Privacy Policy

VITAIRA Privacy Policy

VITAIRA Holding GmbH, Theatinerstrasse 14, 80333 Munich (hereinafter “VITAIRA”), provides information here regarding our processing of personal data.

You can contact our Data Protection Officer by email at info@vitaira-group.com.

Below, we have compiled the most important information regarding typical data processing activities, broken down by data subject group. For certain data processing activities that affect only specific groups, the disclosure requirements are met separately.

Whenever the term “data” is used in this text, it refers exclusively to personal data as defined by the GDPR.

1. Visitors to the website

When you use the website, certain information is sent to our website’s server by the browser running on your device for technical reasons. This data is stored and processed on our server.

  1. We process the data listed below for the purpose of providing the website content you access, ensuring the security of the IT infrastructure used, troubleshooting, enabling and simplifying searches on the website, and managing cookies. We do not plan to change these purposes.
  2. The data processed consists of HTTP data: HTTP data refers to log data that is generated for technical reasons when the website is accessed via the Hypertext Transfer Protocol (Secure) (HTTP(S)): This includes your IP address, the type and version of your web browser, the operating system you are using, the page you accessed, the page you visited previously (referrer URL), and the date and time of the request. HTTP(S) data is also generated on servers operated by service providers (e.g., when accessing third-party content).
  3. The legal basis for the processing is our legitimate interest in the technical operation of a website (Art. 6(1)(f) of the GDPR).
  4. The data is automatically provided by the data subject's browser.
  5. The recipients of the personal data are IT service providers whom we engage under a data processing agreement.
  6. IP addresses are anonymized at the end of the session. Pseudonymized usage data is deleted no later than 14 days after the session ends.
  7. It is not possible to use the website without providing personal data—such as an IP address. It is technically impossible to communicate via the website without providing such data.

2. Visitors to VITAIRA's social media profiles

VITAIRA has profiles on social media. The social media platforms are operated by service providers who process the data necessary to provide these pages.

The purpose of data processing on our social media profiles is to provide interesting content and interact with visitors on social media platforms. Depending on the social media service, usage data may also be analyzed to improve our social media presence.

  1. The data processed consists of content and usage data from social media profiles.
  2. Information and data displayed or shared on VITAIRA’s social media profiles may be accessible to the respective social media platform operator, its users, or contracted service providers.
  3. Further details regarding data processing are provided below:

LinkedIn:

We and LinkedIn (for users in the EU/EEA: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland) are jointly responsible for the processing of personal data via the VITAIRA LinkedIn page. The joint controller agreement is available at: https://www.linkedin.com/legal/l/page-joint-controller-addendum.

Under the agreement, LinkedIn is responsible for informing the data subjects about the processing activities. LinkedIn's Privacy Policy is available at: https://www.linkedin.com/legal/privacy-policy.

Data subjects may exercise their rights with any of the data controllers—VITAIRA and/or LinkedIn.

The legal basis for VITAIRA’s processing of the data is its legitimate interest in analyzing usage data to improve the LinkedIn page (Art. 6(1)(f) of the GDPR).

3. Communication partners, interested parties

  1. The purpose of the processing is to prepare for and carry out a contractual relationship or other communication. There are no plans to change these purposes.
  2. The data processed includes names, contact information, the content of communications, as well as the time and technical metadata of the communications.
  3. The legal basis for processing your data is, in the case of contracts with natural persons, the initiation of a contract or the contract itself (Art. 6(1)(b) GDPR); in the case of contracts with legal entities, our legitimate interest in communicating with the contract-related contacts (Art. 6(1)(f) GDPR), as well as statutory obligations, in particular tax and commercial law provisions (Art. 6(1)(c) GDPR). In the case of communication alone, the legal basis is our legitimate interest in documenting communication processes (Art. 6(1)(f) GDPR).
  4. The contact information is actively provided by the data subject. Communication metadata and communication data are collected automatically.
  5. Contact and contract information may be disclosed to other service providers, business partners, and government agencies and authorities to the extent necessary for the performance of the contract or assignment. We also engage service providers in the capacity of data processors to perform services, in particular for the provision, maintenance, and support of IT systems.
  6. Data pertaining to contractual partners and service providers is deleted ten calendar years after the termination of the contract or engagement. Inquiries and general correspondence are automatically deleted after ten calendar years.
  7. The processing of contact information by service providers and business partners is necessary to fulfill the contract or order. If the information is not provided, communication may be significantly disrupted. Prospective clients are required to provide their information. Communication is not possible without this information.

4. Rights of Data Subjects and Additional Information

  1. We do not use automated individual decision-making processes.
  2. There are no plans to change the purposes mentioned above.
  3. You have the right to request information at any time regarding all personal data we process about you.
  4. If the personal data is incorrect or incomplete, you have the right to have it corrected and supplemented.
  5. You may request the deletion of your personal data at any time, unless we are legally obligated or authorized to continue processing the data.
  6. If the legal requirements are met, a restriction on the processing of personal data may be requested.
  7. You have the right to object to the processing of your data if such processing is carried out for the purposes of direct marketing or profiling.
  8. If the processing is based on a balancing of interests, you may object to the processing by providing reasons based on your specific situation.
  9. If data processing is based on consent or is carried out under a contract, you have the right to have the data you have provided transferred, provided that this does not infringe on the rights and freedoms of others.
  10. If we process data based on a declaration of consent, you have the right to revoke that consent at any time, effective for the future. Any processing carried out prior to the revocation remains unaffected by the revocation.
  11. You also have the right at any time to file a complaint with a data protection supervisory authority if you believe that data processing has been carried out in violation of applicable law.

As of December 2025