Privacy Policy
GDPR Compliant (Articles 12, 13, 14 GDPR) • Version 1.1 • Effective Date: September 25, 2026 • Viewnamic (Dreher, Weiß GbR)
1. Data Controller and Contact Information
Responsible for the processing of personal data on this website (viewnamic.com) and the Viewnamic publishing platform within the meaning of Art. 4 No. 7 of the EU General Data Protection Regulation (GDPR) is:
Dreher, Weiß GbR (Viewnamic)
Oeynhauser Weg 28, 33100 Paderborn, Germany
Represented by the partners: Felix Dreher & Daniel Weiß
VAT ID (USt-IdNr.): DE303700917
Email: felix.dreher@viewnamic.com
Website: https://viewnamic.com
A Data Protection Officer has not been designated, as the statutory prerequisites pursuant to Art. 37(1) GDPR and Section 38 of the German Federal Data Protection Act (BDSG) are not applicable. For any inquiries regarding data protection and the assertion of your data subject rights, please contact the controller directly via email.
2. Primary Web Hosting and Server Infrastructure (IONOS)
Our production website, web application, and database infrastructure are hosted on servers provided by:
IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany.
When you access our web services, your web browser automatically transmits connection data that is recorded in web server log files. This data includes: your IP address, browser type and version, operating system, referrer URL, the requested resource/file, and the precise timestamp of the server request.
Purpose and Legal Basis: Processing of server log files is carried out to ensure the technical operation, stability, system integrity, and cybersecurity of our platform on the basis of Art. 6(1)(f) GDPR (Legitimate Interest in the secure and efficient provision of our online services).
Data Processing Agreement: We have concluded a Data Processing Agreement (DPA / Auftragsverarbeitungsvertrag) with IONOS SE pursuant to Art. 28 GDPR. All live application data is hosted and processed exclusively on certified data center facilities within Germany.
3. Automated Off-Site Backups and Disaster Recovery (Google Drive)
To ensure business continuity, data integrity, and disaster recovery capabilities pursuant to Art. 32(1)(c) GDPR, we generate automated encrypted off-site backups of our database and server directories using UpdraftPlus. These system backups are archived in dedicated cloud storage provided by Google Cloud / Google Drive (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland).
Backups may contain platform configurations, user credentials, and customer assets stored at the time of the snapshot. Backups are stored in access-restricted directories and are systematically overwritten in accordance with our rolling backup retention schedule.
Purpose and Legal Basis: Art. 6(1)(f) GDPR (Legitimate Interest in maintaining effective disaster recovery mechanisms and fulfilling statutory data security mandates under Art. 32 GDPR).
Data Transfer Safeguards: For potential processing operations on servers in the United States, Google LLC is certified under the EU-U.S. Data Privacy Framework (DPF).
4. Bot Protection and Anti-Abuse (Cloudflare Turnstile)
To safeguard our registration process, user logins, and web forms against malicious bot scripts, automated spam attacks, and credential stuffing, we utilize the bot-protection technology Cloudflare Turnstile provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.
Cloudflare Turnstile evaluates browser telemetry and device characteristics to verify human interaction without confronting users with distorted text or image-recognition puzzles. The data processed during verification is used solely for cyber-defense and spam prevention.
Legal Basis: Art. 6(1)(f) GDPR (Legitimate Interest in the protection of our web platform against abusive automated attacks) and Section 25(2) No. 2 TDDDG (strictly necessary for system security).
Data Transfer Safeguards: Data transfers to Cloudflare facilities in the USA are governed by the EU-U.S. Data Privacy Framework (DPF) as well as Cloudflare's standardized Data Processing Addendum incorporating EU Standard Contractual Clauses (SCCs).
5. Consent Management Platform (Complianz)
We deploy the consent management tool Complianz on our marketing website to obtain, manage, and document legally compliant user consent for cookies, tracking scripts, and external typography. Complianz stores an anonymized consent token in your local browser storage to retain your privacy preferences.
Legal Basis: Art. 6(1)(c) GDPR (Compliance with our statutory legal obligation to provide verifiable consent management under Art. 7(1) GDPR) and Section 25(2) No. 2 TDDDG.
6. External Web Typography (Google Fonts)
Our website utilizes external web fonts ("Libre Franklin" and "Roboto") supplied by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). When browsing our website, your browser establishes a direct connection to Google's content delivery servers (fonts.googleapis.com and fonts.gstatic.com) to download the required font files.
In this process, your IP address and user-agent metadata are transmitted to Google to deliver the visual styling to your screen.
Legal Basis: The integration is subject to your consent granted via our Complianz consent banner pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Where consent is withheld, standard fallback system fonts are displayed.
Data Transfer: Google LLC is certified under the EU-U.S. Data Privacy Framework.
7. Web Analytics (Google Analytics 4)
Subject to your explicit consent, our marketing website utilizes Google Analytics 4 (GA4), a web analysis service provided by Google Ireland Limited ("Google"). GA4 sets cookies and pseudonymized client IDs to measure visitor interaction patterns, bounce rates, traffic origins, and user journeys.
IP Anonymization: In Google Analytics 4, IP addresses are not logged or stored permanently. IP addresses are automatically truncated and discarded prior to processing and data logging on EU-based ingestion nodes.
Legal Basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG (Explicit Consent). You may revoke your consent at any time with effect for the future by adjusting your preferences in our website cookie settings.
Retention Period: Event-level analytics data is retained for a maximum duration of 2 to 14 months before automated deletion.
8. Inquiries, Appointment Scheduling (Calendly), and Newsletter
(1) Contact and Demonstration Inquiries: If you contact us via email or website forms, we collect the submitted personal data (name, business email, company, and message content) strictly to process and reply to your inquiry. Legal Basis: Art. 6(1)(b) GDPR (Pre-contractual measures) or Art. 6(1)(f) GDPR (Legitimate interest in responsive B2B communication).
(2) Appointment Booking via Calendly Link: Our website contains external buttons/links leading to our scheduling portal on Calendly (Calendly LLC, 271 17th St NW, Atlanta, GA 30363, USA). When clicking this link, you leave our website and are redirected to Calendly's service. Calendly handles your booking data (name, email address, preferred meeting slot) under its own data privacy responsibility.
(3) Newsletter and Product Updates: If you subscribe to our newsletter, your corporate email address is processed based on your consent via a verified Double Opt-In procedure. You can unsubscribe at any time using the one-click unsubscribe link provided in every newsletter. Legal Basis: Art. 6(1)(a) GDPR.
9. Platform Registration, Social Login (Single Sign-On), Brevo, and Payments (Stripe)
(1) Platform Registration & Administration: To access Viewnamic, Customers register an administrative account. We process business contact details (name, corporate email, company name, and hashed password credentials) to administer the account and fulfill contractual services. Legal Basis: Art. 6(1)(b) GDPR.
(2) Social Login / Single Sign-On (Google & Microsoft): Alternatively, users may register or authenticate via third-party OAuth Single Sign-On providers ("Sign in with Google" by Google Ireland Limited or "Sign in with Microsoft" by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). When utilizing social login, your browser connects directly to the authentication servers of the respective identity provider. The provider authenticates your identity and transmits your verified email address, name, and unique user identifier to Viewnamic to create or link your account. No passwords are exchanged. Legal Basis: Art. 6(1)(b) GDPR (Contract execution) or Art. 6(1)(f) GDPR (Convenient and secure user authentication).
(3) System & Transactional Notifications (Brevo): Critical transactional messages (e.g., account activation, password resets, plan invoices) are delivered via the email infrastructure of Brevo (Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin, Germany). Legal Basis: Art. 6(1)(b) GDPR.
(4) Payment Processing (Stripe): For electronic card and SEPA transactions, billing information is handled directly through the certified payment service provider Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. Viewnamic does not store complete credit card numbers. Legal Basis: Art. 6(1)(b) GDPR (Payment execution) and Art. 6(1)(c) GDPR (Statutory fiscal and accounting duties).
10. Processing of Customer Content (Data Processing on Behalf / Art. 28 GDPR)
Viewnamic allows commercial Customers to upload PDF files, videos, 3D assets, and interactive elements. These materials may contain personal data. To the extent Viewnamic hosts, converts, and delivers such content on behalf of our Customers, Viewnamic acts as a Data Processor pursuant to Art. 28 GDPR.
The respective Customer remains the sole Data Controller responsible for ensuring lawful processing grounds and copyright compliance. We conclude a standardized Data Processing Agreement (DPA / AVV) with our enterprise Customers.
11. Viewnamic Document Viewer & Interaction Analytics
When readers access a published interactive document via an individual project URL or website embed, our web viewer renders the presentation and records aggregated performance metrics for the publisher:
- No Third-Party Advertising Trackers: The Viewnamic viewer does not contain commercial ad-network cookies, marketing tracking pixels, or cross-site profiling beacons. Readers are not tracked across unrelated websites.
- Randomized Session Identifier: The viewer assigns a randomized, project-specific session identifier to group interactions occurring during a single document visit without creating personal cross-site profiles.
- Interaction Metrics: We collect metrics including pages viewed, scroll progression, viewing duration, video plays, 3D object interactions, link clicks, and downloads.
- No Permanent IP Storage: IP addresses are processed in volatile memory solely for network transmission and server defense. Complete IP addresses are not permanently stored as a queryable metric in the document analytics database.
- Retention Period: Detailed session-level interaction telemetry is stored for a maximum period of twelve (12) months before automated permanent deletion or irreversible aggregation into statistical sums.
Legal Basis: Where Viewnamic provides these analytics for a B2B publisher, processing is carried out on the publisher's behalf under the DPA. Access to local terminal storage is limited strictly to technically necessary session tokens pursuant to Section 25(2) No. 2 TDDDG.
12. Your Rights as a Data Subject
Under statutory provisions of the GDPR, you have the right to access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), withdrawal of consent (Art. 7(3) GDPR), and objection to processing based on legitimate interests (Art. 21 GDPR).
To exercise any of your rights, please submit an informal notification via email to: felix.dreher@viewnamic.com.
13. Competent Supervisory Authority
You have the right to lodge a formal complaint with a data protection supervisory authority pursuant to Art. 77 GDPR if you consider that the processing of personal data relating to you infringes the GDPR. The supervisory authority with primary jurisdiction over Viewnamic is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2–4, 40213 Düsseldorf, Germany
Website: https://www.ldi.nrw.de
14. Data Security and Updates
(1) SSL/TLS Encryption: For security reasons and to protect the transmission of confidential information, our platform utilizes end-to-end TLS encryption (HTTPS). You can identify an encrypted connection by the "https://" protocol and the lock icon in your browser URL bar.
(2) Updates: We reserve the right to modify this Privacy Policy to ensure continuous alignment with statutory requirements and platform enhancements. The current version is always accessible at viewnamic.com/privacy.
