Privacy Policy

The controller responsible for data processing on this website is VANTOYA AG, Ridlerstraße 37-39, 80339 München, Germany, phone: +49 (0) 89 470 270 38, email: info@vantoya.com.

We only process personal data where this is necessary to operate the website, provide our content or handle your enquiries. Depending on the operation, the legal basis is your consent (Art. 6(1)(a) GDPR), the performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR), or our legitimate interest (Art. 6(1)(f) GDPR). The relevant basis is stated for each processing activity below.

Where we use service providers that process data on our behalf, this is governed by data processing agreements pursuant to Art. 28 GDPR.

This website is operated on the Lovable hosting platform (lovable.dev) and delivered via a content delivery network. When you access the website, the hosting provider processes technically necessary connection data — in particular your device's IP address, date and time of access, the page requested, your browser (user agent) and the referring page.

This data is required to deliver the website, ensure its stability and security and to defend against attacks. The legal basis is our legitimate interest in operating the website securely (Art. 6(1)(f) GDPR). Log data is only stored for as long as required for these purposes.

Editorial content (in particular the blog) is loaded from the Contentful content management system (Contentful GmbH, Berlin). This happens exclusively on our server; your browser never connects to Contentful and no visitor data is transmitted to Contentful.

On your first visit we ask you via a notice (cookie banner) whether you consent to analytics cookies. Without your consent we set no cookies for analytics or marketing purposes and do not read any information from your device (§ 25 TDDDG, the German implementation of the ePrivacy rules).

Regardless of your decision, we use two strictly necessary storage items:

• Cookie “lang”: remembers your language choice (German/English), stored for 12 months.
• Entry “analytics-consent” in localStorage: remembers your cookie-banner decision so we do not ask again.

The legal basis for this strictly necessary storage is § 25(2) TDDDG in conjunction with our legitimate interest (Art. 6(1)(f) GDPR). You can withdraw any consent you have given at any time with effect for the future — via the “Cookie settings” link in the footer of every page, or right here:

Open cookie settings

We use PostHog (provider: PostHog Inc., USA) to analyse how the website is used. Analytics data is processed on servers within the European Union. Where data is transferred to the USA, this is based on appropriate safeguards under Art. 44 et seq. GDPR (EU-US Data Privacy Framework or EU standard contractual clauses). PostHog operates in two tiers:

a) Cookieless reach measurement (without consent): As long as you do not consent, we measure website usage strictly anonymously and without accessing your device. No cookies are set and nothing is stored in your browser. To distinguish visitors, a short-lived identifier is computed server-side from technical connection data (including IP address and browser signature). The random value used for this changes daily and is deleted afterwards, which rules out recognition beyond a single day or across other websites. The legal basis is our legitimate interest in privacy-preserving reach measurement (Art. 6(1)(f) GDPR). You can object to this processing at any time (Art. 21 GDPR) by emailing info@vantoya.com.

b) Extended analytics (only with consent): If you choose “Accept” in the cookie banner, PostHog sets cookies and stores a pseudonymous identifier in your browser to recognise returning visits. In addition, we then record interactions with the page (e.g. clicks and scroll depth) and create session recordings in which form inputs are masked. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time via “Cookie settings” in the footer; the analytics cookies set until then are deleted.

Only if you have consented do we additionally load Google Tag Manager and, through it, Google Analytics 4 (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google Analytics sets cookies (including “_ga”) to statistically analyse visits. Data may be transferred to Google LLC servers in the USA; Google is certified under the EU-US Data Privacy Framework. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can withdraw at any time via “Cookie settings” in the footer. Without consent, neither Google Tag Manager nor Google Analytics is loaded.

If you contact us by email, phone or via the contact form, we process the details you provide (in the form: name, email address, company and your message) to handle and answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract or its initiation (such as a client enquiry), and otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

We delete this data once it is no longer required to handle your enquiry and no statutory retention obligations apply. As a tax advisory firm we are additionally bound by professional secrecy.

We use the recruiting platform join.com (JOIN Solutions AG, Switzerland; an EU adequacy decision exists for Switzerland) for our job postings and application handling. Our careers page embeds the join.com jobs widget. When you open that page, your browser connects to join.com's servers to load the open positions; connection data (in particular your IP address) is technically transmitted to join.com in the process. The legal basis is our legitimate interest in displaying open positions directly and up to date from our applicant management system (Art. 6(1)(f) GDPR).

If you apply via join.com, your application data is collected there and transmitted to us; join.com's privacy policy applies in addition. Alternatively, you can always apply by email to people@vantoya.com. We process your application data exclusively for the application procedure; the legal basis is Art. 6(1)(b) GDPR in conjunction with § 26 BDSG (German Federal Data Protection Act). If no cooperation comes about, we delete your documents no later than six months after the procedure ends, unless you consent to longer storage (e.g. for future openings).

We maintain profiles on LinkedIn (LinkedIn Ireland Unlimited Company, Dublin) and kununu (New Work SE, Hamburg). This website merely links to them; no plugins or embeds of these platforms are integrated, so no data flows to them when you simply visit our website. When you visit our profiles, the privacy policies of the respective platform apply.

Where data is transferred to countries outside the EU/EEA (see the sections on PostHog and Google), this only happens under the conditions of Art. 44 et seq. GDPR, in particular on the basis of an adequacy decision (EU-US Data Privacy Framework) or EU standard contractual clauses.

We store personal data only for as long as necessary for the purposes stated or as required by statutory retention obligations (e.g. under commercial and tax law). The data is deleted afterwards.

You have the following rights vis-à-vis us:

• Access to the data we process (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

To exercise your rights, an email to info@vantoya.com is sufficient. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), e.g. the Bavarian State Office for Data Protection Supervision (BayLDA), Ansbach.

This website uses TLS encryption throughout (visible via “https://” in the address bar) to protect your data in transit. We also take technical and organisational measures to protect your data against loss, misuse and unauthorised access.