Privacy policy

How GeleeVital processes personal data on this website and in its business operations.

This English version is provided for convenience only. Only the German version is legally binding.

1. Privacy at a glance

General information

The following notes give a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally. Detailed information on data protection can be found in the privacy policy below.

Data collection on this website

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. You can find the operator's contact details in the section “Responsible party” in this privacy policy.

How do we collect your data?

Some of your data is collected when you provide it to us, for example data you enter into a contact form.

Other data is collected automatically or with your consent by our IT systems when you visit the website. This is mainly technical data (e.g. browser, operating system or time of the page request). This data is collected automatically as soon as you enter this website.

What do we use your data for?

Part of the data is collected to ensure the website is provided without errors. We only count visits with your consent and without third-party providers (see “Visitor counting with consent”).

What rights do you have regarding your data?

You have the right at any time to receive information free of charge about the origin, recipient and purpose of your stored personal data. You also have the right to request that this data be corrected or deleted. If you have given consent to data processing, you can revoke this consent at any time with effect for the future. Under certain circumstances you also have the right to request that the processing of your personal data be restricted. You also have the right to lodge a complaint with the competent supervisory authority.

You can contact us at any time about this or any other data protection questions.

Analysis tools and third-party tools

This website does not run any third-party analysis or advertising programs. We count visits solely with our own counter and only with your consent. The services we use for our internal processes are listed in the privacy policy below.

2. Hosting

We host the content of our website with the following provider:

Strato

The provider is Strato AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany (“Strato”). When you visit our website, Strato records various log files including your IP address.

Further information can be found in Strato's privacy policy: https://www.strato.de/datenschutz/.

Strato is used on the basis of Art. 6 (1) (f) GDPR. We have a legitimate interest in presenting our website as reliably as possible. Where consent has been requested, processing is carried out exclusively on the basis of Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user's device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent can be revoked at any time.

We have concluded a data processing agreement (DPA) for the use of this service. This contract, required by data protection law, ensures that the personal data of our website visitors is processed only in accordance with our instructions and in compliance with the GDPR.

3. General information and mandatory disclosures

Data protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

When you use this website, various personal data is collected. Personal data is data that can be used to identify you personally. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this is done.

Please note that data transmission over the internet (e.g. communication by email) may be subject to security gaps. Complete protection of data against access by third parties is not possible.

Responsible party

The party responsible for data processing on this website is:

GeleeVital
Owner: Heiko Ernst
Möhnestr. 5
79238 Ehrenkirchen, Germany
Phone: +49 176 31098811
Email: privacy@geleevital.com

The responsible party is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data (e.g. names, email addresses).

Storage period

Unless a more specific storage period is stated in this privacy policy, your personal data will remain with us until the purpose of processing no longer applies. If you make a justified request for deletion or revoke your consent, your data will be deleted unless we have other legally permissible reasons for storing it (e.g. retention periods under tax or commercial law); in that case, deletion takes place once those reasons cease to apply.

Systems used and data protection

For internal processes, data processing and communication, we use IT systems and devices protected by current security mechanisms. These include in particular access restrictions (e.g. passwords or biometric methods), encryption technologies and regular security updates.

Personal data is processed only within the scope of the statutory requirements and is protected by appropriate technical and organisational measures in accordance with Art. 32 GDPR.

Access to personal data is limited to authorised persons. This ensures that your data is processed confidentially, with its integrity protected, and only for the intended purposes.

General information on the legal basis for data processing on this website

If you have consented to data processing, we process your personal data on the basis of Art. 6 (1) (a) GDPR or Art. 9 (2) (a) GDPR if special categories of data under Art. 9 (1) GDPR are processed. In the case of express consent to the transfer of personal data to third countries, processing is also based on Art. 49 (1) (a) GDPR. If you have consented to the storage of cookies or to access to information on your device (e.g. via device fingerprinting), processing is additionally based on Section 25 (1) TDDDG. Consent can be revoked at any time. If your data is required to perform a contract or to carry out pre-contractual measures, we process it on the basis of Art. 6 (1) (b) GDPR. We also process your data where required to fulfil a legal obligation on the basis of Art. 6 (1) (c) GDPR. Processing may also be based on our legitimate interest under Art. 6 (1) (f) GDPR. The relevant legal bases in each individual case are explained in the following sections of this privacy policy.

Note on data transfer to the USA and other third countries

Among other things, we use services from companies based in the USA or in other countries outside the EU. Personal data may be transferred to and processed in these countries. For the USA there is an adequacy decision by the EU Commission (EU-US Data Privacy Framework): data may be transferred to companies certified under it. For other recipients we base the transfer on the EU Commission’s standard contractual clauses. Which basis applies is stated for each service. Despite these safeguards, we cannot rule out that authorities in these countries access data under local law.

Revocation of your consent

Many data processing operations are only possible with your express consent. You can revoke consent you have already given at any time. The lawfulness of the processing carried out until revocation remains unaffected.

Right to object to data collection in special cases and to direct marketing (Art. 21 GDPR)

IF DATA PROCESSING IS BASED ON ART. 6 (1) (E) OR (F) GDPR, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE LEGAL BASIS ON WHICH PROCESSING IS BASED CAN BE FOUND IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA CONCERNED UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS (OBJECTION UNDER ART. 21 (1) GDPR).

IF YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR SUCH MARKETING; THIS ALSO APPLIES TO PROFILING INSOFAR AS IT IS RELATED TO SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL NO LONGER BE USED FOR DIRECT MARKETING PURPOSES (OBJECTION UNDER ART. 21 (2) GDPR).

Right to lodge a complaint with the competent supervisory authority

In the event of breaches of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the member state of their habitual residence, place of work or the place of the alleged breach. This right exists without prejudice to other administrative or judicial remedies.

The supervisory authority responsible for us is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Heilbronner Straße 35, 70191 Stuttgart, Germany, www.baden-wuerttemberg.datenschutz.de.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in fulfilment of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done where technically feasible.

Information, correction and deletion

Within the framework of the applicable legal provisions, you have the right at any time to free information about your stored personal data, its origin and recipients and the purpose of processing and, if applicable, a right to correction or deletion of this data. You can contact us at any time about this and other questions regarding personal data.

Right to restriction of processing

You have the right to request the restriction of the processing of your personal data. You can contact us about this at any time. The right to restriction of processing exists in the following cases:

If you dispute the accuracy of the personal data we hold about you, we usually need time to verify this. For the duration of the review, you have the right to request that processing be restricted.
If the processing of your personal data was or is unlawful, you can request the restriction of processing instead of deletion.
If we no longer need your personal data but you need it to exercise, defend or assert legal claims, you have the right to request restriction of processing instead of deletion.
If you have lodged an objection under Art. 21 (1) GDPR, your interests and ours must be weighed. As long as it has not been determined whose interests prevail, you have the right to request restriction of processing.

If you have restricted the processing of your personal data, this data, apart from being stored, may only be processed with your consent or for the establishment, exercise or defence of legal claims, or to protect the rights of another natural or legal person, or for reasons of important public interest of the European Union or a member state.

SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, such as orders or enquiries you send to us as the site operator, this site uses SSL/TLS encryption. You can recognise an encrypted connection by the browser's address bar changing from “http://” to “https://” and by the lock symbol in your browser bar.

When SSL/TLS encryption is active, the data you transmit to us cannot be read by third parties.

Objection to advertising emails

We hereby object to the use of contact data published under the legal notice obligation for sending unsolicited advertising and information material. The operators of these pages expressly reserve the right to take legal action in the event of unsolicited advertising, such as spam emails.

4. Data collection on this website

Server log files

Our host Strato automatically records information transmitted by your browser with every page request: IP address, date and time of the request, page requested, volume of data transferred, referring page (referrer), browser type and version, and operating system. This data is not merged with other data sources.

It is recorded on the basis of Art. 6 (1) (f) GDPR. We have a legitimate interest in the technically error-free delivery and the security of our website. The IP addresses in the log files are deleted or anonymised after seven days at the latest.

Automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

Cookies and browser storage

This website sets no cookies and loads no external fonts, maps or analytics services. At most two items are kept in your browser storage: your language choice (German or English), so the site opens in your preferred language next time, and your decision on visit counting, so we do not ask you again on every page. Neither item leaves your browser, contains personal data or is evaluated. You can delete them at any time in your browser settings.

Visit counting with consent

We count visits with our own counter on our own web space, but only if you choose “Yes, sure” in the notice. Your browser then sends the page viewed, clicks on buttons such as “Submit soil sample”, WhatsApp or email, submitted forms (without their content), how far down a page you got, and the domain of the referring page to our server. The device type (computer, phone, tablet) is derived there from the browser identifier.

No cookies are set. IP address and browser identifier are not stored. To group the visits of one day, we derive a short identifier using a random value that is created anew each day and deleted afterwards, so visits on different days cannot be linked. Browsers with “Do Not Track” enabled are not counted.

The counting data is evaluated exclusively by us, locally on one of our own computers using our assistant software Orena (see section “Orena”). It contains neither names nor IP addresses and is deleted after 400 days at the latest. Orena shows aggregated figures (visits per day, total, and how far pages were read) in our internal dashboard, which is provided via Cloudflare. When we ask Orena about these figures, they are passed to the AI services Gemini or Claude to produce the answer. Individual visitors cannot be identified in them. Beyond that, we do not pass the counting data on. The legal basis is your consent (Section 25(1) TDDDG and Article 6(1)(a) GDPR). You can withdraw it at any time with effect for the future via “Privacy settings” at the bottom of every page. Your choice is stored in your browser storage (entry “gv-zaehlung”) so that the notice does not appear on every visit; this is strictly necessary for that purpose (Section 25(2) No. 2 TDDDG). We use no third-party analytics, profiling or advertising trackers.

Contact form and soil sample form

If you send us enquiries via a contact form or the “Submit soil sample” form, the information you provide, including your contact details and the uploaded lab report, will be stored by us for the purpose of processing the enquiry and in case of follow-up questions. We do not pass this data on without your consent.

Providing the information in the form is voluntary. Without the fields marked as required and the lab report, however, we cannot process your soil sample.

The form data, including the uploaded lab report, is sent to us by email via our host Strato. We store the information from the form in our workspace at Notion (Notion Labs, Inc., 2300 Harrison St, San Francisco, CA 94110, USA) so that we can evaluate your soil sample and keep track of its status. Data processing agreements under Art. 28 GDPR are in place with both providers. With Notion, data is processed in the USA; this is based on the EU Commission’s standard contractual clauses and certification under the EU-US Data Privacy Framework.

This data is processed on the basis of Art. 6 (1) (b) GDPR if your enquiry is related to the performance of a contract or is necessary to carry out pre-contractual measures. In all other cases, processing is based on our legitimate interest in handling enquiries effectively (Art. 6 (1) (f) GDPR) or on your consent (Art. 6 (1) (a) GDPR) if this has been requested; consent can be revoked at any time.

The data you enter in the contact form will remain with us until you ask us to delete it, revoke your consent to storage, or the purpose for storing the data no longer applies (e.g. after your enquiry has been processed). Mandatory statutory provisions, in particular retention periods, remain unaffected.

Processing of customer data in Lexware Office

To handle quotations, orders, delivery notes and invoices, we use the business software Lexware Office from Haufe-Lexware GmbH & Co. KG, Freiburg, Germany.

Processing takes place exclusively for the proper execution of pre-contractual and contractual measures in accordance with Art. 6 (1) (b) GDPR.

All customer data is stored in the Lexware environment and not passed on to third parties. A data processing agreement in accordance with Art. 28 GDPR has been concluded with the provider to ensure processing in compliance with data protection law.

Data is not transferred to third countries.

Enquiries by email or phone

If you contact us by email or phone, your enquiry, including all resulting personal data (name, enquiry), will be stored and processed by us for the purpose of handling your request. We do not pass this data on without your consent.

The data you send us via contact requests will remain with us until you ask us to delete it, revoke your consent to storage, or the purpose for storing the data no longer applies (e.g. after your request has been processed). Mandatory statutory provisions, in particular statutory retention periods, remain unaffected.

Recording of consultations

Consultations may be recorded with your express consent. The purpose of such recordings is quality assurance, traceability of the advice given and internal documentation. Consent is voluntary and is obtained by email as part of the appointment confirmation. No recording takes place without your consent.

The legal basis for processing is Art. 6 (1) (a) GDPR (consent). You have the right to revoke your consent at any time with effect for the future. In that case, recordings already stored will be deleted unless there is a statutory retention obligation.

Further details can be found in the separate privacy notice on call recording, which is sent to you with the appointment confirmation.

Communication via WhatsApp

For communication with our customers and other third parties, we use, among other things, the instant messaging service WhatsApp. The provider is WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

Communication uses end-to-end encryption (peer-to-peer), which prevents WhatsApp or other third parties from accessing the content. However, WhatsApp does gain access to metadata created during communication (e.g. sender, recipient and time). We also point out that, according to its own statement, WhatsApp shares personal data of its users with its US-based parent company Meta. Further details can be found in WhatsApp's privacy policy: https://www.whatsapp.com/legal/#privacy-policy.

WhatsApp is used on the basis of our legitimate interest in communicating as quickly and effectively as possible with customers, prospects and other business and contractual partners (Art. 6 (1) (f) GDPR). Where consent has been requested, processing is based exclusively on that consent, which can be revoked at any time with effect for the future.

The content exchanged between you and us on WhatsApp remains with us until you ask us to delete it, revoke your consent to storage, or the purpose for storing the data no longer applies (e.g. after your enquiry has been processed). Mandatory statutory provisions, in particular retention periods, remain unaffected.

We use WhatsApp in the “WhatsApp Business” version.

Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details: https://www.whatsapp.com/legal/business-data-transfer-addendum.

On this website, WhatsApp is included only as a link. A connection to WhatsApp is only established when you click the WhatsApp button.

5. Analysis tools and third-party tools

Metricool

We use Metricool, a service of Metricool Software SL, Spain, to analyse, plan and manage our social media activities.

Data such as interactions, reach, profile information and, where applicable, personal data from social media contacts may be processed.

Use is based on Art. 6 (1) (f) GDPR (legitimate interest in analysing and optimising our online presence and marketing).

Processing of data outside the European Union cannot be ruled out. Metricool uses appropriate safeguards in accordance with Art. 44 et seq. GDPR.

Where necessary, a data processing agreement has been concluded with the provider.

6. Automation

Make.com

To automate internal business processes, we use Make.com (Make s.r.o., Prague, Czech Republic).

Make.com allows us to connect different systems and process data automatically (e.g. transferring customer data between applications, creating documents or synchronising appointments).

Personal data may be processed, in particular:

Name
Contact details (email address, phone number)
Content from forms or communication
Other data required for the respective process

Processing is based on Art. 6 (1) (b) GDPR (performance of contract) and Art. 6 (1) (f) GDPR (legitimate interest in efficient, automated business operations).

Make.com may process data on servers inside and outside the European Union. For transfers to third countries, appropriate safeguards in accordance with Art. 44 et seq. GDPR (e.g. standard contractual clauses) are used.

7. AI

Orena (AI assistant)

For internal processes we use the AI assistant software Orena. It is provided by Ernst Systems (Isabel Ernst) and runs locally on a GeleeVital computer. Orena supports us with organisation, drafting texts and evaluations, including the evaluation of this website’s visit counter.

Personal data contained in our records may be processed in the course of this, for example contact details and the content of enquiries. For language processing, Orena uses the AI services Claude (Anthropic) and Gemini (Google); the content to be processed is transmitted to these providers (see the following sections). Both services are accessed via their programming interfaces (API). Orena only carries out outward actions, such as sending messages, after our express approval.

We access key figures and overviews from Orena via an internal dashboard provided via Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). Transfer of data to the USA cannot be ruled out; it is based on certification under the EU-US Data Privacy Framework and the EU Commission’s standard contractual clauses.

Processing is based on Art. 6 (1) (f) GDPR (legitimate interest in efficient workflows) and, where necessary, Art. 6 (1) (b) GDPR (performance of contract).

Google Gemini

We use the AI system Gemini from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to support internal processes, in particular for analysing data and creating texts.

Personal data may be processed where required for the respective purpose. We take care to process only data that is required for the respective purpose.

Use is based on Art. 6 (1) (f) GDPR (legitimate interest in efficient, modern work processes) and, where necessary, Art. 6 (1) (b) GDPR (performance of contract).

Transfer of data to the USA cannot be ruled out; it is based on certification under the EU-US Data Privacy Framework and the EU Commission’s standard contractual clauses.

Claude (Anthropic)

Our assistant software Orena accesses the AI system Claude via an application programming interface (API). Claude is provided by Anthropic PBC, San Francisco, USA, and supports internal processes, in particular evaluating data and drafting texts.

Personal data may be processed where required for the respective purpose. We take care to process only data that is required for the respective purpose.

Use is based on Art. 6 (1) (f) GDPR (legitimate interest in efficient, modern work processes) and, where necessary, Art. 6 (1) (b) GDPR (performance of contract).

The interface is governed by Anthropic’s terms for commercial customers, including a data processing agreement under Art. 28 GDPR. Under these terms Anthropic does not use content submitted via the interface to train its models.

Transfer of data to the USA cannot be ruled out; it is based on the standard contractual clauses of the EU Commission.

In addition, we use a personal Claude account for general work such as texts and planning. We do not enter customer data there.

8. Technology of this website

Fonts

This website does not load fonts from external servers (e.g. Google Fonts). Text is displayed using the system fonts installed on your device. No connection to third parties is established for this.

Local storage of your language choice

When you switch between German and English, your browser stores this choice in local storage. This information does not leave your device and is not transmitted to us. Storage is necessary for the service you have expressly requested (Section 25 (2) no. 2 TDDDG). You can delete the entry at any time in your browser settings.

As long as you have not chosen a language, the display follows the time zone set on your device: with a time zone from Germany, Austria, Switzerland or Liechtenstein the site appears in German, otherwise in English. The time zone is only read in your browser; it is not stored and not transmitted to us or third parties. Your location is not determined.

Instagram and WhatsApp

Instagram and WhatsApp are included on this website only as plain links. No content from these services is loaded automatically.

9. Cloud & infrastructure

Notion

We use Notion, a service of Notion Labs Inc., USA, for internal organisation, documentation and management of business processes, and for storing customer and project data.

Personal data such as contact details, notes, project information and communication content may be processed.

Processing is based on Art. 6 (1) (b) GDPR and Art. 6 (1) (f) GDPR.

Transfer of data to the USA cannot be ruled out. Notion uses appropriate safeguards in accordance with Art. 44 et seq. GDPR. A data processing agreement has been concluded with the provider.

Google Drive

All customer data, project documents and communication documents are stored by GeleeVital in Google Drive. Storage takes place exclusively within GeleeVital's Google account, which is protected by individual access rights and security mechanisms.

Access to the data is restricted to authorised persons. Google Drive meets the requirements of the GDPR and offers protective measures under Art. 32 GDPR, including encryption in transit and at rest, password protection and regular security audits by Google.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Processing is based on Art. 6 (1) (b) GDPR (contract and pre-contractual measures) and Art. 6 (1) (f) GDPR (legitimate interest in secure and orderly storage).

A transfer of data to the USA cannot be ruled out; it is based on Google's certification under the EU-US Data Privacy Framework.

Google Calendar

To organise appointments and plan our business processes, we use Google Calendar, a service of Google Ireland Limited, Dublin, Ireland.

The following personal data may be processed:

Name
Contact details
Appointment-related information (e.g. meeting content)

Processing is based on Art. 6 (1) (b) GDPR (pre-contractual measures and performance of contract) and Art. 6 (1) (f) GDPR (efficient scheduling and resource planning).

Transfer of data to third countries, in particular the USA, cannot be ruled out. Google provides appropriate safeguards in accordance with Art. 44 et seq. GDPR.

Apple Mail

We use the email application Apple Mail to communicate with customers and business partners.

Apple Mail serves only as an email client for processing and displaying emails. The actual storage, processing and archiving of emails is handled by our email provider Strato AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany.

Personal data such as name, email address and the content of communications are processed.

Processing is based on Art. 6 (1) (b) GDPR (contract or pre-contractual communication) and Art. 6 (1) (f) GDPR (legitimate interest in efficient and reliable communication).

Apple Mail itself does not process any data independently outside the device. Any synchronisation takes place exclusively via the infrastructure of the email provider (here: Strato). Further information on data processing by Strato: https://www.strato.de/datenschutz/

We maintain a publicly accessible profile on Instagram and a Google Business Profile. We are also listed in business directories (Bing Places, Cylex). When you visit these profiles or contact us there, the platform operators process your data under their own responsibility, including for their own purposes such as advertising and market research. We have no influence on this. For WhatsApp, see the section “Communication via WhatsApp”.

We ourselves process the data you share with us there (e.g. comments, messages or reviews) in order to answer your enquiry and to provide information about our company. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in public presentation and communication) and, for enquiries relating to a contract, Art. 6 (1) (b) GDPR.

Instagram

The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Where we receive aggregated statistics on our profile from Meta, we are jointly responsible for these together with Meta (Art. 26 GDPR). You can assert your rights against Meta and against us. Transfer of data to the USA cannot be ruled out; it is based on the EU-US Data Privacy Framework and the EU Commission’s standard contractual clauses. Privacy policy: https://privacycenter.instagram.com/policy.

Google Business Profile

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Reviews and questions you post there are publicly visible. Transfer of data to the USA cannot be ruled out; it is based on the EU-US Data Privacy Framework and the EU Commission’s standard contractual clauses. Privacy policy: https://policies.google.com/privacy.

Last updated: 13 October 2026