Velonify

Privacy policy

How we handle your data when you visit our website or contact us.

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Johannes Braun
Velonify, owner Johannes Braun
Zur Leimengrube 11
97947 Paimar
Germany

Email: johannes@velonify.de

2. General information on data processing

As a rule, we only process personal data of our users to the extent necessary to provide a functional website and our content and services. Personal data is generally only processed with consent or on one of the following legal bases:

  • Art. 6(1)(a) GDPR, if you have consented to the processing.
  • Art. 6(1)(b) GDPR, if the processing is necessary for the performance of a contract or to take steps prior to entering into a contract.
  • Art. 6(1)(c) GDPR, if the processing is necessary for compliance with a legal obligation.
  • Art. 6(1)(f) GDPR, if the processing is necessary for the purposes of our legitimate interests and your interests, fundamental rights and freedoms do not override them.

Personal data is deleted as soon as the purpose of storage no longer applies. Storage beyond this point only takes place if required by statutory retention obligations.

3. Hosting

This website is hosted by Netlify, Inc., 44 Montgomery Street, Suite 300, San Francisco, CA 94104, USA. When you visit the website, the data listed under section 4 is processed on the hosting provider's servers. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, fast and efficient provision of our online offering.

4. Server log files

Each time our website is accessed, the system automatically collects data and information from the accessing computer. The following data is collected:

  • IP address of the requesting device
  • Date and time of access
  • Page or file accessed and amount of data transferred
  • Referrer URL (the previously visited page)
  • Browser type and version, and operating system

The data is stored in the system's log files. It is not combined with other personal data. Temporary storage is necessary to deliver the website to your computer and to ensure the security of the systems. The legal basis is Art. 6(1)(f) GDPR.

The data is deleted as soon as it is no longer required for the purpose for which it was collected. Collecting data to provide the website and storing it in log files is essential for operating the website. There is therefore no option to object.

5. Contacting us

Contact form and email

If you contact us via the contact form or by email, we process the data you provide. For the contact form, this is your name, email address, store URL, the topics you selected and your message. We use this data solely to handle your request and to get in touch with you.

The legal basis is Art. 6(1)(b) GDPR where your request relates to the performance of a contract or pre-contractual measures, otherwise Art. 6(1)(f) GDPR (legitimate interest in handling requests effectively). The data is deleted once your request has been fully handled and no statutory retention obligations prevent this.

Forwarding to our internal CRM

We also forward contact-form requests automatically to our internal CRM so we can process and follow up on them there. Technically, this forwarding runs through a script inside Google Sheets (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The legal basis is Art. 6(1)(b) or (f) GDPR, as above.

Free downloads (resources)

On velonify.de/ressourcen we offer free working aids such as checklists or templates for AI tools. If you request one, we process your first name, your email address, the shop system you use, optionally your shop address and the link that brought you to the page (so-called UTM parameters, for example “linkedin”). We use this to send you the download by email and to record whether and when the download link was opened.

The legal basis for sending it is Art. 6(1)(b) GDPR, as you request the working aid from us. We also store the details in our internal CRM so that we can match later enquiries and see which content is in demand. The legal basis for this is Art. 6(1)(f) GDPR. You can object to this at any time; a short message to hallo@velonify.de is enough. We only send you promotional emails if you have explicitly ordered and confirmed the newsletter.

Technically, Netlify (see section 3) receives the form. The details are stored in Google Sheets, the email is sent via Google Workspace and the files are provided via Google Drive, each operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We delete the details once they are no longer needed for these purposes or you object, unless statutory retention obligations apply.

Free shop check (Shop-Roast)

For the free shop check you also give us the address of your shop and confirm that you work for this shop. We then load publicly accessible pages of the shop and have the loading time measured by Google PageSpeed Insights. The check runs on Google Cloud servers in Frankfurt (Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland). For suggested wording of the results we use the AI model Claude by Anthropic, PBC (USA). We only transmit the shop address and the results of the check, not your name and not your email address. Our team reads and completes every report before you receive it.

We provide the finished report at a personal address on velonify.de that only people with the link know. The page is blocked for search engines. We record whether and how often the report was opened. We send you the link by email via Google Workspace. The legal basis is Art. 6(1)(b) GDPR, as you request the check from us. If all places are taken, we store your details for the waiting list and get in touch as soon as we check shops again. Otherwise, what is said above about free downloads applies (storage in the CRM, objection, deletion).

Booking a call

Via velonify.de/en/booking and the links in our emails you can book a call with us directly. Booking runs on Google Calendar appointment scheduling (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). We process your name, email address, the chosen time and the details you enter in the booking form, such as your store’s address, your topic or, optionally, your phone number. You receive a calendar invitation with a Google Meet link and reminders by email.

The legal basis is Art. 6(1)(b) GDPR, as the booking serves to prepare or perform a contract, and otherwise our legitimate interest in simple scheduling under Art. 6(1)(f) GDPR. Google may also process data in the USA; Google is certified under the EU-U.S. Data Privacy Framework. We delete the booking data once it is no longer needed for the request or collaboration and no statutory retention obligations apply.

Newsletter

If you also tick the newsletter box in the form, the email contains a confirmation link (double opt-in). Only after you confirm do we add you to the mailing list. To be able to prove your subscription, we store the time of sign-up and confirmation as well as the wording you agreed to.

The legal basis is your consent under Art. 6(1)(a) GDPR. You can withdraw it at any time with effect for the future, via the unsubscribe link in every newsletter or by message to hallo@velonify.de. If we use a dedicated newsletter service provider for sending, we will name it here beforehand.

Client portal (kunden.velonify.de)

For our clients we run a client portal at kunden.velonify.de. Contacts we have given access can see the status of their project, approve drafts, send us messages, submit requests and exchange files with us. Access is only granted to people we enable at the request of the respective client.

To log in, you enter your email address. We then send you a login link via Google Workspace that is valid for 15 minutes and works only once. After logging in, your browser stores an encrypted session identifier in local storage (localStorage) so that you stay logged in for 30 days. It also stores when you last opened the portal (for the “New” label) and links you save in the UTM generator. This information does not leave your browser; you can delete it at any time in your browser settings. The legal basis is Section 25 (2) No. 2 TDDDG, as this storage is technically necessary for the login you request.

In the portal we process your name, email address, company, the time of your last login as well as your approvals, messages, requests and uploaded files. The legal basis is Art. 6 (1) (b) GDPR where you yourself are our contractual partner, and otherwise Art. 6 (1) (f) GDPR (legitimate interest in an orderly collaboration with your company).

The site itself is delivered by GitHub Pages (GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA); GitHub processes your IP address in server logs and is certified under the EU-U.S. Data Privacy Framework. The portal’s data is stored on Google Cloud servers in Frankfurt (Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland), files in Google Drive (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The portal serves its fonts itself. We deactivate your access as soon as the collaboration ends or your company requests it. We delete project data once it is no longer needed and no statutory retention obligations apply.

6. Fonts

This website uses the fonts Krona One and Albert Sans. The font files are stored on our own web server and delivered from there. No connection to Google or any other font provider is made.

7. Cookies and similar technologies

Where cookies or similar technologies that are technically necessary to operate the website are used, this is based on Section 25(2) No. 2 TDDDG and Art. 6(1)(f) GDPR. All other cookies and similar technologies, in particular for statistics and marketing, are only used with your explicit consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

You can withdraw your consent at any time with effect for the future. You can also set your browser to reject or delete cookies. This may limit the functionality of the website.

With your consent, we use Microsoft Clarity, an analytics service of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA (for the EEA: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). Clarity collects pseudonymised usage data such as clicks, scrolling, mouse movements, page views, and device and browser information, and uses it to create heatmaps and session recordings. Cookies (including “_clck” and “_clsk”) are set for this purpose. Input fields are masked. The script is only loaded after you consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw your consent at any time.

8. Recipients and transfers to third countries

We only pass personal data on to third parties if this is necessary to perform a contract, we are legally obliged to do so, or you have consented. Service providers who process data on our behalf (e.g. hosting and email) are carefully selected and contractually bound under Art. 28 GDPR.

Where data is transferred to countries outside the European Union or the European Economic Area, this only happens if there is an adequacy decision by the European Commission (such as the EU-U.S. Data Privacy Framework for certified companies) or other appropriate safeguards under Art. 46 GDPR, in particular standard contractual clauses.

9. Storage period

We only store personal data for as long as necessary for the respective purpose. After that, the data is deleted or blocked unless statutory retention obligations apply. Retention periods under commercial and tax law are generally six or ten years.

10. Your rights

You have the following rights towards us regarding the personal data concerning you:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to notification regarding rectification, erasure or restriction (Art. 19 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to withdraw consent with effect for the future (Art. 7(3) GDPR)

To exercise these rights, an informal message to the following address is sufficient: johannes@velonify.de.

Right to object under Art. 21 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is based on Art. 6(1)(f) GDPR. We will then no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

11. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of personal data concerning you infringes the GDPR (Art. 77 GDPR). The supervisory authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information Baden-Württemberg)
Lautenschlagerstraße 20
70173 Stuttgart

Website: www.baden-wuerttemberg.datenschutz.de

12. Data security

For security reasons and to protect the transmission of confidential content, such as requests you send to us, this website uses SSL/TLS encryption. You can recognize an encrypted connection by the browser's address bar changing from “http://” to “https://” and by the lock icon in your browser bar.

13. Currency and changes to this privacy policy

This privacy policy is current as of October 2026. As our website evolves, or due to changes in legal or regulatory requirements, it may become necessary to update it. You can view the current version on this page at any time.

Velonify

Privacy policy

How we handle your data when you visit our website or contact us.

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Johannes Braun
Velonify, owner Johannes Braun
Zur Leimengrube 11
97947 Paimar
Germany

Email: johannes@velonify.de

2. General information on data processing

As a rule, we only process personal data of our users to the extent necessary to provide a functional website and our content and services. Personal data is generally only processed with consent or on one of the following legal bases:

  • Art. 6(1)(a) GDPR, if you have consented to the processing.
  • Art. 6(1)(b) GDPR, if the processing is necessary for the performance of a contract or to take steps prior to entering into a contract.
  • Art. 6(1)(c) GDPR, if the processing is necessary for compliance with a legal obligation.
  • Art. 6(1)(f) GDPR, if the processing is necessary for the purposes of our legitimate interests and your interests, fundamental rights and freedoms do not override them.

Personal data is deleted as soon as the purpose of storage no longer applies. Storage beyond this point only takes place if required by statutory retention obligations.

3. Hosting

This website is hosted by Netlify, Inc., 44 Montgomery Street, Suite 300, San Francisco, CA 94104, USA. When you visit the website, the data listed under section 4 is processed on the hosting provider's servers. A data processing agreement pursuant to Art. 28 GDPR is in place with the provider.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, fast and efficient provision of our online offering.

4. Server log files

Each time our website is accessed, the system automatically collects data and information from the accessing computer. The following data is collected:

  • IP address of the requesting device
  • Date and time of access
  • Page or file accessed and amount of data transferred
  • Referrer URL (the previously visited page)
  • Browser type and version, and operating system

The data is stored in the system's log files. It is not combined with other personal data. Temporary storage is necessary to deliver the website to your computer and to ensure the security of the systems. The legal basis is Art. 6(1)(f) GDPR.

The data is deleted as soon as it is no longer required for the purpose for which it was collected. Collecting data to provide the website and storing it in log files is essential for operating the website. There is therefore no option to object.

5. Contacting us

Contact form and email

If you contact us via the contact form or by email, we process the data you provide. For the contact form, this is your name, email address, store URL, the topics you selected and your message. We use this data solely to handle your request and to get in touch with you.

The legal basis is Art. 6(1)(b) GDPR where your request relates to the performance of a contract or pre-contractual measures, otherwise Art. 6(1)(f) GDPR (legitimate interest in handling requests effectively). The data is deleted once your request has been fully handled and no statutory retention obligations prevent this.

Forwarding to our internal CRM

We also forward contact-form requests automatically to our internal CRM so we can process and follow up on them there. Technically, this forwarding runs through a script inside Google Sheets (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The legal basis is Art. 6(1)(b) or (f) GDPR, as above.

Free downloads (resources)

On velonify.de/ressourcen we offer free working aids such as checklists or templates for AI tools. If you request one, we process your first name, your email address, the shop system you use, optionally your shop address and the link that brought you to the page (so-called UTM parameters, for example “linkedin”). We use this to send you the download by email and to record whether and when the download link was opened.

The legal basis for sending it is Art. 6(1)(b) GDPR, as you request the working aid from us. We also store the details in our internal CRM so that we can match later enquiries and see which content is in demand. The legal basis for this is Art. 6(1)(f) GDPR. You can object to this at any time; a short message to hallo@velonify.de is enough. We only send you promotional emails if you have explicitly ordered and confirmed the newsletter.

Technically, Netlify (see section 3) receives the form. The details are stored in Google Sheets, the email is sent via Google Workspace and the files are provided via Google Drive, each operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We delete the details once they are no longer needed for these purposes or you object, unless statutory retention obligations apply.

Free shop check (Shop-Roast)

For the free shop check you also give us the address of your shop and confirm that you work for this shop. We then load publicly accessible pages of the shop and have the loading time measured by Google PageSpeed Insights. The check runs on Google Cloud servers in Frankfurt (Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland). For suggested wording of the results we use the AI model Claude by Anthropic, PBC (USA). We only transmit the shop address and the results of the check, not your name and not your email address. Our team reads and completes every report before you receive it.

We provide the finished report at a personal address on velonify.de that only people with the link know. The page is blocked for search engines. We record whether and how often the report was opened. We send you the link by email via Google Workspace. The legal basis is Art. 6(1)(b) GDPR, as you request the check from us. If all places are taken, we store your details for the waiting list and get in touch as soon as we check shops again. Otherwise, what is said above about free downloads applies (storage in the CRM, objection, deletion).

Booking a call

Via velonify.de/en/booking and the links in our emails you can book a call with us directly. Booking runs on Google Calendar appointment scheduling (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). We process your name, email address, the chosen time and the details you enter in the booking form, such as your store’s address, your topic or, optionally, your phone number. You receive a calendar invitation with a Google Meet link and reminders by email.

The legal basis is Art. 6(1)(b) GDPR, as the booking serves to prepare or perform a contract, and otherwise our legitimate interest in simple scheduling under Art. 6(1)(f) GDPR. Google may also process data in the USA; Google is certified under the EU-U.S. Data Privacy Framework. We delete the booking data once it is no longer needed for the request or collaboration and no statutory retention obligations apply.

Newsletter

If you also tick the newsletter box in the form, the email contains a confirmation link (double opt-in). Only after you confirm do we add you to the mailing list. To be able to prove your subscription, we store the time of sign-up and confirmation as well as the wording you agreed to.

The legal basis is your consent under Art. 6(1)(a) GDPR. You can withdraw it at any time with effect for the future, via the unsubscribe link in every newsletter or by message to hallo@velonify.de. If we use a dedicated newsletter service provider for sending, we will name it here beforehand.

6. Fonts

This website uses the fonts Krona One and Albert Sans. The font files are stored on our own web server and delivered from there. No connection to Google or any other font provider is made.

7. Cookies and similar technologies

Where cookies or similar technologies that are technically necessary to operate the website are used, this is based on Section 25(2) No. 2 TDDDG and Art. 6(1)(f) GDPR. All other cookies and similar technologies, in particular for statistics and marketing, are only used with your explicit consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

You can withdraw your consent at any time with effect for the future. You can also set your browser to reject or delete cookies. This may limit the functionality of the website.

With your consent, we use Microsoft Clarity, an analytics service of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA (for the EEA: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). Clarity collects pseudonymised usage data such as clicks, scrolling, mouse movements, page views, and device and browser information, and uses it to create heatmaps and session recordings. Cookies (including “_clck” and “_clsk”) are set for this purpose. Input fields are masked. The script is only loaded after you consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw your consent at any time.

8. Recipients and transfers to third countries

We only pass personal data on to third parties if this is necessary to perform a contract, we are legally obliged to do so, or you have consented. Service providers who process data on our behalf (e.g. hosting and email) are carefully selected and contractually bound under Art. 28 GDPR.

Where data is transferred to countries outside the European Union or the European Economic Area, this only happens if there is an adequacy decision by the European Commission (such as the EU-U.S. Data Privacy Framework for certified companies) or other appropriate safeguards under Art. 46 GDPR, in particular standard contractual clauses.

9. Storage period

We only store personal data for as long as necessary for the respective purpose. After that, the data is deleted or blocked unless statutory retention obligations apply. Retention periods under commercial and tax law are generally six or ten years.

10. Your rights

You have the following rights towards us regarding the personal data concerning you:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to notification regarding rectification, erasure or restriction (Art. 19 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to withdraw consent with effect for the future (Art. 7(3) GDPR)

To exercise these rights, an informal message to the following address is sufficient: johannes@velonify.de.

Right to object under Art. 21 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is based on Art. 6(1)(f) GDPR. We will then no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

11. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of personal data concerning you infringes the GDPR (Art. 77 GDPR). The supervisory authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information Baden-Württemberg)
Lautenschlagerstraße 20
70173 Stuttgart

Website: www.baden-wuerttemberg.datenschutz.de

12. Data security

For security reasons and to protect the transmission of confidential content, such as requests you send to us, this website uses SSL/TLS encryption. You can recognize an encrypted connection by the browser's address bar changing from “http://” to “https://” and by the lock icon in your browser bar.

13. Currency and changes to this privacy policy

This privacy policy is current as of October 2026. As our website evolves, or due to changes in legal or regulatory requirements, it may become necessary to update it. You can view the current version on this page at any time.