Privacy policy

1. Controller (Verantwortlicher)

Senva GmbH
Bundesallee 32
10717 Berlin
Germany
Phone: +49 30 5268 7541
Email: info@senva.de

Represented by its managing director (Geschäftsführer), Kim Pham.

2. Questions about data protection

Please send questions about data protection to info@senva.de or by post to the address in section 1.

3. Overview

The website senva.de is static. It has no user accounts, no contact form, no newsletter and no comment function. We process personal data here in only four situations:

• when you open pages (server log files, section 4),
• when you contact us by email or phone (section 5),
• when you apply for a job (section 6),
• when you consent to statistics with Google Analytics 4 (sections 7 and 8).

4. Hosting and server log files

The website senva.de runs on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server is located in a Hetzner data centre in Nuremberg. Hetzner provides the server on our behalf.

Each time a page is requested, the server automatically processes the following data and stores it in log files:

• IP address of the requesting device
• date and time of access
• requested address and amount of data transferred
• HTTP status code
• address of the page you came from (referrer), if your browser sends it
• browser and operating system, as far as your browser sends them

Purpose: we need this data to deliver the website, keep its operation secure, detect and fend off attacks, and find errors.

Legal basis: Art. 6(1)(f) of the General Data Protection Regulation (GDPR, in German DSGVO). Our legitimate interest lies in the secure and functioning operation of the website.

Retention: the server starts a new log file every day and deletes it after 14 days. If we need individual entries to investigate a specific security incident, we keep them until the investigation is complete.

5. Contact by email and phone

When you email or call us, we process the information you give us in doing so: usually your name, company, email address or phone number, and the content of your enquiry.

Purpose: we answer your enquiry and, if you wish, arrange and hold an intro call with you.

Legal basis: Art. 6(1)(b) GDPR if your enquiry is aimed at entering into a contract with us. In all other cases Art. 6(1)(f) GDPR; our legitimate interest is answering enquiries.

Retention: we delete your details once your enquiry has been fully dealt with and no contract has resulted from it. This does not apply to documents we are required to keep for commercial or tax reasons, such as commercial and business letters, which we keep for six years under Section 257 of the German Commercial Code (Handelsgesetzbuch, HGB), and tax-relevant documents, which we keep for up to ten years under Section 147 of the German Fiscal Code (Abgabenordnung, AO).

Recipients: our emails are processed on our behalf by our email provider, STRATO AG, based in Berlin.

Video calls: if a call takes place by video, we use the service we agree on with you. If you invite us through your company's system, your company is responsible for the processing in that service. If we send the invitation, we tell you in the invitation which provider we use and which data is processed.

Please do not send us particularly sensitive data by unencrypted email. We will agree with you beforehand how to exchange such data securely.

6. Job applications

If you apply by email to bewerbung@senva.de, we process the data contained in your application: usually your contact details, CV, certificates and references, information on your qualifications and salary expectations, and links to samples of your work.

Purpose: we review your application, carry out the application process and decide whether to hire you.

Legal basis: Art. 6(1)(b) GDPR (steps taken prior to entering into a contract). If you voluntarily share special categories of personal data with us, such as a severe disability (Schwerbehinderung), we process this information under Art. 9(2)(b) GDPR in conjunction with Section 26(3) of the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG).

Recipients: your documents are seen only by the people involved in the selection. Your email passes through our email provider, STRATO AG (section 5).

Retention: if we do not hire you, we delete your documents six months after the end of the process. We need them for that long so that we can defend ourselves against possible claims under the German General Equal Treatment Act (Allgemeines Gleichbehandlungsgesetz, AGG) (Art. 6(1)(f) GDPR). We keep your documents for longer only if you expressly consent, for example so that we can consider you for future positions (Art. 6(1)(a) GDPR). You can withdraw this consent at any time. If we hire you, we add the documents to your personnel file.

7. Consent and cookie settings

As long as you have not made a decision, a banner asks whether you consent to statistics with Google Analytics 4. “Reject” and “Accept” are shown side by side with equal weight. Without your consent, Google Analytics is not loaded and no cookies are set. You can use the website without restriction even if you do not consent.

We store your decision in your browser's local storage (localStorage) so that we do not have to ask you again on every page view. The key “senva-consent-v1” holds only your choice and the date. The entry stays in your browser and is not transmitted to us or to any third party. After twelve months we ask you again.

Legal basis: Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, TDDDG), because this is the only way we can respect your decision. To the extent that personal data is processed in doing so, the legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR.

Withdrawal: you can withdraw your consent at any time with effect for the future, just as easily as you gave it. To do so, click “Cookie settings” at the bottom of any page and then “Reject”. The website then deletes the Google Analytics cookies in your browser and reloads the page. This does not affect the lawfulness of processing carried out before you withdrew your consent.

8. Statistics with Google Analytics 4

Only if you have given your consent do we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”).

What is collected: pages viewed, time and duration of the visit, interactions such as clicks and scrolling, the page you came from, device type, browser, operating system, screen resolution, and your approximate location (country, region, city). Google derives the location from your IP address. According to Google, Google Analytics then immediately discards the IP addresses of visitors from the EU and does not store them. Google Analytics recognises your device by a random identifier stored in a cookie. The data is therefore pseudonymous, but not anonymous.

Cookies:

• _ga: distinguishes between visitors, expires after 2 years
• _ga_[ID]: stores the session state, expires after 2 years

Purpose: we want to know which pages are read and at which point visitors leave the website, so that we can improve it. We use the data only as statistics, we do not try to identify you as a person, and we do not combine the data with other data about you.

Settings: Google signals and the use of the data for personalised advertising are switched off in our website's code.

Legal basis: your consent, under Section 25(1) TDDDG for storing and reading the cookies on your device, and under Art. 6(1)(a) GDPR for the further processing of the data.

Processing on our behalf: we have a data processing agreement with Google (Art. 28 GDPR).

Transfers to third countries: Google may transfer data to Google LLC in the USA. On 10 July 2023 the European Commission adopted an adequacy decision for the USA under Art. 45 GDPR (EU-US Data Privacy Framework, Implementing Decision (EU) 2023/1795). Google LLC is certified under this framework. On 3 September 2025 the General Court of the EU dismissed an action against this decision (Case T-553/23). The Court of Justice of the EU has not yet ruled on the appeal against that judgment (Case C-703/25 P, as of 8 November 2026); until it does, the decision remains in force. If Google transfers data to other countries without an adequacy decision, Google's contract terms apply the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).

Retention: Google Analytics keeps data at the level of individual visitors and events for at most 14 months and then deletes it automatically. Aggregated reports that do not relate to individual visitors, such as the number of page views per month, are not covered by this period.

Withdrawal: via “Cookie settings” at the bottom of every page, see section 7.

More information: Google's privacy policy, policies.google.com/privacy

9. Fonts, images and videos

We serve the Geist and Geist Mono fonts from our own server. Loading the website does not open a connection to Google Fonts or any other font service. Images and videos are also stored on our own server. We do not embed video platforms or third-party maps. This applies to all pages, including the Labs papers.

10. No social media plugins; external links

This website contains no social media plugins and no embedded content from social networks. Links to other websites, such as the sources in our Labs papers, are plain links. The operator of the linked website receives data from your browser only when you follow a link. From then on, that operator's privacy policy applies.

11. Recipients at a glance

• Hetzner Online GmbH, website hosting (section 4), as a processor (Auftragsverarbeiter)
• STRATO AG, email (section 5), as a processor
• Google Ireland Limited, only after your consent (section 8), as a processor
• Public authorities, where we are legally obliged

We do not pass data on to any other third parties. We do not sell data.

12. Transfers to third countries

Through this website, we transfer data to countries outside the EU and the EEA only through Google Analytics 4, and only after you have consented (section 8). The website runs on a Hetzner server in Nuremberg; our email provider is STRATO AG, based in Berlin. For video calls, see section 5.

Our partner team in Hanoi (Vietnam) is an independent partner company that develops software for us as a subcontractor. It has no access to personal data or production data, and therefore receives none of the data described in this policy.

13. Retention periods at a glance

14. Your rights

Provided the legal requirements are met, you have the following rights with respect to us:

• access to the data we process about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing (Art. 21 GDPR, see section 15)
• withdrawal of consent with effect for the future (Art. 7(3) GDPR)
• complaint to a supervisory authority (Art. 77 GDPR, see section 16)

For any of these requests, an email to info@senva.de or a letter to the address in section 1 is enough.

15. Right to object under Art. 21 GDPR

Where we process your data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you can object to this processing at any time on grounds relating to your particular situation. We will then stop processing the data, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You can send your objection informally to info@senva.de.

16. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU Member State where you live or work or where the alleged infringement took place. The authority responsible for us is:

Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit)
Alt-Moabit 59-61
10555 Berlin
Germany
www.datenschutz-berlin.de

17. Obligation to provide data; automated decisions

You are under no obligation to provide us with personal data. Without your contact details, however, we cannot answer an enquiry, and without your documents we cannot consider an application. We do not make automated decisions, including profiling, within the meaning of Art. 22 GDPR.

18. Data security

The website is delivered exclusively over encrypted connections (HTTPS with TLS). We protect the data we process with technical and organisational measures that we review regularly.

19. Changes to this policy

We update this policy when the website, our service providers or the legal situation change. The version published here at the time of your visit applies.

Last updated: 8 November 2026