{"id":17785,"date":"2024-10-18T13:25:30","date_gmt":"2024-10-18T11:25:30","guid":{"rendered":"https:\/\/vasro.de\/?page_id=17785"},"modified":"2026-10-14T13:59:48","modified_gmt":"2026-10-14T11:59:48","slug":"privacy-policy","status":"publish","type":"page","link":"https:\/\/vasro.de\/en\/privacy-policy\/","title":{"rendered":"Privacy Policy"},"content":{"rendered":"<h2>In short<\/h2>\n<ul>\n<li>We use no analytics, tracking or advertising tools.<\/li>\n<li>Fonts load from our own server. There is no connection to Google Fonts or Adobe Fonts.<\/li>\n<li>Videos, share price charts and AI services load only when you click them. Before that, these providers receive no data.<\/li>\n<\/ul>\n<h2>Controller<\/h2>\n<p>VASRO GmbH, Am Hauptbahnhof 16, 60329 Frankfurt am Main, Germany, represented by its managing director Dr. M-Javad Vaseghi. Phone +49 (0)69 90 28 39 81, email <a href=\"mailto:info@vasro.de\">info@vasro.de<\/a>. You can reach us at this address for any question about data protection.<\/p>\n<h2>Hosting and server log files<\/h2>\n<p>Our website and our reports (PDF) are hosted by Raidboxes GmbH, Hafenstra\u00dfe 32, 48153 M\u00fcnster, Germany, on servers in Germany. Raidboxes acts as our processor under Art. 28 GDPR.<\/p>\n<p>With every request, the server automatically records: IP address, date and time, the page or file requested, the page you came from (referrer), browser and operating system. We need these data to deliver the website, find errors and fend off attacks (Art. 6(1)(f) GDPR). Raidboxes deletes the log files automatically after a short period.<\/p>\n<p>A server cache (Varnish) keeps copies of our pages so they load faster. It stores pages, not data about you. The connection is encrypted (https).<\/p>\n<p>The name lookup (DNS) for vasro.de is handled by Cloudflare, Inc., San Francisco, USA. Cloudflare only answers at which address our server can be reached; your visits do not pass through Cloudflare (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework.<\/p>\n<h2>Security<\/h2>\n<p>The security plugin All-In-One Security runs on our own server. It checks requests for attack patterns and blocks addresses that attack the website. For failed sign-in attempts to the staff login, it records the IP address, the time and the user name entered. The purpose is to protect the website (Art. 6(1)(f) GDPR). The plugin&#8217;s maker receives no data. We delete these entries once they are no longer needed for protection.<\/p>\n<h2>Cookies and your consent<\/h2>\n<p>Without your consent, we set only cookies the website needs to work (Section 25(2) No. 2 TDDDG, Art. 6(1)(f) GDPR):<\/p>\n<ul>\n<li>Real Cookie Banner stores your choice in the cookie banner (cookies and local storage &#8220;real_cookie_banner\u2026&#8221;, six months).<\/li>\n<li>The translation plugin WPML remembers your language (cookie &#8220;wp-wpml_current_language&#8221;, one day).<\/li>\n<li>For signed-in staff only: the WordPress sign-in cookies.<\/li>\n<\/ul>\n<p>Real Cookie Banner is a plugin by devowl.io GmbH, Grafling, Germany, and runs on our own server; its maker receives no data. As proof, it records on our server when and how you decided, with a random ID and your IP address in a shortened, irreversible (hashed) form. The legal basis is our duty to be able to prove consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR). We keep these records for up to three years.<\/p>\n<p>You can change or withdraw your choice at any time under &#8220;Cookie settings&#8221; at the bottom of every page.<\/p>\n<h2>Videos from YouTube<\/h2>\n<p>On the company pages we show videos from YouTube in its privacy-enhanced mode (youtube-nocookie.com). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Before you click, the page loads nothing from YouTube, not even a preview image.<\/p>\n<p>Only when you press Play does the player load. Google then receives your IP address, technical data about your browser and the address of our website (without the exact page), and may store or read data on your device. Data may go to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework.<\/p>\n<p>The legal basis is your consent by the click (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). It covers only this video and this page view. You can withdraw it by closing or reloading the page; after that, nothing loads from YouTube until you click again. More from Google: <a href=\"https:\/\/policies.google.com\/privacy\" target=\"_blank\" rel=\"noopener\">policies.google.com\/privacy<\/a>.<\/p>\n<h2>Share price charts from TradingView and Stockdio<\/h2>\n<p>On some company pages you can show the share price as a chart. Depending on the company, the chart comes from TradingView Inc., New York, USA, or from Stockdio, USA. Before you click &#8220;Show the share price&#8221;, the page loads nothing from these providers.<\/p>\n<p>With the click, the chart loads from that provider. It receives your IP address, technical data about your browser and the address of our website (without the exact page), and may store or read data on your device.<\/p>\n<p>Both providers process data in the USA and are not certified under the EU-US Data Privacy Framework. For this transfer there is therefore neither an adequacy decision nor appropriate safeguards: US authorities could access the data, and your rights may be harder to enforce there. The legal basis is your explicit consent by the click (Art. 6(1)(a) and Art. 49(1)(a) GDPR, Section 25(1) TDDDG). It covers only this page view; you can withdraw it by closing or reloading the page.<\/p>\n<p>More from the providers: <a href=\"https:\/\/www.tradingview.com\/privacy-policy\/\" target=\"_blank\" rel=\"noopener\">TradingView<\/a>, <a href=\"https:\/\/stockdio.com\/privacy-policy.html\" target=\"_blank\" rel=\"noopener\">Stockdio<\/a>.<\/p>\n<h2>&#8220;Ask this report&#8221;: links to AI services<\/h2>\n<p>Under each report you can ask it questions with an AI of your choice. The links open ChatGPT (OpenAI), Claude (Anthropic), Google Search in AI Mode (Google), Perplexity or Grok (xAI) in a new tab, with a question already written. It holds only the company name, the report date and the link to the PDF, no data about you. &#8220;Copy the eight questions&#8221; only places the questions on your clipboard.<\/p>\n<p>Before you click, these providers receive nothing. With the click you visit their website; as with any website visit, the provider learns your IP address and that you came from vasro.de. From there, its own terms and privacy policy apply, and it is responsible for the processing.<\/p>\n<p>The short links on our reports (vasro.de\/ask\/\u2026) read your browser&#8217;s language setting to open the right language version. Nothing else is stored in the process.<\/p>\n<h2>LinkedIn and other links<\/h2>\n<p>We point to LinkedIn and other websites with plain links. Nothing loads from them before you click. After the click, that provider&#8217;s terms apply. Our website passes on only its own address, not the exact page.<\/p>\n<h2>Email and phone<\/h2>\n<p>When you write to us or call us, we process what you give us (name, contact details, content of the message) to deal with your request. The legal basis is Art. 6(1)(b) GDPR where it concerns a contract or steps towards one, otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).<\/p>\n<p>Our mailboxes (info@vasro.de and our staff mailboxes) are hosted by Microsoft 365. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, acting as our processor. Access from the USA cannot be ruled out; Microsoft Corporation is certified under the EU-US Data Privacy Framework.<\/p>\n<p>We delete your messages once your request is settled, unless commercial or tax law requires us to keep them (for business letters, usually six years).<\/p>\n<h2>Emails sent by the website<\/h2>\n<p>Emails the website itself sends (for example system messages to us or messages from a form) go through the Post SMTP plugin and the delivery service SMTP2GO (Sand Dune Mail Ltd, Christchurch, New Zealand), acting as our processor. An adequacy decision of the European Commission covers New Zealand. The legal basis is our legitimate interest in reliable delivery (Art. 6(1)(f) GDPR).<\/p>\n<h2>Forms and spam protection<\/h2>\n<p>If a page has a form, we receive what you enter by email and use it only for your request. On such pages, and only there, Cloudflare Turnstile (Cloudflare, Inc., San Francisco, USA) checks whether a person is using the form. To do so, Turnstile evaluates your IP address and technical features of your browser. The legal basis is our legitimate interest in protection against spam and abuse (Art. 6(1)(f) GDPR, Section 25(2) No. 2 TDDDG). Cloudflare is certified under the EU-US Data Privacy Framework. Pages without a form do not load Turnstile.<\/p>\n<h2>New research by email<\/h2>\n<p>To receive new research by email, write to <a href=\"mailto:info@vasro.de\">info@vasro.de<\/a>; the link on our website prepares this message. With your message you consent to our sending you new research reports (title and link) by email (Art. 6(1)(a) GDPR). We send them from our Microsoft 365 mailboxes.<\/p>\n<p>We use your address for nothing else: we never sell it, never share it with the companies VASRO covers, and never use it in any work for them.<\/p>\n<p>You can withdraw at any time, with effect for the future: by email to info@vasro.de or by replying to one of our emails. We then remove your address from the list. We keep your request and your withdrawal as proof for up to three years after the withdrawal (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).<\/p>\n<h2>Applications<\/h2>\n<p>If you apply to us by email, we process your documents to decide on the position (Art. 6(1)(b) GDPR). Only the people who decide on the application see them. If you are not hired, we delete your documents six months after the process ends; we need them until then to defend ourselves against possible claims (Art. 6(1)(f) GDPR). We keep them longer only with your consent.<\/p>\n<h2>Transfers outside the EU<\/h2>\n<ul>\n<li>Google (YouTube), Microsoft and Cloudflare: USA, based on the EU-US Data Privacy Framework (adequacy decision of the European Commission).<\/li>\n<li>SMTP2GO: New Zealand, based on an adequacy decision of the European Commission.<\/li>\n<li>TradingView and Stockdio: USA, only with your explicit consent by click (Art. 49(1)(a) GDPR).<\/li>\n<\/ul>\n<h2>Your rights<\/h2>\n<p>You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent at any time with effect for the future (Art. 7(3)). An email to <a href=\"mailto:info@vasro.de\">info@vasro.de<\/a> is enough.<\/p>\n<h2>Your right to object<\/h2>\n<p>Where we process data based on our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). We then stop processing the data, unless we demonstrate compelling legitimate grounds, or we need the data to establish, exercise or defend legal claims.<\/p>\n<p>You can object at any time, without giving reasons, to the use of your data for direct marketing (Art. 21(2) GDPR).<\/p>\n<h2>Complaints<\/h2>\n<p>You can lodge a complaint with any data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte f\u00fcr Datenschutz und Informationsfreiheit), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany, <a href=\"https:\/\/datenschutz.hessen.de\" target=\"_blank\" rel=\"noopener\">datenschutz.hessen.de<\/a>.<\/p>\n<h2>Other points<\/h2>\n<p>You are not obliged to give us any data. Without your email address, however, we cannot reply to you or send you research. We make no automated decisions and create no profiles.<\/p>\n<p>Last updated: October 2026<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In short We use no analytics, tracking or advertising tools. Fonts load from our own server. There is no connection to Google Fonts or Adobe Fonts. Videos, share price charts and AI services load only when you click them. Before that, these providers receive no data. Controller VASRO GmbH, Am Hauptbahnhof 16, 60329 Frankfurt am [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-17785","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/vasro.de\/en\/wp-json\/wp\/v2\/pages\/17785","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vasro.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/vasro.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/vasro.de\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/vasro.de\/en\/wp-json\/wp\/v2\/comments?post=17785"}],"version-history":[{"count":3,"href":"https:\/\/vasro.de\/en\/wp-json\/wp\/v2\/pages\/17785\/revisions"}],"predecessor-version":[{"id":25387,"href":"https:\/\/vasro.de\/en\/wp-json\/wp\/v2\/pages\/17785\/revisions\/25387"}],"wp:attachment":[{"href":"https:\/\/vasro.de\/en\/wp-json\/wp\/v2\/media?parent=17785"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}