The only mandatory field is your e-mail address. You may optionally provide your first name and your areas of interest so that we can address you personally and select relevant content.
• We use the double opt-in procedure: after signing up, you receive an e-mail with a confirmation link. You are only subscribed once you click this link. As proof of your consent, we store the time of sign-up and confirmation as well as the IP address used. If you do not confirm your subscription within 30 days, we delete your details automatically.
• The legal basis for sending the newsletter is your consent under Art. 6(1)(1)(a) GDPR. The proof data are stored on the basis of Art. 6(1)(1)(c) GDPR in conjunction with Art. 7(1) GDPR.
• The sign-up data are stored on our web server (see section “Provision of our website and creation of log files”). If we use an external service provider for sending, we will name it here before transferring your data to it.
• You may withdraw your consent at any time with effect for the future, via the unsubscribe link in every issue or by e-mail to kontakt@provalida.de. After you unsubscribe, we delete your data. We retain the proof of your consent for as long as we need it to defend against possible claims, for a maximum of three years, and use it exclusively for that purpose.
• We maintain profiles or fan pages on social media. When you use and access our profile on the respective network, the privacy notices and terms of use of that network apply.
• When you visit our website, no information is automatically transmitted to social media operators.
• Data categories and description of data processing: usage data, contact data, content data, master data. Furthermore, user data within social networks are generally processed for market research and advertising purposes. For example, usage profiles can be created on the basis of usage behaviour and the resulting interests of users. These usage profiles can in turn be used, for example, to place advertisements inside and outside the networks that presumably match the users' interests. For these purposes, cookies are generally stored on users' computers, in which the usage behaviour and interests of the users are stored. Furthermore, data may also be stored in the usage profiles independently of the devices used by the users (in particular if the users are members of the respective platforms and are logged in to them). For a detailed description of the respective forms of processing and the options to object (opt-out), please refer to the privacy policies and information provided by the operators of the respective networks. In the case of requests for information and the assertion of data subject rights, we also point out that these can be asserted most effectively with the providers. Only the providers have access to the users' data and can take appropriate measures and provide information directly. Should you nevertheless need help, you can contact us.
• Purpose of processing: communication with users connected to and registered on the social networks; information about and advertising for our products, offers and services; external presentation and image cultivation; evaluation and analysis of the users and content of our social media presences.
• Legal bases: the legal basis for processing personal data is our legitimate interest, as set out in the purposes above, in accordance with Art. 6(1)(1)(f) GDPR. Where you have given us or the controller of the social network consent to the processing of your personal data, the legal basis is Art. 6(1)(1)(a) in conjunction with Art. 7 GDPR.
• Data transfer / recipient category: social network.
• You can find the privacy notices, information options and options to object (opt-out) of the respective networks / service providers here:
Facebook - Service provider: Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; website: www.facebook.com; privacy policy: https://www.facebook.com/about/privacy/, opt-out: https://www.facebook.com/settings?tab=ads and http://www.youronlinechoices.com; objection: https://www.facebook.com/help/contact/2061665240770586; agreement on joint processing of personal data on Facebook pages (Art. 26 GDPR): https://www.facebook.com/legal/terms/page_controller_addendum, privacy notice for Facebook pages: https://www.facebook.com/legal/terms/information_about_page_insights_data. We are jointly responsible with Facebook for our fan page in accordance with Art. 26 GDPR. For this purpose, an agreement entitled “Page Insights information”, available at https://www.facebook.com/legal/terms/page_controller_addendum, has been concluded, under which Facebook must observe certain security measures and will itself fulfil data subject rights directly. You can therefore, above all, contact Facebook directly regarding rights of access and erasure. However, your data subject rights, in particular access, erasure, objection and complaint to the competent supervisory authority, remain unaffected. Further information on joint responsibility can be found in the “Information about Page Insights data” at https://www.facebook.com/legal/terms/information_about_page_insights_data.
XING - Service provider: XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany; privacy policy / opt-out: https://privacy.xing.com/de/datenschutzerklaerung.
LinkedIn - Service provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland; privacy policy: https://www.linkedin.com/legal/privacy-policy, cookie policy and opt-out: https://www.linkedin.com/legal/cookie-policy.
• Applications sent to the controller electronically or by post are processed electronically or manually for the purpose of handling the application process.
• We expressly point out that application documents containing “special categories of personal data” under Art. 9 GDPR (e.g. a photo that allows conclusions to be drawn about your ethnic origin, religion or marital status) are not wanted, with the exception of any severe disability that you freely choose to disclose. Please submit your application without these data. This has no effect on your chances as an applicant.
• The legal bases for the processing are Art. 6(1)(1)(b) and (c) GDPR.
• If an employment relationship is entered into with the applicant after the application process has been completed, the applicant's data are stored in compliance with the relevant data protection regulations. If you are not offered a position after the application process has been completed, your cover letter and documents will be deleted 6 months after the rejection has been sent, in order to meet any claims and obligations to provide evidence under the German General Equal Treatment Act (AGG).
• On our website you can book a consultation appointment via a link to Calendly. The provider is Calendly LLC, 115 E Main St, Ste A1B, Buford, GA 30518, USA. Calendly is only accessed when you click the link. No data are transferred to Calendly beforehand.
• When you book, Calendly processes the data you enter, such as your name, e-mail address and preferred appointment, as well as technical data such as your IP address. We use these data to prepare for and hold the appointment. The legal basis is Art. 6(1)(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(1)(f) GDPR. Our legitimate interest lies in simple and quick scheduling of appointments.
• In this context, data may be transferred to the USA. The transfer takes place on the basis of the provider's certification under the EU-US Data Privacy Framework or the EU standard contractual clauses. Further information can be found in Calendly's privacy policy: https://calendly.com/privacy
• The data are deleted as soon as they are no longer needed for handling the appointment, unless statutory retention obligations apply.
• On our website we offer online checks: the Process Check, the CRM Check and the PPM Check. In each, you answer eight questions and receive an evaluation immediately. No registration is required.
• The evaluation runs in your browser. So that we can see how often the checks are used and where companies most often need to take action, your browser transmits your answers, without any reference to you personally, to our server when you start and complete a check. There they are only added up into monthly totals (for example “Answer 2 to question 5 was chosen 14 times”). We do not store individual runs, your IP address or any other identifiers, and no cookies are set. It is not possible to identify you.
• The legal basis is our legitimate interest in adapting our offering to the actual needs of our visitors (Art. 6(1)(1)(f) GDPR). The aggregated values do not contain any personal data and are not passed on to third parties.
• If you save your result as a PDF or copy it as a link, this happens only in your browser. We do not store the link. If someone opens a shared result link, this is not counted.
• We only process personal data if you subsequently contact us voluntarily via the contact form, by e-mail or via appointment booking. In that case, the information in the relevant sections of this privacy policy applies.
Objection to or withdrawal of consent for the processing of your data
Insofar as the processing is based on your consent in accordance with Art. 6(1)(1)(a), Art. 7 GDPR, you have the right to withdraw your consent at any time. This does not affect the lawfulness of the processing carried out on the basis of the consent before its withdrawal. Insofar as we base the processing of your personal data on a balancing of interests in accordance with Art. 6(1)(1)(f) GDPR, you may object to the processing. This is the case in particular if the processing is not necessary for the performance of a contract with you, which we set out in each case in the following description of the functions. When exercising such an objection, we ask you to explain the reasons why we should not process your personal data as we have done. In the event of a justified objection, we will review the situation and either stop or adjust the data processing or show you our compelling legitimate grounds on the basis of which we will continue the processing. You may object to the processing of your personal data for the purposes of advertising and data analysis at any time. You can exercise your right to object free of charge. You can inform us of your objection to advertising using the following contact details:
provalida GmbH, Springorumallee 20a, 44795 Bochum, Managing Directors Klaus Wendland, Attila Mozes, commercial register no.: HRB no. 11246, registry court: Bochum, fax: +49 234 2987979-99, e-mail address: kontakt@provalida.de
Right of access
You have the right to obtain information about the personal data we hold about you in accordance with Art. 15 GDPR. This includes, in particular, information about the purposes of processing, the category of personal data, the categories of recipients to whom your data have been or will be disclosed, the planned storage period and the source of your data if they were not collected directly from you.
Right to rectification
You have the right to the rectification of inaccurate data or the completion of correct data in accordance with Art. 16 GDPR.
Right to erasure
You have the right to the erasure of your data stored by us in accordance with Art. 17 GDPR, unless statutory or contractual retention periods or other legal obligations or rights to further storage prevent this.
Right to restriction
You have the right to request the restriction of the processing of your personal data if one of the conditions in Art. 18(1)(a) to (d) GDPR is met:
• if you contest the accuracy of the personal data concerning you, for a period enabling the controller to verify the accuracy of the personal data;
• the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
• the controller no longer needs the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims; or
• if you have objected to the processing in accordance with Art. 21(1) GDPR and it has not yet been determined whether the legitimate grounds of the controller override your grounds.
Right to data portability
You have the right to data portability in accordance with Art. 20 GDPR, which means that you can receive the personal data we hold about you in a structured, commonly used and machine-readable format or request that they be transmitted to another controller.
Right to lodge a complaint
You have the right to lodge a complaint with a supervisory authority. As a rule, you can contact the supervisory authority in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement.
To protect all personal data transmitted to us and to ensure that data protection regulations are complied with by us and by our external service providers, we have taken appropriate technical and organisational security measures. For this reason, among other things, all data between your browser and our server are transmitted in encrypted form via a secure SSL connection.
Last updated: 20/10/2026
