● Legal

Privacy Policy

How Plavion GmbH processes personal data on this website, what rights you have, and which services we work with.

Last updated: July 2026

Version: 1.0

1 Privacy at a Glance

The protection of your personal data is highly important to Plavion GmbH. We treat your personal data confidentially and in accordance with applicable data protection laws, in particular the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), the German Digital Services Act (DDG), and other applicable data protection provisions.

This privacy policy informs you about:

what personal data we process,
for what purposes,
on what legal basis the processing is based,
how long data is stored,
what rights you have as a data subject,
and what technical and organizational measures we have taken to protect your data.

This privacy policy applies to visits to our website and to all functions and services offered through it, in particular contact inquiries, job applications and the submission of application documents.

Our website can generally be used without providing personal data. Where the processing of personal data is required for certain services, this is done exclusively on the basis of legal permission or your explicit consent.

We review this privacy policy regularly and adapt it to technical developments, legal changes, or new features of our website.

2 Data Controller

The controller within the meaning of Art. 4 No. 7 GDPR is:
Plavion GmbH
Managing Director
Kaveh Jenabi
Bayreuth
Germany
Email:
info@plavion.de
Website:
www.plavion.de
If you have any questions regarding the processing of your personal data or wish to exercise your data subject rights, you may contact us at any time.

3 Data Protection Officer

Under current circumstances, Plavion GmbH is not legally required to appoint a Data Protection Officer pursuant to Art. 37 GDPR or Sec. 38 BDSG.

Should this legal obligation arise in the future due to a change in our business activities or the applicable legal framework, the relevant information will be published here.

Regardless of this, we handle all data protection inquiries with the utmost care.

4 Scope

This privacy policy applies to all pages of the Plavion GmbH website at
www.plavion.de
including all subpages and the functions offered through them.

It applies in particular to:

contact inquiries,
email communication,
job applications,
uploading application documents,
the careers section,
the Talent Pool,
embedded media,
cookie settings,
and all future features, unless governed by a separate privacy policy.

5 Principles of Data Processing

The processing of personal data is carried out in accordance with the principles of Art. 5 GDPR.

This means in particular:

lawfulness, fairness and transparency,
purpose limitation,
data minimization,
accuracy,
storage limitation,
integrity and confidentiality,
accountability.

We process personal data only to the extent necessary for the respective processing purpose.

Processing for other purposes only takes place where a legal basis exists or where you have given explicit consent.

6 Legal Bases for Processing

Where we process personal data, this is done exclusively on the basis of legal permission under the General Data Protection Regulation (GDPR).

Depending on the type of processing, we rely in particular on the following legal bases:

Art. 6(1)(a) GDPR – Consent
Where you give us your explicit consent to the processing of personal data, the processing is based on this consent. Consent given may be withdrawn at any time with effect for the future.

Art. 6(1)(b) GDPR – Contract or pre-contractual measures
Processing takes place where it is necessary for the performance of a contract or for the implementation of pre-contractual measures, for example in the context of customer inquiries or application procedures.

Art. 6(1)(c) GDPR – Legal obligation
Where statutory retention, documentation or evidentiary obligations exist, we process personal data on the basis of these legal obligations.

Art. 6(1)(f) GDPR – Legitimate interest
Where necessary, we process personal data to safeguard our legitimate interests. These include in particular:

ensuring the secure operation of our website,
protecting our IT systems,
preventing misuse,
handling general contact inquiries,
asserting, exercising or defending legal claims,
optimizing our business processes.

Where special categories of personal data are voluntarily submitted as part of a job application (e.g. health data or information on a severe disability), such data is processed exclusively in accordance with Art. 9 GDPR and applicable employment law provisions.

7 Hosting of Our Website

Our website is hosted on a managed WordPress platform provided by
IONOS SE
IONOS SE acts as a processor within the meaning of Art. 28 GDPR.

As part of the hosting service, IONOS processes personal data exclusively on our behalf and in accordance with our instructions pursuant to Art. 28 GDPR.

This may include in particular the following data:

IP address
date and time of access
browser type
operating system
referrer URL
pages accessed
server log data

This processing serves the purpose of:

providing the website,
ensuring system security,
error analysis,
detecting misuse,
and ensuring reliable operation.

A data processing agreement pursuant to Art. 28 GDPR is in place with our hosting provider.

Further information on data protection at IONOS is available at:

https://www.ionos.de/terms-gtc/datenschutzerklaerung/

8 SSL/TLS Encryption

To protect confidential content and personal data, our website uses modern TLS encryption.

You can recognize an encrypted connection by the fact that the address bar of your browser begins with
https://
and a lock symbol is displayed.
Encryption generally prevents data you transmit to us from being read by unauthorized third parties.

Nevertheless, we recommend transmitting confidential information only via secure communication channels.

9 Server Log Files

When you visit our website, our hosting provider automatically collects information and stores it in what are known as server log files.

This includes in particular:

browser type and version
operating system used
referrer URL
hostname of the accessing device
IP address
date and time of the server request
files accessed
HTTP status code
amount of data transferred

This data serves exclusively the following purposes:

ensuring system security,
detecting and defending against cyberattacks,
error analysis,
ensuring stable server operation,
technical administration.

This data is not combined with other personal data.

The legal basis for this processing is Art. 6(1)(f) GDPR.

Our legitimate interest lies in the secure, stable and reliable provision of our website.

10 Cookies

Our website uses cookies.
Cookies are small text files that are stored on your device and contain certain information.

We distinguish between:
Technically necessary cookies
These cookies are necessary for our website to function properly. They enable, for example:

storing your cookie settings,
the secure operation of the website,
the provision of basic functions.

No consent is required for technically necessary cookies.

Legal basis:
Art. 6(1)(f) GDPR in conjunction with Sec. 25(2) TDDDG.
Cookies requiring consent
Should analytics, convenience or marketing services be used in the future, they will only be activated after your prior consent.

Without your explicit consent, no personal data is processed for analytics or marketing purposes.

11 Consent Management (CookieYes)

To manage the consent of our website visitors, we use the consent management system CookieYes.

On your first visit to our website, you can choose which cookies and external services may be activated.

Your consent is documented and can be withdrawn or adjusted at any time via the cookie settings.

Legal basis:
Art. 6(1)(a) GDPR in conjunction with Sec. 25(1) TDDDG.

12 Contact via Contact Form and Email

If you contact us via the contact form or by email, we process only the personal data you voluntarily provide to us.

This includes in particular:

name
email address
content of your message
other voluntarily provided information

Processing is carried out exclusively for the purpose of communicating with you and handling your request.

As a general rule, data is not disclosed to third parties, unless there is a legal obligation to do so or this is necessary to process your request.

The legal basis is regularly
Art. 6(1)(b) GDPR
or
Art. 6(1)(f) GDPR.
Once processing is complete, your data will be deleted, provided no statutory retention obligations apply.

13 Job Applications

You have the option of applying for advertised positions or submitting a speculative application to Plavion GmbH via our website.

This may involve the processing of the following personal data in particular:

first name
last name
email address
phone number (optional)
place of residence
nationality (optional)
language skills
salary expectations
earliest possible start date
links to online profiles (e.g. LinkedIn), where voluntarily provided
application documents
resume/CV
references
certificates
cover letter
other voluntarily provided information

Processing is carried out exclusively for the purpose of conducting the application process.

Access to your application documents is granted exclusively to those persons within Plavion GmbH who are directly involved in the respective selection process.

No automated decision-making or profiling takes place.

The legal basis is
Art. 6(1)(b) GDPR
and
Sec. 26 BDSG.
Should application documents voluntarily contain special categories of personal data (e.g. health data or information on a severe disability), such data is processed exclusively to the extent legally permitted under Art. 9 GDPR.

We explicitly recommend that applicants refrain from submitting special categories of personal data in their application documents unless required for the application process.

14 Uploading Application Documents

As part of the application form, you can upload documents electronically.

This includes in particular:

resume/CV
work references
academic transcripts
certificates
cover letters
other voluntarily submitted documents.

Transmission takes place exclusively via an encrypted TLS connection.

Submitted documents are processed exclusively for the purpose of conducting the application process.

Please submit only documents that are necessary for your application.

We ask that you refrain from uploading documents that contain personal data of third parties or that are not required for the application process.

15 Talent Pool

If you give us separate consent, we may store your application documents in our Talent Pool beyond the current application process.

The purpose of this storage is to be able to contact you again regarding future suitable job openings.

Inclusion in the Talent Pool is based exclusively on your voluntary consent. Inclusion in the Talent Pool has no influence on the decision in the current application process.

Legal basis:
Art. 6(1)(a) GDPR.
You may withdraw your consent at any time with effect for the future.

Withdrawal can be made informally by email to
info@plavion.de
Upon receipt of your withdrawal, your data will be promptly deleted from the Talent Pool, provided no statutory retention obligations apply.

16 Storage Period

As a general rule, we only store personal data for as long as is necessary for the respective processing purpose.

Where statutory retention obligations exist, storage is carried out in accordance with legal requirements.

The following storage periods currently apply to job applications:
Successful application
The application documents become part of the personnel file and are processed in accordance with legal requirements.

Unsuccessful application
As a general rule, application documents are deleted no later than six months after conclusion of the application process, unless legal grounds require earlier or later deletion.

Talent Pool
Where you have given explicit consent, your data will be stored for a maximum of 24 months.

Before this period expires, your data will either be deleted or — where necessary — your consent will be requested again.

17 Recipients of Personal Data

Within Plavion GmbH, access to personal data is granted exclusively to those persons who require it to perform their respective duties.

In addition, we use carefully selected external service providers who process personal data exclusively on our behalf and in accordance with our instructions. Where legally required, we enter into a data processing agreement pursuant to Art. 28 GDPR with these service providers.

Recipients of personal data may include in particular:

hosting providers
IT service providers
email service providers
applicant management and website service providers (where used)
tax advisors, auditors or legal advisors, where legally required or necessary to safeguard legitimate interests
authorities and public bodies, where we are legally obligated to do so.

Beyond this, personal data is disclosed to third parties exclusively:

where you have given explicit consent,
where this is legally required,
or where disclosure is necessary to assert, exercise or defend legal claims.

18 Transfer of Personal Data to Third Countries

As a general rule, Plavion GmbH processes personal data within the European Union or the European Economic Area (EEA).

A transfer of personal data to recipients outside the EU or EEA only takes place:

where legally permitted,
where you have given explicit consent,
or where appropriate safeguards pursuant to Art. 44 et seq. GDPR are in place.

Where services from companies based in third countries are used, personal data is transferred exclusively in compliance with the legal requirements of the GDPR.

This may include in particular adequacy decisions by the European Commission or appropriate safeguards such as Standard Contractual Clauses (SCCs).

19 Google Fonts

To ensure a consistent display of typefaces, we use "Google Fonts", a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When a page is accessed, a connection to Google's servers is automatically established, transmitting your IP address.

The legal basis is our legitimate interest in a technically stable and consistent presentation of our website (Art. 6(1)(f) GDPR).

Further information on the handling of user data can be found in Google's privacy policy: https://policies.google.com/privacy

20 YouTube (Privacy Enhanced Mode)

A company video may be embedded on our website via YouTube. The video is not loaded automatically; it is only embedded and played after you actively click on it.

We use YouTube's enhanced privacy mode ("Privacy Enhanced Mode", youtube-nocookie.com).

When you click on or play the video, a connection to YouTube's or Google's servers may be established. This may involve the processing of the following data in particular:

IP address
browser information
device information
date and time of access
technical connection data

We have no influence on the further processing of personal data by Google or YouTube.

Further information is available at:
https://policies.google.com/privacy

The legal basis is your consent given by actively clicking on the video (Art. 6(1)(a) GDPR).

21 Links to Social Networks

Our website may contain links to social networks.

Currently, this applies in particular to:

Additional platforms, such as Xing, may be added in the future.

Simply visiting our website does not result in any personal data being transmitted to these platforms.

Only when you actively click on the corresponding link do you leave our website and are redirected to the respective platform.

From that point on, only the privacy policy of the respective platform operator applies.

Please note that operators of social networks may process personal data under their own responsibility.

Further information can be found in the respective providers' privacy policies.

22 Data Security

The protection of your personal data is of the utmost priority to Plavion GmbH.

We implement appropriate technical and organizational measures (TOMs) to protect personal data against

unauthorized access,
loss,
manipulation,
disclosure,
destruction
and other unauthorized processing

These measures include in particular:

encrypted data transmission via TLS,
access restrictions,
role-based authorization concepts,
regular security updates,
protection of our IT infrastructure,
data backups,
and organizational measures to maintain confidentiality.

Our security measures are continuously reviewed and adapted in line with technological developments.

Despite all measures taken, we point out that complete security of data transmitted over the internet cannot be technically guaranteed.

23 No Automated Decision-Making

No decision-making based solely on automated processing — including profiling — pursuant to Art. 22 GDPR takes place.

In particular, applications are not evaluated or selected solely by automated means.

Decisions in the application process are always made with the involvement of responsible individuals.

24 Data Economy and Minimization

Plavion GmbH processes personal data only to the extent necessary to fulfill the respective purpose.

In doing so, we are guided in particular by the principles of

data minimization,
purpose limitation,
storage limitation,
and integrity and confidentiality pursuant to Art. 5 GDPR.

We therefore ask you to provide us only with the personal data that is necessary for the respective inquiry or application process.

25 Rights of Data Subjects

As a data subject, you have various rights under the General Data Protection Regulation (GDPR) regarding the processing of your personal data.

If you wish to exercise any of the following rights, you may contact us at any time using the contact details provided in this privacy policy.

We will process your request without undue delay and within the statutory deadlines.

25.1 Right of Access

Under Art. 15 GDPR, you have the right to request information about:

whether we process personal data concerning you,
what data is being processed,
the purposes of the processing,
the legal basis for the processing,
how long the data will be stored,
which recipients the data has been or will be disclosed to,
and what rights you have regarding the processing.

You may also request a copy of the personal data being processed.

25.2 Right to Rectification

Under Art. 16 GDPR, you have the right
to request the prompt rectification of inaccurate personal data.

You may also request the completion of incomplete personal data.

25.3 Right to Erasure

Under Art. 17 GDPR, you have the right
to request the erasure of your personal data under the statutory conditions.

This applies in particular:

where the data is no longer necessary for the original purpose,
where you withdraw your consent,
where the processing is unlawful,
or where there is a legal obligation to erase the data.

The right to erasure does not apply where statutory retention obligations or other legal grounds preclude erasure.

25.4 Right to Restriction of Processing

Under the conditions of Art. 18 GDPR, you may request
that the processing of your personal data be restricted.

During the restriction, your data may generally only be stored or processed with your consent.

25.5 Right to Data Portability

Where the statutory conditions of Art. 20 GDPR are met, you have the right
to receive the personal data you have provided us in a structured, commonly used and machine-readable format.

You may also request
that this data be transferred directly to another controller, where technically feasible.

25.6 Right to Object

Where we process personal data on the basis of a legitimate interest pursuant to Art. 6(1)(f) GDPR,
you have the right under Art. 21 GDPR at any time
to object to this processing
on grounds relating to your particular situation.
Upon receipt of your objection, we will cease the relevant processing,
unless
we can demonstrate compelling legitimate grounds
that override your interests, rights and freedoms,
or the processing serves to assert, exercise or defend legal claims.

25.7 Withdrawal of Consent

You may withdraw any consent already given at any time with effect for the future.

The withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

Withdrawal may be made informally using the contact details provided in this privacy policy.

25.8 Right to Lodge a Complaint

If you believe
that the processing of your personal data violates data protection law,
you have the right under Art. 77 GDPR
to lodge a complaint with a data protection supervisory authority.
You may contact in particular the supervisory authority
of your habitual residence,
your place of work,
or the place of the alleged infringement.
Exercising this right does not affect any other administrative or judicial remedies.

26 Privacy of Minors

Our online services are aimed exclusively at businesses, business partners, job applicants and adult natural persons.

We do not specifically target children or minors under the age of 16.

We are not aware
of any personal data of children being knowingly collected.

Should we become aware
that personal data of children has been processed without the required consent,
such data will be deleted without delay.

27 Changes to This Privacy Policy

Plavion GmbH reserves the right
to amend this privacy policy
where necessary due to

changes in law,
new regulatory requirements,
technical developments,
new services,
or the further development of our website.

The version published on our website is always the current one that applies.

Where legally required,
we will inform you of material changes in an appropriate manner.

28 Contact Regarding Data Protection

If you have questions regarding data protection,
the processing of personal data,
or exercising your data subject rights,
you may contact us at any time.
Plavion GmbH
Managing Director Kaveh Jenabi
Email:
info@plavion.de
Website:
www.plavion.de
We endeavor
to process data protection inquiries as promptly as possible,
and no later than within the statutory deadlines.

29 Final Provision

This privacy policy was created specifically for the Plavion GmbH website.

It reflects the current technical setup of the website, the services used, and the data protection requirements applicable at the time of publication.

Should additional features or services be integrated in the future — for example analytics tools, map services, newsletters, applicant management systems, or additional communication platforms — this privacy policy will be updated accordingly.

30 Data Protection and Compliance Principles

Plavion GmbH regards data protection as an essential part of responsible corporate governance.

For us, protecting personal data is not solely about fulfilling legal obligations, but is an expression of our commitment to quality and our responsible approach toward customers, business partners, applicants, and all other data subjects.

Our processing of personal data is guided in particular by the following principles:

lawfulness and transparency
integrity and confidentiality
data minimization
purpose limitation
storage limitation
accountability
security of processing
continuous improvement of our data protection measures

Data protection is part of our business processes for us and is already taken into account when planning new services and digital applications (privacy by design and privacy by default pursuant to Art. 25 GDPR).

31 Technical and Organizational Measures (TOMs)

Plavion GmbH implements appropriate technical and organizational measures pursuant to Art. 32 GDPR to protect personal data against loss, misuse, unauthorized access, alteration or disclosure.

These include in particular:
Access control
Access to personal data is granted exclusively on a need-to-know basis.

Only authorized individuals are granted access to the data they require to perform their respective duties.

Authentication
Administrative areas of the website are protected by appropriate authentication measures.

Passwords are managed in accordance with recognized security standards.

Encryption
Communication between your browser and our website is encrypted using TLS.

This protects personal data from unauthorized access during transmission.

Data backup
Regular data backups enable the restoration of our systems in the event of technical faults or security incidents.

System updates
Our systems are updated regularly to close known security vulnerabilities and reflect the current state of the art.

Authorization concepts
Personal data is made accessible only to those individuals who require it to perform their respective duties.

Security monitoring
We regularly review our technical and organizational measures and adapt them as needed to new technical or legal requirements.

32 Directory of Currently Used Services

Below is an overview of the key services currently actually used on our website.

Service	Purpose	Legal Basis
IONOS Managed WordPress	Website hosting	Art. 6(1)(f) GDPR
IONOS Mail	Communication	Art. 6(1)(b) GDPR
CookieYes	Consent management	Art. 6(1)(a) GDPR
YouTube (Privacy Enhanced Mode)	Embedding company videos	Art. 6(1)(a) GDPR
WordPress	Website operation	Art. 6(1)(f) GDPR
Kubio	Website creation and presentation	Art. 6(1)(f) GDPR
WordPress Block Editor	Content management	Art. 6(1)(f) GDPR
Plavion Karriere	Processing job applications and uploading application documents	Art. 6(1)(b) GDPR in conjunction with Sec. 26 BDSG

This overview is updated whenever the services we use change.

33 Data Protection with Business Partners

In the course of our business activities, Plavion GmbH processes personal data of contacts at customers, suppliers, project partners and other business partners.

This includes in particular:

name
business contact details
company affiliation
communication data
project-related information

Processing is carried out exclusively to implement pre-contractual measures, to perform contracts, to maintain existing business relationships, and to fulfill legal obligations.

The legal basis is Art. 6(1)(b), (c) and (f) GDPR.

34 Data Protection for Project Inquiries

If you submit project inquiries or requests for proposals to us, we process the personal data you provide exclusively to handle your inquiry.

This includes in particular:

contact details
company information
project information
communication content

This data is used exclusively to process your inquiry.

It is not used for advertising purposes without your explicit consent.

35 Confidentiality

Plavion GmbH treats all information received in the course of its business activities confidentially.

Personal data and project-related information are made accessible only to those individuals who require it to perform their respective duties.

All employees and commissioned service providers are obligated to maintain confidentiality.

36 Data Protection for Future Enhancements

Our website is continuously being developed further.
Should additional features or services be integrated in the future, such as

newsletters,
customer portals,
appointment booking systems,
analytics tools,
map services,
chat functions,
applicant management systems,
or other external services,

these will be implemented exclusively in compliance with applicable data protection requirements.

Where necessary, this privacy policy will be updated accordingly.

37 Document History

Version	Date	Changes	Approved by
1.0	15.07.2026	Initial creation	Management

38 Approval

This privacy policy has been reviewed and approved by the management of Plavion GmbH.

The management is responsible for its regular review and updating.

Recommended review cycle:
at least once a year
as well as

after technical changes,
after the introduction of new services,
after legal changes,
after relevant decisions by European or German data protection authorities.

39 Processing of Personal Data in Business Communications

In the course of our business activities, we process personal data of contacts at our customers, business partners, suppliers, service providers, and other interested parties.

This may include in particular the following data:

first and last name
company
position or role
business phone number
business email address
communication content
project-related information
contract data

Processing is carried out exclusively:

to initiate and conduct business relationships,
for communication in the context of ongoing projects,
to fulfill contractual obligations,
to document business transactions,
and to safeguard legitimate interests.

The legal basis for this processing is Art. 6(1)(b), (c) and (f) GDPR.

40 Confidential Communication

Plavion GmbH treats all information received in the course of its business activities confidentially.

Personal data and project-related information are made accessible only to those individuals who require it to perform their respective duties.

We also expect our business partners to handle personal data responsibly and recommend the use of secure communication channels.

41 Electronic Communication

Communication with Plavion GmbH takes place predominantly by electronic means.

Please note that, despite security measures in place, the transmission of information by email may generally carry security risks.

If you wish to transmit particularly confidential information, we recommend contacting us in advance to agree on a suitable and secure means of transmission.

42 Data Quality

We place value on ensuring that personal data is:

accurate,
complete,
up to date,
and factually correct.

Should personal data change or be inaccurate, please inform us accordingly.

43 Privacy-Friendly Default Settings

When developing and operating our website, we adhere to the principles of
Privacy by Design
and
Privacy by Default
pursuant to Art. 25 GDPR.
This means in particular
that personal data is generally only processed to the extent
necessary for the respective purpose.
New features of our website are assessed from a data protection perspective before being introduced.

44 Cooperation with Processors

Where we engage external service providers to process personal data,
this is done exclusively on the basis of a data processing agreement pursuant to Art. 28 GDPR.

Our service providers are carefully selected and regularly reviewed
to ensure they implement appropriate technical and organizational measures to protect personal data.

45 Data Protection in the Application Process

The confidentiality of your application is of the utmost priority to us.

Your application documents are made accessible only to those individuals within Plavion GmbH
who are directly involved in conducting the respective application process.

As a general rule, your application documents are not disclosed to third parties,
unless
you have given explicit consent
or we are legally obligated to do so.

46 Deletion of Application Documents

After the application process is concluded, application documents are deleted in accordance with our deletion concept,
provided that

no statutory retention obligations apply,
no legitimate interests preclude deletion,
and no separate consent for inclusion in the Talent Pool exists.

Deletion takes into account the statutory limitation periods under the German General Equal Treatment Act (AGG).

47 Currency and Validity

This privacy policy is valid from the publication date stated above.

With each new version, the previous version becomes invalid.

The current version is always available on our website.

48 Document Control

Document	Website Privacy Policy
Version	1.0
Valid from	15.07.2026
Document owner	Management
Approved by	Managing Director
Next review	15.07.2027
Classification	Public

49 Closing Remarks

Plavion GmbH regards data protection as an essential part of responsible, transparent and sustainable corporate governance.

We are convinced
that trust is not created by technical solutions alone,
but in particular through an open, responsible and lawful approach to personal data.

For this reason, we regularly review our technical, organizational and legal data protection measures and continuously develop them further.

If you have any questions regarding data protection or the processing of your personal data,
we are happy to assist you at any time.