Privacy policy

Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Hosting and server log files

Our website is delivered through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (“Cloudflare”) (Cloudflare Workers). Cloudflare runs data centres worldwide; your request is usually handled in a data centre near you but may also be processed outside the EU. In a database at Cloudflare (Cloudflare D1) we also store orders and started orders, newsletter sign-ups and chat and contact messages (details in the respective sections). Cloudflare acts as our processor. Transfers to the USA are based on the EU-US Data Privacy Framework and, in addition, on EU standard contractual clauses. More information: Cloudflare privacy policy.

Each time you visit our website, server log files are recorded automatically: IP address, date and time, page requested, referrer URL, browser and operating system (user agent), HTTP status code and amount of data transferred. We need this data to deliver the website, keep it stable and secure and fend off attacks. The legal basis is Art. 6(1)(f) GDPR. Our application logs are deleted automatically after 7 days at the latest; Cloudflare processes connection data for attack prevention according to its own deletion periods.

To protect against abuse (e.g. automated mass requests), we briefly process your IP address in memory to limit the number of requests to our forms and interfaces. It is not stored permanently. Fonts are hosted locally; no connection to Google servers is made when you visit the site.

Cookies and consent management

We use cookies and similar technologies. We set strictly necessary cookies on the basis of § 25(2) no. 2 TDDDG and Art. 6(1)(b) or (f) GDPR. We set all other cookies only with your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR).

Statistics: If you consent to “Statistics”, your browser measures how fast and responsive our pages are (Web Vitals: LCP, INP, CLS) and sends the values together with the page visited to our server. We use no cookies and no third parties for this; the values are only kept in our application logs (deleted after 7 days at the latest). The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

You can change your choice or withdraw your consent at any time via the “Cookie settings” link in the footer of every page. Your choice is stored in the hv_consent cookie.

Price test

We are currently testing different prices – but only for visitors who reach us via certain ad links (links ending in “?variant=…”). If you come via such a link, you see the price of that link's test group; the group is stored in the cookie hv_arm for 90 days so that you see the same price on all pages and during checkout. All other visitors see the regular price. The assignment is not based on personal characteristics, your location or your behaviour. If you order, we store the price group with the order to evaluate the test. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is determining an appropriate price and displaying prices consistently.

Contact form and email

If you contact us via the contact form or by email, we process your name, email address, message, the selected topic and – if provided – your order number. Messages from the contact form are stored in our database at Cloudflare (see “Hosting”), and we receive a notification by email via Resend (see “Transactional emails”).

We process this data to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract, otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries). We delete the data once your request has been dealt with, unless statutory retention obligations apply.

Orders and payment processing

When you place an order, we process your name, email address, delivery address, optionally your phone number, and the order details (product, offer, price, price-test group, pre-order, language). The purpose is to perform the purchase contract. The legal basis is Art. 6(1)(b) GDPR and, where we comply with statutory retention obligations, Art. 6(1)(c) GDPR.

Order form

As soon as you enter an email address in the order form, we store the email address, name, delivery country, the chosen offer and the price in our database – even if you do not complete the order. This lets us complete your order, help you with problems during checkout and evaluate abandoned orders. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(f) GDPR (our legitimate interest in a working checkout). We do not send reminder or advertising emails without your consent. If no order follows, we delete this data after 30 days.

Stripe

Payments are processed by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (“Stripe”). Stripe receives the order details listed above and the payment details you enter in the payment form. We never receive your full card details. The order details are stored in our Stripe account. Stripe processes data partly as our processor and partly as an independent controller, e.g. for fraud prevention and to comply with legal obligations. Data may be transferred to Stripe, Inc. in the USA (EU-US Data Privacy Framework, supplemented by EU standard contractual clauses). More information: Stripe privacy policy.

On the checkout page, Stripe loads a script (Stripe.js) and sets cookies (e.g. __stripe_mid, __stripe_sid) to detect and prevent fraudulent payments. This involves processing your IP address and browser and device information, among other things. The legal basis is § 25(2) no. 2 TDDDG for storing and reading information and Art. 6(1)(b) and (f) GDPR; our legitimate interest is secure payment processing.

Klarna

If you choose Klarna, you are redirected to Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden (“Klarna”). Klarna receives the data required for the payment (e.g. name, address, email address, amount, order number) and processes it as an independent controller, including for identity and credit checks. More information: Klarna privacy notice.

Transactional emails (Resend)

We send order confirmations, confirmations of withdrawals or cancellations, replies to your chat or contact requests and notifications to ourselves via the Resend service, provided by Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, USA. This involves processing your email address, your name, the content of the email and technical delivery data. We do not use open or click tracking. We have concluded a data processing agreement with the provider. Transfers to the USA are based on the EU-US Data Privacy Framework where the provider is certified, and on EU standard contractual clauses. The legal basis is Art. 6(1)(b) GDPR.

Shipping

Your order is shipped directly by our supplier. For delivery, we therefore pass your name, delivery address and the items ordered on to our supplier, who hands the parcel to the carrier. We only pass on your email address or phone number if this is necessary for delivery or you have consented. The legal basis is Art. 6(1)(b) GDPR. If the supplier or the carrier is based outside the EU/EEA, we transfer this data because it is necessary for performing the purchase contract with you (Art. 49(1)(b) GDPR).

Withdrawal function and cancellation

If you withdraw from your contract using our withdrawal function or cancel a contract via our cancellation page, we process your name, email address, order or contract number, the details you enter in the form and the date and time of receipt. We send you an acknowledgement of receipt by email. The legal basis is Art. 6(1)(c) GDPR in conjunction with §§ 356a, 312k BGB and Art. 6(1)(b) GDPR. We store this data until the limitation period for possible claims has expired (usually three years from the end of the year) and beyond that where statutory retention obligations apply.

Chat and chat assistant

You can ask us questions via the chat window. We process your messages, the page on which you started the chat, the times and – if you provide it – your email address. So that you can find the conversation again, your browser stores an ID of the chat (local storage, see the table above); this is strictly necessary for the chat you requested (§ 25(2) no. 2 TDDDG). We store the messages in our database at Cloudflare. If you ask for a person, our staff answer the chat; if you wish, we also send you their replies by email.

At first, an AI assistant answers. For this we process your messages and the chat history so far with Cloudflare Workers AI: an open language model (GLM-4.7 Flash by Z.ai), run by Cloudflare in its own network, generates the reply. The data does not leave Cloudflare’s infrastructure for this (see “Hosting”); Cloudflare processes it as our processor, does not store inputs or outputs after the reply and does not use them to train AI models. If you ask in the chat about the status of an order, the assistant checks the order number and email address against our database and only tells you the status. Replies from the AI assistant may contain mistakes; it does not make decisions about you. Please do not enter sensitive data such as payment details or passwords in the chat.

The purpose is to answer your questions and provide customer service. The legal basis is Art. 6(1)(b) GDPR if your question relates to an order or a purchase you are considering, otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries). We delete closed chats 180 days after the last message unless retention obligations apply.

Connection service (relay server)

To connect the boxes of the Homvoya Kit with each other, we operate a relay server in the EU. Hosting provider: TODO (Anbieter und Standort des Relay-Servers). The provider acts as our processor.

We process:

• the public IP addresses of your home box and travel box,
• the start and end of connections (timestamps),
• the amount of data transferred,
• a technical identifier of the boxes (e.g. a cryptographic key) to assign them to your kit.

We do not log the content of your traffic – for example the websites you visit or the files you transfer. The connections between the boxes and the relay server are encrypted.

The purpose is to establish and operate the connection, troubleshoot and prevent abuse and attacks. The legal basis is Art. 6(1)(b) GDPR and, for security and abuse prevention, Art. 6(1)(f) GDPR. We delete connection logs after 7 days. We only disclose data to authorities where we are legally obliged to do so.

When you use websites or services via the boxes, they see the IP address of your home connection. Their data processing is governed by the privacy policies of the respective providers. TODO: check whether the boxes contact other services (e.g. manufacturer update servers, time servers) and add them here.

Newsletter

If you subscribe to our newsletter, we use your email address to send you information about our product and offers. We use the double opt-in procedure: after signing up you receive an email with a confirmation link; we only send the newsletter after you confirm. We store the sign-up with the language and the times of sign-up and confirmation in our database at Cloudflare; the emails are sent via Resend. Unconfirmed sign-ups are deleted after 30 days.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the link in every email. After you unsubscribe, we remove your email address from the mailing list; we keep proof of your earlier consent for up to three years on the basis of Art. 6(1)(f) GDPR.

Legal bases at a glance

• Art. 6(1)(a) GDPR: consent (e.g. Meta Pixel and Conversions API)
• Art. 6(1)(b) GDPR: performance of a contract and pre-contractual measures (e.g. order, shipping, connection service, customer service)
• Art. 6(1)(c) GDPR: legal obligation (e.g. retention obligations, confirmations of withdrawal and cancellation)
• Art. 6(1)(f) GDPR: legitimate interests (e.g. secure provision of the website, fraud prevention, abuse prevention, price test)
• § 25 TDDDG: storing and reading information on your device – with consent (para. 1) or where strictly necessary (para. 2 no. 2)

Storage period

We only store personal data for as long as necessary for the respective purpose. We then delete it unless statutory retention obligations apply. Under German commercial and tax law (§ 257 HGB, § 147 AO), we retain:

• commercial and business letters: 6 years,
• accounting vouchers (e.g. invoices): 8 years,
• books of account, inventories, annual financial statements and management reports: 10 years.

The periods start at the end of the calendar year in which the documents were created. During this time we restrict processing. We may also keep data relating to your order until the limitation periods for claims for defects have expired. Storage periods for individual cookies and services are given in the respective sections.

For the data in our own database, the following deletion periods also apply:

• started but not completed orders: 30 days,
• unconfirmed newsletter sign-ups: 30 days,
• closed chats and contact requests: 180 days after the last message,
• orders: until the retention and limitation periods above have expired.

Transfers to third countries

Some of our service providers are based in the USA or transfer data there or to other third countries (Cloudflare, Stripe, Resend). For the USA, the EU Commission has adopted an adequacy decision for companies certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Where there is no certification, we or the provider use the EU standard contractual clauses (Art. 46(2)(c) GDPR). You can request a copy of these safeguards from us.

Your rights

You have the following rights towards us:

• access to your stored data (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• objection to processing (Art. 21 GDPR),
• withdrawal of consent with effect for the future (Art. 7(3) GDPR). This does not affect the lawfulness of processing carried out before the withdrawal.

Simply contact us at support@homvoya.com.

Right to object under Art. 21 GDPR: where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. Where we process your data for direct marketing, you can object at any time without giving reasons.

Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is:

TODO (Datenschutzaufsichtsbehörde Ihres Bundeslandes, mit Anschrift)

Obligation to provide data

For an order, we need the details marked as mandatory. Without them we cannot conclude or perform the contract. All other details are voluntary. You are not obliged to provide data for marketing purposes.

No automated decision-making

We do not make decisions based solely on automated processing within the meaning of Art. 22 GDPR. The random assignment to a price-test group is not based on an evaluation of your personal characteristics or behaviour and is not such a decision. Payment providers such as Klarna or PayPal may carry out automated credit checks under their own responsibility; see their privacy notices for details.

Data security

Our website is transmitted exclusively in encrypted form via HTTPS (TLS). We take technical and organisational measures to protect your data against loss, manipulation and unauthorised access.

Changes to this privacy policy

We update this privacy policy when our data processing or the legal situation changes. The version published here applies.