Data protection declaration

VegaSystems Privacy Policy

1. Controller and Data Protection Officer

Controller within the meaning of the General Data Protection Regulation (GDPR):

VegaSystems GmbH & Co. KG 

Halberstädter Str. 99 

33106 Paderborn, Germany 

VegaSystems GmbH & Co. KG is represented by its general partner, VegaSystems Verwaltungs-GmbH, registered office in Paderborn, Local Court (Amtsgericht) Paderborn HRB 9884, which in turn is represented by its managing directors Tobias Altemeier and Sascha Fleiss.

Phone: +49 5251 14854-0 

Email: info@vegasystems.de

Data Protection Officer:

Floß GmbH, Sebastian von der Au, Hopfengarten 10, 33775 Versmold, Germany

Email: privacy@vegasystems.de

Competent supervisory authority:

State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de

Last updated: 12 October 2026

2. General Information on Data Processing

2.1 Scope. This privacy policy informs you about the processing of personal data on our website www.vegasystems.de, including its subpages, and in connection with our online services. For the processing of data within the scope of our customer contracts (e.g. colocation, cloud, hosting), the respective contracts additionally apply, in particular data processing agreements pursuant to Art. 28 GDPR.

2.2 Definitions. The terms used, such as “personal data” or “processing”, correspond to the definitions in Art. 4 GDPR.

2.3 Legal bases. We process personal data on the following legal bases:

• Consent: Art. 6(1)(a) GDPR; when storing or accessing information on your terminal device, additionally Section 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act)
• Performance of a contract and pre-contractual measures: Art. 6(1)(b) GDPR
• Legal obligation: Art. 6(1)(c) GDPR
• Legitimate interests: Art. 6(1)(f) GDPR; we specify the respective interest for each individual processing operation
• Strictly necessary storage/access on your terminal device: Section 25(2) No. 2 TDDDG

2.4 Storage period. We store personal data only for as long as is necessary for the respective purpose or as required by statutory retention obligations. Specific periods are stated for the individual processing operations and in Section 11.

2.5 Recipients. We only disclose personal data if a legal basis permits this. Recipients may in particular be IT and communication service providers, tax advisors and auditors, as well as public authorities within the scope of statutory obligations. Service providers who process data on our behalf are contractually bound by us in accordance with Art. 28 GDPR.

2.6 Transfers to third countries. Data is only transferred to countries outside the EU or the EEA if the requirements of Art. 44 et seq. GDPR are met – for example, on the basis of an adequacy decision of the EU Commission (for the USA: the EU-US Data Privacy Framework, provided the recipient is certified) or of EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. We state which basis applies in each case for the respective service.

2.7 Obligation to provide data. You are not legally required to provide your data. However, without certain information we cannot conclude a contract or process your request; we point this out at the time of collection.

2.8 Automated decision-making. No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

2.9 Data security. We implement technical and organisational measures in accordance with Art. 32 GDPR in line with the state of the art; our information security management system is certified according to ISO/IEC 27001. Transmission between your browser and our server is TLS-encrypted.

3. Provision of the Website and Server Log Files

3.1 Hosting. Our website is operated on our own servers in our data centre in Paderborn. No data is transferred to external hosting providers.

3.2 Log files. When you access our website, we automatically process: the page or file accessed, date and time, amount of data transferred, HTTP status code, browser type and version, operating system, referrer URL and IP address.

3.3 Purpose and legal basis. The processing serves to deliver the website and to ensure the security of our systems, in particular to detect and defend against attacks and misuse. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and stable operation of the website.

3.4 Storage period. Log files are deleted after 7 days at the latest. Data required to investigate a specific security incident is retained until the incident has been resolved.

4. Cookies and Consent Management

4.1 General. Cookies and similar technologies store information on your terminal device or read it from there. We use technically necessary cookies on the basis of Section 25(2) No. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR. All other cookies and tracking technologies are only used with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).

4.2 Consent tool. To manage your consents, we use the TYPO3 extension “mindshape Cookie Consent”, which runs on our own server. Your selection is stored in the cookie “cookie_consent” for 12 months. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (obligation to provide proof) and Section 25(2) No. 2 TDDDG.

4.3 Overview. You can see which cookies we use in detail in the cookie settings under “Show details”.

4.4 Withdrawal. You can withdraw or change your consent at any time with effect for the future via the “Change cookie settings” button in the footer. The lawfulness of the processing carried out until withdrawal remains unaffected.

Change cookie settings

5. Audience Analysis with Matomo

5.1 Scope. With your consent, we use Matomo, an open-source software for the statistical analysis of website usage. Matomo runs exclusively on our own servers (piwik.vegasystems.de); the data is not passed on to third parties.

5.2 Data processed. Truncated IP address (the last two bytes are removed before storage), pages accessed, time spent, referrer, browser, operating system, screen resolution and time of access. Pseudonymous usage profiles may be created from this data; this data is not combined with data about your person.

5.3 Cookies. Matomo sets cookies with a duration of up to 13 months.

5.4 Legal basis. Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. No data is collected without consent. 

6. Other Third-Party Services 

No other services are currently integrated.

7. Contact, Customer Portal and Contract Processing

7.1 Contacting us. If you contact us via the contact form, email or phone, we process your details (e.g. name, company, contact details, content of the request) in order to handle your request. The legal basis is Art. 6(1)(b) GDPR insofar as your request is aimed at concluding a contract, otherwise Art. 6(1)(f) GDPR (interest in responding to enquiries). We delete the data once the request has been fully processed and no retention obligations apply.

7.2 Contract processing. To fulfil our contracts, we process master data (e.g. company, contact person, address, contact details), contract data (e.g. booked services, terms) and payment data. The legal basis is Art. 6(1)(b) GDPR and, for obligations under tax and commercial law, Art. 6(1)(c) GDPR.

7.3 Customer portal. For the use of our customer portal (login), we process your access data and the contract data stored in the portal. To protect against misuse, we log logins with IP address and time for 14 days; the legal basis is Art. 6(1)(f) GDPR (protection of your account and our systems). After the end of the contract, the account is deleted unless retention obligations apply.

7.4 Status page. We provide information about service disruptions at vegasystems-status.de. The same terms as described in Section 3 apply to this domain.

8. Newsletter 

8.1 Subscription. We only send our newsletter containing information about products, offers and our company with your consent (Art. 6(1)(a) GDPR). Your email address is mandatory; your name is optional and is used to address you personally.

8.2 Double opt-in and logging. After subscribing, you will receive an email asking you to confirm. We log the time of subscription and confirmation as well as the IP address in order to be able to prove your consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).

8.3 Mailing service provider. We send the newsletter ourselves via our own systems; no external mailing service provider is used.

8.4 Performance tracking. No personalised tracking takes place.  

8.5 Unsubscribing. You can unsubscribe from the newsletter at any time via the link in each issue or by email to info@vegasystems.de. We will then delete your data; we retain your email address and proof of your previous consent for up to three years in order to be able to demonstrate lawful processing (Art. 6(1)(f) GDPR).

9. Job Applications

9.1 Processing. If you apply to us by email, we process your application documents and contact details in order to carry out the application process. The legal basis is Art. 6(1)(b) GDPR (initiation of an employment relationship); insofar as you voluntarily provide special categories of data, additionally Art. 9(2)(b) GDPR.

9.2 Access. Only the persons involved in the selection process have access. 

9.3 Storage period. If no employment relationship is established, we delete your documents six months after the conclusion of the process in order to be able to defend ourselves against claims under the German General Equal Treatment Act (AGG) (Art. 6(1)(f) GDPR). Longer storage for future vacancies only takes place with your consent.

10. Social Media Presences

10.1 Links. On our website, we link to our profiles on Facebook, Instagram, LinkedIn and Xing. These are simple links; no data is transmitted to these networks when you visit our website. Only when you click on a link do the data protection provisions of the respective provider apply.

10.2 Our profiles. When you visit our profiles, the operators also process your data for their own purposes. We are jointly responsible with the respective provider for certain processing operations (Art. 26 GDPR), in particular for page statistics (Insights). The legal basis for our processing is Art. 6(1)(f) GDPR (interest in corporate communication). You can most effectively assert your data subject rights directly with the provider.

In the case of Meta and LinkedIn, a transfer to the USA is possible; it takes place on the basis of the EU-US Data Privacy Framework.

11. Retention and Deletion

We delete personal data as soon as it is no longer required for its purpose and no statutory retention obligations preclude deletion. If data is subject to a retention obligation, we restrict its processing and delete it once the retention period has expired.

The periods begin at the end of the calendar year in which the document was created. 

12. Domain Registration (Product)

For the registration and management of domains, we transfer the data of the domain holder and the contact persons (name, address, contact details, and for certain extensions also ID or tax numbers) to our registrar InterNetX GmbH and to the responsible registry, e.g. DENIC eG for .de. The registry processes the data under its own responsibility and may publish it in the WHOIS in accordance with its policies. For extensions with a registry outside the EU (e.g. .cn), the transfer to a third country takes place for the performance of the registration contract (Art. 49(1)(b) GDPR). The legal basis is Art. 6(1)(b) GDPR.

13. Your Rights

13.1 Data subject rights. You have the following rights vis-à-vis us with regard to personal data concerning you:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to withdraw consent with effect for the future (Art. 7(3) GDPR)

To exercise your rights, a message to privacy@vegasystems.de or to the address stated above is sufficient.

13.2 Right to lodge a complaint. You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular with the LDI NRW, which is responsible for us (see Section 1).

13.3 RIGHT TO OBJECT PURSUANT TO ART. 21 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is carried out on the basis of Art. 6(1)(f) GDPR (legitimate interests). We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where your data is processed for direct marketing purposes, you have the right to object at any time to such processing; this also applies to profiling to the extent that it is related to such direct marketing. Following an objection, we will no longer process your data for direct marketing purposes.

The objection can be made without any particular form, e.g. by email to privacy@vegasystems.de.

14. Changes to this Privacy Policy

We will amend this privacy policy if our data processing or the legal situation changes. The version published on this page applies in each case; the date of the last amendment can be found above under “Last updated”.