Privacy policy
As of 23 October 2026
This English translation is provided for convenience only. The German version of the privacy policy is the legally binding one.
Note: this version describes the new website (beta) and still needs legal review before the public launch. Items marked “[to be checked: …]” are still open.
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
pruve GmbH Dachauer Straße 159 80636 München Germany
Email: [email protected] Commercial register: HRB 304961, Amtsgericht München (Munich Local Court) Represented by the Managing Director Ben Bommhardt
2. Data protection officer
As fewer than 20 people at our company are permanently engaged in the automated processing of personal data, appointing a data protection officer under Art. 37 GDPR in conjunction with § 38 BDSG (German Federal Data Protection Act) is not required. If you have any questions about data protection, please use the contact details above.
3. General information on data processing
3.1 Scope of processing
We process personal data only insofar as this is necessary to provide a functioning website, our content and services, or to handle your enquiries.
3.2 Legal bases
- Art. 6 (1) (a) GDPR – consent
- Art. 6 (1) (b) GDPR – contract or pre-contractual measures
- Art. 6 (1) (c) GDPR – legal obligation
- Art. 6 (1) (f) GDPR – legitimate interest
Where information is stored on or read from your device, this is additionally governed by § 25 TDDDG (German Telecommunications Digital Services Data Protection Act).
3.3 Storage period
Personal data is deleted as soon as the purpose of storage no longer applies, unless statutory retention obligations (e.g. § 257 HGB, § 147 AO) prevent this.
3.4 Recipients and processors
We use service providers that process data on our behalf. We have concluded data processing agreements with them under Art. 28 GDPR or accepted their data processing terms. The individual service providers are named in the following sections; an overview can be found in section 10.
4. Hosting, provision of the website and server log files
4.1 Operation of the website by us
Our website runs on the open-source content management system EmDash, which we operate ourselves on our own virtual servers; content and settings are kept in a database of our own. The servers are located at [to be checked: hosting provider, data centre and location]. Incoming connections are received encrypted (TLS) by our firewall and forwarded to the website through an internal gateway server. We do not use an external content delivery network (CDN).
Each time the website is accessed, our gateway server automatically logs the following data:
- IP address
- Date and time of access
- Address (URL) requested and request method
- Status code, amount of data transferred and response time
The referrer URL, browser type and the other request headers are not logged. [to be checked: logging by the firewall (HAProxy)]
This data is technically necessary to deliver the website and to ensure the security and stability of the system. It is not combined with other data sources.
Storage period: the logs are kept in rotating files of at most five times 20 MB per service; once this size is reached, the oldest entries are overwritten. There is currently no fixed deletion period. [to be checked: set a deletion period for server log files in days]
The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in providing the website securely and without errors.
4.2 Fonts, images and external links
We serve fonts, images and scripts exclusively from our own server. No third-party content is loaded when you visit the website: there are no embedded font services, maps, videos or social media plugins. Email addresses appear on the page as ordinary email (mailto) links.
Our pages link to external services: appointment booking with Zeeg (zeeg.me, see section 7), our profiles on LinkedIn and XING, and sources in our articles. Data is only transferred to these providers when you click such a link; the privacy policy of the respective provider then applies. An email link opens your own email program. [to be checked: the LinkedIn link currently still leads through the previous website www.pruve.org.]
5. Cookies, local storage and web analytics
5.1 Technically necessary cookies and local storage
On the public pages our website sets at most the following cookie and stores at most the following settings in your browser’s local storage, each only once you choose the setting concerned:
Name | Purpose | Storage period |
|---|---|---|
pruve_lang (cookie) | Stores the website language chosen with the DE/EN switch | 1 year |
pruve-theme (local storage) | Stores the light or dark appearance chosen with the switch | until you delete the entry in your browser |
pruve.design (local storage) | Stores a design chosen with the ?theme= link parameter | until you delete the entry or open ?theme=auto |
These entries contain only the chosen setting (e.g. “en” or “dark”) and no identifier. They are strictly necessary for the service you have expressly requested, showing the site in the chosen language and appearance. Consent is therefore not required under § 25 (2) no. 2 TDDDG. The legal basis for the associated processing is Art. 6 (1) (f) GDPR.
We do not use marketing or tracking cookies.
5.2 Editorial area
Only when pruve staff sign in to the website’s editorial area (/_emdash) does the website set a session cookie (astro-session) and technically necessary cookies for the sign-in process; sign-in takes place through our platform app.pruve.org. These cookies are not set for visitors to the public pages. The session cookie is deleted when the browser is closed. The legal basis is § 25 (2) no. 2 TDDDG in conjunction with Art. 6 (1) (f) GDPR.
5.3 Web analytics
We do not use any web analytics or tracking services and do not create usage profiles.
6. Contact by email
6.1 Description and scope
You can contact us at the email address provided. In doing so, we process the data you send us (e.g. name, email address, company, content of the message). There is no contact form on our website.
Our email mailboxes are operated by Infomaniak Network SA, Geneva, Switzerland. Emails to [email protected] are forwarded within our domain to the Managing Director's mailbox. Enquiries may then be transferred to our CRM (see section 8).
6.2 Legal basis
Art. 6 (1) (f) GDPR (legitimate interest in answering your enquiry); if your enquiry is aimed at concluding a contract, additionally Art. 6 (1) (b) GDPR.
6.3 Storage period
The data is deleted as soon as the enquiry has been dealt with conclusively and no statutory retention obligations apply. We keep business correspondence that qualifies as a commercial or business letter for up to six years (§ 257 HGB).
6.4 Objection
You can object to the storage of your data at any time. The communication can then not be continued.
7. Appointment booking via Zeeg
7.1 Description and scope
To book appointments (e.g. a diagnostic call), we use the appointment booking service Zeeg. The provider is Zeeg GmbH, Berlin, Germany. When you click a booking link, you are redirected to zeeg.me; no data is transferred to Zeeg before that. In doing so, Zeeg processes the following on our behalf:
- Name, email address and, where applicable, other data you enter in the booking form
- Selected appointment
- Technical connection data (e.g. IP address, browser information)
The appointment data is synchronised with our calendar at Infomaniak Network SA, Geneva, Switzerland, and may be transferred to our CRM (see section 8).
According to its own information, Zeeg stores all data on servers in Germany. Zeeg's privacy policy additionally applies to data processing on zeeg.me.
7.2 Legal basis
Art. 6 (1) (b) GDPR (carrying out pre-contractual measures at your request) and Art. 6 (1) (f) GDPR (efficient appointment scheduling).
7.3 Storage period
Booking data is deleted as soon as it is no longer needed to hold and follow up on the appointment, unless statutory retention obligations apply or a contractual relationship results from it.
8. CRM system
8.1 Description and scope
To manage enquiries and business relationships we use a CRM system [to be checked: CRM system, provider and storage location]. The CRM stores:
- Contact data from email enquiries and appointment bookings
- Email correspondence
- Notes on conversations and business transactions
8.2 Access and data security
Access to the CRM is restricted to the Managing Director of pruve GmbH. Data is transmitted in encrypted form only (TLS). [to be checked: confirm for the current CRM system]
8.3 Legal basis and storage period
Art. 6 (1) (b) GDPR, insofar as the processing serves the initiation or performance of a contract, otherwise Art. 6 (1) (f) GDPR (legitimate interest in managing business contacts). The data is deleted as soon as it is no longer required for these purposes and no statutory retention obligations apply.
9. Transfers to third countries
Personal data is transferred to countries outside the EU / EEA in the following cases:
- Infomaniak Network SA (Switzerland): The European Commission has issued an adequacy decision for Switzerland (Art. 45 GDPR).
Beyond this, no data is transferred to third countries. [to be checked: hosting provider and CRM system]
10. Overview of processors
Service provider | Purpose | Registered office | Third country |
|---|---|---|---|
[to be checked: hosting provider] | Website servers and data centre | [to be checked] | [to be checked] |
Infomaniak Network SA | Email, calendar | Switzerland | yes, adequacy decision |
Zeeg GmbH | Appointment booking | Germany | no |
[to be checked: CRM provider] | CRM | [to be checked] | [to be checked] |
11. Rights of the data subject
If your personal data is processed, you have the following rights against us:
- Access (Art. 15 GDPR)
- Rectification (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Notification of recipients about rectification, erasure or restriction (Art. 19 GDPR)
- Data portability (Art. 20 GDPR)
- Withdrawal of consent given, with effect for the future (Art. 7 (3) GDPR)
- Not to be subject to a decision based solely on automated processing, including profiling (Art. 22 GDPR)
Right to object (Art. 21 GDPR)
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Art. 6 (1) (e) or (f) GDPR. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
If your data is processed for direct marketing purposes, you can object to this processing at any time without giving reasons.
To exercise your rights, an email to [email protected] is sufficient.
Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)
You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA, Bavarian Data Protection Authority) Promenade 18 91522 Ansbach Phone: +49 (0) 981 180093-0 Email: [email protected]
12. Changes to this privacy policy
We will update this privacy policy whenever our data processing or the legal requirements change. The version published on this page applies.