Privacy Policy

1. Who is responsible

The controller responsible for processing personal data on this website is:

VaySunic New Energy GmbH, Güglingstraße 66, 73529 Schwäbisch Gmünd, Germany (“VaySunic”, “we”, “us”).

For any question about data protection, or to exercise your rights, please email info@vaysunic.com with the subject “Data protection”, or write to us at the address above.

2. What this policy covers

This policy applies only to the website www.vaysunic.com (the “website”) and to enquiries you send us through it or by email or phone as a result of visiting it.

It does not apply to:

• our apps and cloud services, such as VIP Cloud and VIP Professional, and the data our products exchange with them — these have their own privacy information;
• distributors, installers and other partners who sell, install or service our products — they decide for themselves how they use your data and are responsible for it;
• other websites, platforms and services that this website links to (see section 10).

3. Summary

We collect as little personal data as possible. This website does not use analytics, advertising or tracking cookies, and does not build user profiles. That is why there is no cookie banner. We process personal data only to deliver the website securely, to answer enquiries and — if you ask us to — to send you product news. We do not sell personal data.

The website, including its database and servers, is hosted within the European Union.

4. Visiting the website

4.1 Hosting

The website is run on servers of a hosting provider located in the European Union. The provider processes data only on our behalf and on our instructions, under a data processing agreement in line with Art. 28 GDPR. The hosting set-up itself does not transfer website data outside the EU/EEA.

Product information, images and documents are loaded by our server from our own content management system, which is also hosted in the EU. This does not involve any information about you.

4.2 Server log files

When you open a page, our web server automatically records the technical information your browser sends: IP address, date and time, the page or file requested, the referring page, the amount of data transferred, status code, browser type and operating system. We need this to deliver the website, to keep it stable and secure, and to detect and defend against attacks. We do not combine this information with other data to identify you.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in a secure and working website. Log files are deleted after no more than 14 days. Where an entry is needed to investigate a specific security incident, we keep it until the incident has been dealt with.

4.3 Protection against misuse

To prevent spam and abuse, our server counts requests per IP address over a short period — for example, the number of enquiries sent within ten minutes. These counters are held in the server’s memory only and are discarded automatically after ten minutes. The enquiry form also contains a hidden field that only automated programs fill in. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in protecting the website and our staff from spam and attacks.

5. Enquiries by form, email or phone

5.1 What we process

When you send an enquiry through the form, we process: the type of enquiry, company name (optional for home projects), your name, email address, phone or WhatsApp number (optional), country or region and your message. The form also sends us the product you asked about (if any), the page you sent it from, the language of the site and whether you ticked the box for product news. When you email or phone us, we process the information you give us in the same way.

Fields marked as required are needed to answer you; without them we cannot handle the enquiry. Everything else is voluntary. You are not obliged by law or contract to provide any data.

5.2 Purpose and legal basis

We use your data to answer your enquiry and to prepare and carry out any offer, order or cooperation that follows.

• Where your enquiry relates to a contract with us, or to steps before one: Art. 6(1)(b) GDPR.
• Otherwise: Art. 6(1)(f) GDPR — our legitimate interest in answering enquiries and developing business relationships.

Our website and enquiry form are aimed mainly at business customers such as distributors, installers and project partners. If you contact us as a private individual — for example about a home project — the same rules and the same rights apply.

5.3 Please keep it to what we need

Please do not include in your message any sensitive information, such as health data, or any information we do not need to answer you. If you give us personal data about other people — for example a colleague’s contact details — please do so only if you are entitled to share it and have told them about this policy.

5.4 Who receives your enquiry

Your enquiry is sent by email to our sales team. Where needed to answer you, it is passed on to the VaySunic team responsible for your region or for the product concerned — in Germany, France, China, Thailand or Brazil. Our email provider processes the message on our behalf under Art. 28 GDPR. Transfers outside the EU are explained in section 12.

5.5 How long we keep it

We keep enquiry data for as long as we need it to deal with your enquiry and any follow-up. Where an enquiry becomes part of our business correspondence, we keep it for the periods required by commercial and tax law (see section 13).

6. Spam protection (Cloudflare Turnstile)

Where it is enabled, our enquiry form is protected by Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. When the form is shown, Turnstile processes technical information about your browser and device, and your IP address, to tell people and automated programs apart.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in protecting the form from abuse. Reading information from your device for this purpose is strictly necessary to provide the form you are using securely (Section 25(2) No. 2 TDDDG). Cloudflare, Inc. is certified under the EU–US Data Privacy Framework. More information: cloudflare.com/privacypolicy.

7. Product news

If you tick the box “Send me occasional product news”, we will use your email address to send you information about our products and company. We do this only with your consent (Art. 6(1)(a) GDPR). Before we send the first email, we may ask you to confirm your address.

You can withdraw your consent at any time, without giving reasons — by using the unsubscribe link in any of these emails or by writing to info@vaysunic.com. Withdrawal does not affect the lawfulness of processing before it.

We keep a record of your consent (date, time and the form used) so that we can prove it, as the law requires (Art. 7(1) GDPR). After you unsubscribe, we may keep your email address on a block list for the sole purpose of making sure we do not contact you again (Art. 6(1)(f) GDPR).

8. Cookies and local storage

We do not use analytics, marketing or tracking cookies. The website uses only the following, and only when you use the feature concerned:

• vs_lang — a cookie set by us that remembers the language you chose in the menu. Stored for 12 months.
• vs3d_brand and vs3d_brand_sc — local storage in your browser that keeps the logo, colours and settings you choose in our 3D configurators. This information stays on your device and is never sent to us. Stored until you delete it.

They are strictly necessary to provide features you have expressly requested (Section 25(2) No. 2 TDDDG), so no consent is needed. You can delete them at any time in your browser settings; the features concerned will then reset.

9. Embedded videos (YouTube)

Some pages show videos from our YouTube channel. The preview image is delivered from our own server, and no connection to YouTube is made until you press play. Only then is the video loaded from YouTube in privacy-enhanced mode (youtube-nocookie.com), a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google then receives information such as your IP address and the page you are on, and may store information on your device. Google is responsible for that processing. Data may be transferred to Google LLC in the USA, which is certified under the EU–US Data Privacy Framework.

Legal basis: your consent, given by pressing play (Art. 6(1)(a) GDPR and Section 25(1) TDDDG). If you do not want this, do not start the video; you can find our videos on YouTube directly instead. More information: policies.google.com/privacy.

10. Links, messaging apps and social media

Our contact pages show QR codes and links for WhatsApp, LINE and LinkedIn, and the footer links to our social media pages. These are plain links and images: no data is sent to these platforms just because you visit our pages.

Once you follow a link to another website or platform, that provider’s own privacy policy and terms apply. We have no control over and, to the extent permitted by law, are not responsible for the content or data processing of third-party websites. If you contact us through one of these platforms, we handle the information we receive as an enquiry under section 5.

11. Who we share data with

We share personal data only as described in this policy and only as far as necessary:

• service providers who process data on our behalf, such as hosting and email, each bound by a data processing agreement under Art. 28 GDPR;
• the VaySunic team responsible for your region or product (section 5.4);
• the providers named in sections 6 and 9, when you use the feature concerned;
• our professional advisers, such as lawyers, tax advisers and auditors, who are bound to confidentiality, where needed to protect our rights or meet our obligations;
• courts, public authorities and law enforcement, where we are legally required to do so (Art. 6(1)(c) GDPR) or where needed to establish, exercise or defend legal claims (Art. 6(1)(f) GDPR);
• a buyer or successor, if all or part of our business is reorganised, merged or sold — only as far as data protection law allows.

12. Transfers outside the EU/EEA

Hosting and storage of website data take place within the EU. Personal data leaves the EU/EEA only in the following cases:

• Enquiries: where needed to answer your enquiry, we pass it to our own teams in China, Thailand or Brazil. We do this on the basis of the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), together with additional safeguards where needed.
• Cloudflare (section 6) and Google/YouTube (section 9): these transfers are based on the EU–US Data Privacy Framework (Art. 45 GDPR).

You can ask us for a copy of the safeguards we use by writing to info@vaysunic.com.

13. How long we keep data

We delete personal data as soon as we no longer need it for the purpose for which we collected it, unless the law requires us to keep it longer. In particular:

• Server log files: no more than 14 days, except entries needed to investigate a specific security incident.
• Rate-limit counters: about ten minutes, in memory only.
• Enquiries: as long as needed to deal with your enquiry and any follow-up. Business letters and documents relevant to tax are kept for the statutory periods — six years for commercial correspondence, eight years for accounting vouchers and ten years for books of account and annual financial statements (Section 257 HGB, Section 147 AO; Art. 6(1)(c) GDPR).
• Product news: until you withdraw your consent; the record of your consent for as long as we may need to prove it.
• Cookies and local storage: as stated in section 8.

Where we must keep data for legal reasons, we restrict its use to that purpose. We may also keep data for as long as it is needed to establish, exercise or defend legal claims (Art. 17(3)(e) GDPR), usually until the relevant limitation period has ended.

14. Security

We use appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access, taking into account the state of the art and the risks involved. These include encrypted connections (TLS/HTTPS), access controls, rate limiting and the regular deletion of logs.

Please note that no transmission of data over the internet can be made completely secure. We therefore recommend that you do not send highly confidential information through the enquiry form or by unencrypted email.

15. Your rights

Under the GDPR you have the right to:

• access your personal data (Art. 15 GDPR);
• have inaccurate data corrected (Art. 16 GDPR);
• have your data erased (Art. 17 GDPR);
• restrict processing (Art. 18 GDPR);
• receive your data in a portable format (Art. 20 GDPR);
• object to processing (Art. 21 GDPR — see section 16);
• withdraw any consent at any time, with effect for the future (Art. 7(3) GDPR).

To exercise your rights, write to info@vaysunic.com or to our postal address. We reply without undue delay and in any event within one month. Where a request is complex or we receive many requests, this period may be extended by up to two further months; we will tell you if so (Art. 12(3) GDPR). Using your rights is free of charge.

If you are in Brazil, you also have the rights of data subjects under the General Data Protection Law (LGPD, Law No. 13,709/2018, Art. 18), and you may complain to the National Data Protection Authority (ANPD). If you are in Thailand, you also have the rights under the Personal Data Protection Act B.E. 2562 (PDPA), and you may complain to the Personal Data Protection Committee (PDPC). You can exercise these rights in the same way.

To protect your data, we may ask for information needed to confirm your identity before we act on a request (Art. 12(6) GDPR). Where a request is manifestly unfounded or excessive, in particular because it is repetitive, we may charge a reasonable fee or refuse it; we will explain why (Art. 12(5) GDPR).

Some rights are limited by law. For example, we cannot erase data that we are legally required to keep; in that case we restrict its processing instead.

16. Right to object

Right to object (Art. 21 GDPR): where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then stop processing your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

Direct marketing: where we use your data for direct marketing, you may object at any time without giving reasons, and we will stop using it for this purpose.

To object, an informal message to info@vaysunic.com is enough.

17. Right to complain

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work or where you believe an infringement took place. The authority responsible for us is: The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI Baden-Württemberg), Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

We would appreciate the chance to deal with your concern first, so please feel free to contact us beforehand. This does not limit your right to complain.

18. Children

This website is aimed at business customers and adults. It is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has sent us personal data, please let us know and we will delete it.

19. Automated decisions

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

20. Changes to this policy

We may update this policy when our website, our services or the law change. The current version applies from the time it is published on this page, and the date of the last update is shown at the top. We will point out material changes on this page. Where a change requires your consent, we will ask for it.

21. Language versions

This policy may also be provided in other languages. If there is any difference between the versions, the English version prevails, unless mandatory law requires otherwise.