Privacy

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

vona KI- und Softwareagentur
Sylvia Michalk
c/o Kaminstudio Leipzig
Könneritzstr. 76
04229 Leipzig
Germany

Email: hello@vonalab.com
Phone: +49 (0) 341 247 150 38

The following notes provide a simple overview of what happens to your personal data when you visit this website. Personal data is any data with which you can be personally identified.

This website is deliberately built to use as little data as possible: fonts and images are served from our own server, no access logs are kept, and form data is transmitted only when you submit a form (contact, application or newsletter). To analyse how the website is used, we use the web analytics software Matomo with shortened IP addresses and without cookies; Matomo is loaded from our statistics server stats.lanakila-sports.de (see Web analytics with Matomo). Beyond that, personal data arises only when you contact us on your own initiative — and, for technical reasons, briefly when pages are requested and in the server's error logs (see Hosting).

This website is hosted by an external service provider: Contabo GmbH, Aschauer Straße 32a, 81549 Munich, Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with the host.

When a page is requested, the server briefly processes your IP address and the information your browser sends along (such as the address requested and the browser type) in order to deliver the page to you. The server is configured so that no access logs are kept; the host does not keep access logs for this website either and does not use tracking. Access data is therefore not stored and not merged with other data sources.

The exception is the server's technical error logs: they serve troubleshooting and securing operations and may contain IP addresses. They are not merged with other data sources and are kept only as long as necessary for that purpose.

The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in the secure and uninterrupted operation of the website).

Transmission between your browser and the server is encrypted (TLS).

When you use the contact form, your details (name, email address, subject, message and how you heard about us, and optionally phone number and company) are transmitted to our server over an encrypted connection (TLS) and forwarded from there as an email to our mailbox. They are not stored in a database. To protect against misuse (spam), the server checks before sending that the form was not submitted too quickly and limits the number of requests per sender. For this purpose your IP address is kept only as an irreversible check value (hash) and for at most 24 hours. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in protection against misuse).

If you contact us via the form, by email or by phone, we process the data you provide (e.g. name, email address, phone number, content of the inquiry) in order to handle your request. The legal basis is Art. 6 (1) (b) GDPR where your inquiry is aimed at a contract or pre-contractual measures, and otherwise Art. 6 (1) (f) GDPR (legitimate interest in answering inquiries).

We delete the data as soon as your request has been fully dealt with and no statutory retention obligations apply. When emails are received and sent, our mail server logs technically necessary connection data (for example time and sender or recipient address), but not the content of the message.

If you apply using the form on a job page (Careers), we transmit your details (name, email address, message, the title of the position, how you heard about us and – optionally – a link to your portfolio, profile or CV) to our mailbox over an encrypted connection (TLS), in the same way as the contact form. No files are uploaded via the website. Protection against misuse works as described under “Contacting us”. If you apply by email, we process the details and documents you send us.

We process this data to decide on your application, i.e. on a thesis, an internship, freelance work or employment. The legal basis is Art. 6 (1) (b) GDPR (steps prior to entering into a contract, i.e. preparing a possible collaboration). If we open a link you provide, the terms of the provider of that page apply to it.

Only the people at vona involved in the selection process have access to your application. We do not pass it on to third parties; it is kept in our mailbox for applications (jobs@vonalab.com) with our hosting provider (see “Hosting”). Decisions on applications are made exclusively by people: we do not evaluate applications with AI and make no automated decisions within the meaning of Art. 22 GDPR.

Providing your details is voluntary. However, we cannot process an application without your name, email address, a short message and how you heard about us; the link to your portfolio, profile or CV is optional.

If we do not end up working together, we delete your application data no later than six months after the end of the process, so that we can respond to any questions or claims during that time. If you would like us to keep your application for future positions, we will ask for your consent first (Art. 6 (1) (a) GDPR). If we do work together, we transfer the necessary data into the relevant records.

Our job postings are public; Google also shows them in its job search (Google for Jobs). So that Google picks up new, changed and closed postings quickly, we send Google the address of the respective job page. No data about visitors or applicants is transmitted. Google’s own privacy policy applies to searching on Google.

To offer theses with real-world relevance, we contact chairs, professorships and career centres at universities by email. For this we process business contact details that the university itself has published on its website: name, title, position or field and the business email address. In addition, we process the status of our contact (for example contacted, reminded, reply) and the email correspondence itself.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is to offer students theses from practice and to get in touch with universities for this purpose. We write individually and only where the field matches our topics, and send at most one reminder.

An AI service (Claude by Anthropic, based in the USA) helps us find suitable contacts on the universities’ public websites; it only reads publicly accessible pages. We do not analyse the email correspondence itself with AI.

We store the contact details in our mailing system (Listmonk), which we run ourselves on our server at our hosting provider (see Hosting); the correspondence is kept in our mailbox hello@vonalab.com with the same provider. We do not pass the data on to third parties and do not use it for our newsletter. We only name a university publicly as a partner with its explicit consent.

If no cooperation comes about, we delete the contact details and the correspondence no later than twelve months after the last message. If you object, we delete them immediately and keep only your email address with a note that you do not wish to be contacted again. If there is a cooperation, we keep the data for its duration.

You can object to this processing at any time (Art. 21 GDPR), for example with a short reply to our email. You will find your other rights under “Your rights”.

Using the “Submit an AI tool” form, providers can suggest a tool for our AI tools directory or report a correction to an existing entry. We transmit your details (name of the tool, website, category, pricing model, description, optional information on the tool’s data protection, your name, your email address, how you heard about us, and optionally company and role) encrypted (TLS) to our server. From there they are sent as an email to our mailbox and additionally stored as a file on our server at our hosting provider (not publicly accessible) so that we can process the submission. Protection against misuse works the same way as for the contact form; in addition, we limit the number of submissions per email address and store only an irreversible hash of the address for this purpose, for no longer than 24 hours.

We process this data to review the tool, ask questions and publish or update the entry. The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by submitting the form and can withdraw at any time by email, and our legitimate interest in an up-to-date, correct directory (Art. 6(1)(f) GDPR). We do not publish your name or email address; the directory only shows information about the tool and the provider.

Once processing is complete, we move the submission to an archive and delete it there after 180 days at the latest; we delete the email as soon as it is no longer needed for questions. There is no right to be listed in the directory.

If you sign up for our newsletter, you consent to receiving information from us by email on a regular basis. Your email address will not be passed on to other companies.

To sign up, we only need your email address; your name is optional. After submitting the form, you will receive an email in which you confirm your sign-up (double opt-in) – only then do we send you the newsletter. This ensures that nobody can enter someone else’s address. We store your email address, your name if provided, and the time of sign-up and confirmation so that we can prove your consent. The legal basis is your consent (Art. 6(1)(a) GDPR).

You can sign up using the form at the end of every page or on news.vonalab.com. The form on the website transmits your email address in encrypted form (TLS) to our server, which passes it directly to our newsletter software. To protect against misuse, the same applies as described under contacting us (checking the waiting time, limiting requests per sender using a non-reversible hash of the IP address, kept for no more than 24 hours). Confirmation emails and newsletters are currently sent in German.

To protect against automated sign-ups, the form on news.vonalab.com uses the open-source software ALTCHA. Your browser solves a small computational task that our server provides and verifies; you do not need to click anything. ALTCHA runs entirely on our own server, sets no cookies, stores nothing on your device and does not transmit any data to third parties. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in protection against misuse).

The newsletter is managed and sent using the open-source software listmonk on our own server with our hosting provider (see Hosting) at news.vonalab.com; the emails are sent by our own mail server. No external newsletter service is involved.

You can withdraw this consent to the use of your email address for promotional purposes at any time with effect for the future by clicking the “Unsubscribe” link at the end of each newsletter.

After you unsubscribe, we will no longer send you the newsletter. Your email address then remains stored as unsubscribed so that it is not contacted again by mistake and so that we can document your earlier consent (Art. 6(1)(f) GDPR). Using the “Settings” link at the end of each newsletter, you can download or completely delete your stored data yourself at any time; alternatively, a message to us is sufficient.

Newsletter tracking: Our newsletters contain so-called web beacons or tracking pixels, which allow us to see whether and when an email was opened and which links in the email the individual recipient followed. We store this data so that we can tailor our newsletters as closely as possible to the wishes and interests of our subscribers. The data collected in this way is used to send personalised newsletters to the respective recipient.

Consent to the newsletter: With regard to the use of your personal data for receiving our newsletter, you will be asked for your consent at the appropriate point as follows: “I have read the privacy policy and consent to my data being stored for sending the newsletter and for the newsletter tracking described therein. I can withdraw my consent at any time via the ‘Unsubscribe’ link in every newsletter.” By ticking the box, you agree that your data and your usage behaviour are stored electronically through newsletter tracking so that we can send you individual newsletters where applicable. Withdrawing your consent to the newsletter also withdraws your consent to newsletter tracking.

This website does not set any cookies; the Matomo web analytics also works without cookies. Only if you object to the web analytics does your browser store a cookie that records your objection (details under “Web analytics with Matomo”).

When you switch between the light and dark appearance, your choice is saved in your browser’s local storage (entry “vona-theme”) so that it is kept for your next visit. This entry contains no personal data, is not transmitted to us and serves solely the display you have chosen (§ 25 (2) no. 2 TDDDG).

You can delete stored cookies and local storage entries at any time in your browser settings.

On this website we use Matomo (formerly “Piwik”). Matomo is an open-source software with which we analyse the use of our website. In the process, your IP address, the pages of our website you visit, the website from which you came to us (referrer URL), the time you spend on these pages and technical information about your browser (e.g. browser type, operating system, screen resolution) are processed. If you use the search on this website, the search term, the selected section and the number of results are also recorded so that we can see which content is being looked for and is missing; please do not enter any personal information there.

Matomo does not set any cookies and does not store anything on your device. To attribute several page views to one visit, Matomo creates an irreversible check value (hash) from the shortened IP address and the technical information about your browser. If “Do Not Track” is enabled in your browser, Matomo does not record your visit.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in analysing and optimising our website.

We use Matomo with the anonymisation function “Automatically Anonymize Visitor IPs”. It shortens your IP address by two bytes, so that it is impossible to attribute the data to you or to the internet connection you use.

If you do not agree with this processing, you can object to the collection here. To keep your objection, your browser stores a cookie for this purpose; if you delete it, the objection no longer applies.

You have the following rights with regard to your personal data: access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR).

Right to object: Where we process data on the basis of Art. 6 (1) (f) GDPR, you may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR).

You can withdraw any consent you have given at any time with effect for the future (Art. 7 (3) GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the Saxon Data Protection and Transparency Commissioner (Sächsische Datenschutz- und Transparenzbeauftragte).

To exercise your rights, a message to hello@vonalab.com is sufficient.

October 2026. We update this privacy policy whenever the website or the legal situation changes.