Privacy Policy

About this English version

This page is a partial English version of our Privacy Policy. Fully translated are the sections on cookies and advertising measurement, because our ads landing page is served in English as well; controller, third-country transfers and your rights are summarised. Everything else — in particular the complete list of processing purposes, retention periods and processors — is set out in the German version only.

The German version is the legally binding one. It is available at vesturium.com/privacy, and in case of any discrepancy it prevails. A full English translation is in preparation.

For questions about data processing, please contact [email protected].

Controller

Vesturium Ltd. Artemidos 5, Artemidos Tower, 8th Floor Larnaca, 6020, Cyprus

Registration number: HE 490885 Email: [email protected]

Cookies and tracking

Strictly necessary cookies

Our website uses strictly necessary cookies (session cookies during the multi-step registration process, language preference). They are required to operate the website and to complete a registration. Legal basis: Section 25(2) no. 2 TDDDG; the subsequent processing relies on Art. 6(1)(f) GDPR (legitimate interest in the technical operation of the site).

Meta Pixel and Conversions API on the /start landing page and in the live demo

On our landing page for paid ads, reachable at vesturium.com/en/start, and in the live demo at demo.vesturium.com, and only there, we use the Meta Pixel and Meta's Conversions API after you have given your explicit consent.

This section describes the case where you have consented. If you made no choice in the consent bar and arrived through one of our ads, we transfer the enquiry event alone on a different legal basis and to a smaller extent — no pixel, no cookies; see “Transfer of the enquiry event without consent” below.

None of this processing takes place on any other page of this website. There, no analytics, marketing or tracking cookies are used, and no data is transmitted to analytics services such as Google Analytics.

Purpose. We measure which of our paid ads on Facebook and Instagram led to an enquiry, and we make that information available to Meta so that it can optimise ad delivery.

Recipient and joint controllership. The recipient of this transfer is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. For the collection of the data on this website and its transfer to Meta, we and Meta are joint controllers under Art. 26 GDPR, not controller and processor. Meta alone is responsible for any further processing in its own systems; we have neither influence over it nor access to the data stored there. See Meta's privacy policy at facebook.com/privacy/policy. You may exercise your data subject rights against us as well as directly against Meta; where your request concerns data held by Meta, Meta is the appropriate point of contact.

Legal basis. Art. 6(1)(a) GDPR (consent) in conjunction with Section 25(1) TDDDG. Without your consent the pixel script is not loaded, no Meta cookies are set, and no event is sent to Meta.

Cookies set or read.

vw_consent itself does not require consent (Section 25(2) no. 2 TDDDG). It is also set when you decline, and it stores only your decision and the time you made it — no usage profile.

Events your browser reports to Meta. Opening the page (PageView), reaching 50% and 90% scroll depth, starting to fill in the form (InitiateCheckout), and a successfully submitted enquiry (Lead).

The event our server sends to Meta in addition (Conversions API). After your form has been submitted successfully, our server reports the Lead event to Meta a second time — from our own systems rather than from your browser, so that attribution still works if your browser blocks the pixel. Both reports carry the same event identifier so that Meta counts them as a single event. The transfer contains:

• your email address, phone number, first name and last name, in each case only as a SHA-256 hash. The plaintext values of these four fields never leave our server.
• your IP address and your browser's identifier (user agent) — these two unhashed, in plain text, because Meta requires them in that form
• the values of the _fbp and _fbc cookies listed above. If the _fbc cookie is absent — for instance because the pixel had not yet set it when you arrived — we derive its value from the ad's click identifier and the time of your visit
• the time of submission and the address of the page you were on, including the campaign parameters of the ad

Retention on our side. We delete the Meta cookie values (_fbp, _fbc) from our database as soon as the transfer of the event has concluded — and at the latest two days after your submission, even if no transfer has taken place by then. The event identifier, the time of your submission, and the time of our transfer to Meta remain stored against the lead record as evidence. This deletion does not cover the click identifier fbclid: it is stored independently of your consent on a separate legal basis and is retained (see the next section).

Withdrawal. You may withdraw your consent at any time with effect for the future (Art. 7(3) GDPR). The simplest way is the "Change ad-measurement consent" link at the foot of the /start landing page and the live demo: it reopens the consent bar, and clicking "Decline" withdraws your consent and removes the _fbp and _fbc cookies from your browser. Merely reopening the bar changes nothing about your existing decision; only clicking one of the two buttons does. The usual routes remain open as well: an email to [email protected], or deleting this website's cookies in your browser — after which the consent bar reappears by itself the next time you open /start or the live demo, and for as long as you do not consent again, no pixel is loaded and no event is sent.

The link makes withdrawal easier, not retroactive. Two limits therefore apply unchanged, and we state them explicitly so that nothing is promised here that cannot technically be kept:

• A withdrawal takes effect only for the future. It cannot recall events that have already been sent to Meta. To have data already held by Meta erased, please also contact Meta.
• There are usually up to 15 minutes between your submission and our server's transfer run. A withdrawal within that window no longer stops the server event that is already queued. Nor does a withdrawal reach the lead record already stored with us; please request its erasure separately at [email protected].

Attribution of our own campaigns, independent of consent

If you reach our landing page from an ad, the address you open carries campaign parameters: the click identifier fbclid and the UTM parameters utm_source, utm_medium, utm_campaign, utm_content and utm_term. When you submit the form, we store those parameters together with the referrer URL and the time of your visit against your lead record.

This happens independently of your consent, including where you have declined in the consent bar. It is neither storage of information on your terminal equipment nor access to it, so Section 25 TDDDG does not apply: the parameters are part of the address you opened and are transmitted with the form you submit.

The legal basis is Art. 6(1)(f) GDPR: our legitimate interest in being able to tell which of our ads led to which enquiry. This evaluation takes place solely within our own systems.

Relationship to the transfer to Meta. If you have consented, these parameters additionally form part of the transfer described above: the click identifier in the value of the _fbc cookie, or in the value we derive when that cookie is absent — and both the click identifier and the five UTM parameters in the page address sent along with the event. Without your consent they leave our systems only within the narrower scope described in “Transfer of the enquiry event without consent” below — and not at all if you declined in the consent bar.

Your right to object. You may object to this processing at any time on grounds relating to your particular situation, under Art. 21 GDPR, informally to [email protected]. Such an objection is distinct from withdrawing the consent described above and has to be declared separately: clicking "Decline" in the consent bar likewise ends only the transfer to Meta, not the storage in our own systems described here.

Transfer of the enquiry event without consent

If you arrived on the /start landing page or the live demo through one of our paid ads and made no choice in the consent bar — neither accepting nor declining — we transfer the Lead event to Meta after you successfully submit the form. In that case the basis is not your consent but our legitimate interest.

When this applies — and when it does not.

No access to your device. In this case the Meta Pixel is not loaded, no cookies are set, and we do not read any either — in particular not _fbp or _fbc. Section 25(1) TDDDG is therefore not engaged, as neither information is stored on your device nor is any accessed. Everything transferred comes from the form you submitted, from the address you opened, and from your connection to our server.

What is transferred. Compared with the section above, everything derived from cookies falls away:

• your email address, phone number, and first and last name — each as a cryptographic hash (SHA-256), not in plain text
• your IP address and your browser's identifier (user agent) — these two unhashed, in plain text, because Meta requires them in that form
• the click identifier of the ad you arrived from. We derive this on our server from the fbclid parameter of the address you opened; it does not come from a cookie
• the address of the page on which you submitted the form
• time and event identifier

Legal basis and balancing. Art. 6(1)(f) GDPR. Our legitimate interest is to measure the performance of our own paid ads — which ad led to which enquiry — and not to spend our advertising budget on ads that do not work. That interest exists only in relation to people who actually arrived through one of our ads; where the click identifier is absent, no transfer takes place. Only what is necessary for attribution is transferred, and the identifying details only as hashes. In balancing we took into account that by submitting the form you actively responded to an ad, and that the transfer does not serve to track your behaviour beyond our website.

We expressly note that the German supervisory authorities regularly require consent for transfers to Meta, and that our assessment departs from that view.

Joint controllership. What the section above says continues to apply: for collection and transfer we and Meta are joint controllers under Art. 26 GDPR; Meta alone is responsible for further processing in its systems. For processing in the United States, the adequacy decision named under “Transfers to third countries” applies.

Retention on our side. As above: we delete the values derived for the transfer as soon as it has concluded, at the latest two days after your submission. The event identifier, the time, and a record of which legal basis the transfer rested on remain stored as evidence.

Your right to object (Art. 21 GDPR). You may object to this processing at any time on grounds relating to your particular situation — informally to [email protected]. Beyond that, clicking “Decline” in the consent bar is enough for the future: a declared refusal also ends the transfer described here, for every further submission. As with withdrawal above: events already sent to Meta cannot be recalled, and up to 15 minutes typically pass between your submission and our sending run.

Transfers to third countries

Where Meta processes data in the United States, the transfer relies on the European Commission's adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework (Art. 45 GDPR). Meta Platforms, Inc. is certified under that framework; the certification can be checked on the official list at dataprivacyframework.gov.

For our other providers (Cloudflare Inc., Amazon Web Services) we rely on EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR together with a data processing addendum. A copy of the Standard Contractual Clauses is available from us on request.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection to processing based on legitimate interests (Art. 21), withdrawal of consent with effect for the future (Art. 7(3)), and to lodge a complaint with a supervisory authority (Art. 77 GDPR).

To exercise your rights, please contact [email protected]. The supervisory authority responsible for us is the Commissioner for Personal Data Protection, 1 Iasonos Street, 1082 Nicosia, Republic of Cyprus.

The full set of rights, retention periods and processors is set out in the German version at vesturium.com/privacy.

In the event of any discrepancy between the German version and a version in another language, the German version prevails.