Privacy Policy

Who is responsible for your data

The data controller for this website is Vexoris Development, based in Bad Oeynhausen, Germany. Full legal identification of the responsible person is provided in our Impressum.

For privacy-related requests, contact privacy@vexorisdev.com. For general legal enquiries, contact legal@vexorisdev.com.

What data we collect

Depending on how you use our site and services, we may process the following categories of personal data:

• Identity and contact data — name, email address, company name, and messages you send through contact, partner, careers, or branding forms.
• Account data — if you register for a client or staff portal account: username, name, date of birth, email, password (stored only as a secure hash), account type, and role assignments.
• Usage and security data — session identifiers, login timestamps, user-agent strings, and hashed IP addresses used for abuse prevention and rate limiting.
• Brand asset request data — name, email, company, intended use, and a SHA-256 hashed IP address (not the raw IP) submitted with branding access requests.
• Support and project data — ticket subjects, messages, attachments, and files uploaded through client or staff portals where applicable.
• Cookie and preference data — necessary session cookies and your optional analytics/marketing consent choices.

Why we collect it (legal basis under GDPR)

We process personal data only where a legal basis applies under the GDPR:

• Contract — to provide services you request, manage client accounts, deliver projects, and operate the client portal.
• Legitimate interests — to secure our systems, prevent abuse, improve our services, and respond to enquiries, balanced against your rights.
• Consent — for optional cookies (analytics and marketing) and where you explicitly opt in, e.g. marketing communications if offered.
• Legal obligation — where we must retain or disclose data to comply with applicable law.

How it's stored and for how long

Personal data is stored in an encrypted, distributed database service. Files you upload are stored using object storage infrastructure with access controls. Transactional and support email is sent via a third-party email delivery service under a data processing agreement.

We retain data only as long as necessary for the purpose collected: active account data for the life of the account plus a reasonable period after closure; form submissions and support tickets for the duration of the business relationship and applicable limitation periods; security and rate-limit logs typically for up to 24 hours unless needed for incident investigation.

When data is no longer required, we delete or anonymise it where feasible.

Your rights

Under the GDPR, you have the right to access, rectify, erase, restrict processing, data portability, and to object to certain processing. Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

You also have the right to lodge a complaint with a supervisory authority. In Germany, this is typically the authority in the federal state where we are established.

To exercise your rights, email privacy@vexorisdev.com. We will respond within the timeframe required by law.

Third-party processors

We use carefully selected service providers who process data on our behalf under data processing agreements where required:

• Application hosting and content delivery — our site and applications are served through third-party hosting infrastructure with appropriate data processing agreements in place.
• Database hosting — personal data is stored in an encrypted, distributed database service.
• File storage — uploaded files are stored using object storage infrastructure with access controls.
• Email delivery — transactional and support email is sent via a third-party email delivery service under a data processing agreement.

Brand asset request security logging

When you submit a brand asset access request, we record a SHA-256 hashed version of your IP address (not the raw address) and your browser user-agent string. This is used solely for abuse prevention, fraud detection, and security accountability.

Legal basis: legitimate interest in protecting our brand assets and systems. Retention: aligned with brand request records and security incident needs. You may request information about data held about you via the contact details above.

International transfers

Some processors may process data outside the European Economic Area. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions, consistent with GDPR requirements.

Children

Our services are not directed at individuals under 16. We do not knowingly collect personal data from children under this age. If you believe a child has provided us data, contact us and we will delete it.

Contact for data requests

Data protection enquiries: privacy@vexorisdev.com

General contact: contact@vexorisdev.com

Vexoris Development · Bad Oeynhausen, Germany