Privacy policy

CONVIEN GmbH
Balanstraße 71a
81541 Munich
Germany

Phone: +49 800 2668436
Email: info@convien.com
More details in the imprint.

We are not required to appoint a data protection officer (Art. 37 GDPR, § 38 BDSG). You can reach us with any data protection question at info@convien.com.

Our website is aimed at businesses. We process personal data only as far as needed for the purposes described. We rely on these legal bases:

• Art. 6(1)(a) GDPR: your consent, for example for functional content such as videos, or for web analytics. Together with § 25(1) TDDDG where information is stored on or read from your device.
• Art. 6(1)(b) GDPR: performance of a contract or pre-contractual steps at your request, for example a free trial, a demo request or an offer request.
• Art. 6(1)(c) GDPR: legal obligations, for example retention under tax and commercial law.
• Art. 6(1)(f) GDPR: our legitimate interests, for example a secure and stable website, protection against abuse and managing business relationships.
• § 25(2) no. 2 TDDDG: storage on and access to your device where strictly necessary for a service you asked for.

Our website is hosted by Vercel Inc., USA. Server functions run in Frankfurt am Main; static content is delivered through Vercel's worldwide network.

Whenever a page is requested, Vercel processes technically necessary data: IP address, date and time, the requested address, referrer, browser and operating system, and the status code. The purpose is to deliver the website, keep it secure and analyse errors. The legal basis is Art. 6(1)(f) GDPR. The log files are deleted after 30 days at the latest.

We have signed a data processing agreement with Vercel. For transfers to the USA, Vercel is certified under the EU-US Data Privacy Framework; standard contractual clauses apply in addition.

We manage the website's content with Storyblok (Storyblok GmbH, Linz, Austria), stored in the EU. Visiting the website sends none of your data to Storyblok; we deliver images from our own domain. Storyblok processes only the data of our editors.

On your first visit we ask which optional services you allow. Before you decide, we load only necessary services. You can choose "Accept all" or "Reject all", or set individual categories, and change or withdraw your choice at any time via "Cookie settings" in the footer. Withdrawal applies to the future.

We store the chosen categories, a random ID, the version of the consent text and the time, so we can demonstrate your consent (Art. 7(1) GDPR). The website's language comes from the address; we set no cookie for it.

When you book a demo, contact sales, ask us to email you times or write to us, we process your name, business email address, company, optionally your number of meetings per year, your interest (for example the calculation you looked at, or your industry), the page you came from and campaign parameters (UTM). The purpose is to answer your request and prepare a possible contract. The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for managing the business relationship.

We store the details in our CRM, HubSpot (HubSpot Ireland Ltd., Dublin, Ireland). This may involve transfers to HubSpot Inc. in the USA; HubSpot is certified under the Data Privacy Framework, and standard contractual clauses apply in addition. Together with your details we store the privacy notice text, its version and the time.

When you request a free trial, we process your business email address, name, company and, if you give it, the number of attendees of your next meeting, as well as your language, the page you came from and campaign parameters (UTM). We do not accept addresses from personal email providers. The purpose is to set up your trial and contact you about it. The legal basis is Art. 6(1)(b) GDPR.

We store the details in HubSpot (see above), together with the privacy notice text, its version and the time. We set up the trial by hand in our application and enter your name, email address and company there. The privacy information of the application applies to its use.

We send transactional emails, such as access details, confirmations and the trial tips, through Resend (Resend Inc., USA). This involves your email address, your name and the content of the email. The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for the trial tips. The emails are sent from the EU (Ireland). For transfers to the USA, Resend is certified under the EU-US Data Privacy Framework; standard contractual clauses apply in addition.

After a demo request we propose a date by email within one business day. For this we use the details from your request (see above); no external calendar service is used.

For several calculations, more dates, API, white label and integration for partners we prepare an individual offer. You reach us through "Contact sales", the demo booking form (see above) with the calculation you looked at; we store the request as a contact in HubSpot. If you request a calculation through "Request this offer", we process your name, business email address, company and the chosen calculation (product, attendees, dates, Concierge), store them as a contact, company and deal in HubSpot and confirm the request by email. The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps at your request).

Once the offer is accepted, we issue invoices electronically and payment is by bank transfer. For this we process the company name, billing address, VAT ID and billing contact (Art. 6(1)(b) and (c) GDPR). We keep invoices for eight years (§ 147 AO, § 257 HGB).

Cloudflare Turnstile: we protect our forms with Turnstile (Cloudflare Inc., USA). The script loads only once you interact with a form. Turnstile processes your IP address and browser and device characteristics to detect bots. The legal basis is Art. 6(1)(f) GDPR, and § 25(2) no. 2 TDDDG for access to your device. Cloudflare is certified under the Data Privacy Framework.

Rate limiting: to prevent abuse, we count form submissions per IP address for ten minutes and block duplicate submissions for ten minutes. For this we use Upstash (Upstash Inc., USA), with the database in Frankfurt am Main. The legal basis is Art. 6(1)(f) GDPR.

Our product video is hosted by Vimeo (Vimeo.com Inc., USA). Until you start it, we show only a preview image from our own server and no data goes to Vimeo. The player loads only after your click or your consent to functional services, with the "Do Not Track" setting. Vimeo then receives your IP address and device data and may set cookies. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). For transfers to the USA, Vimeo is certified under the EU-US Data Privacy Framework; standard contractual clauses apply in addition.

With "Ask AI" you can ask ChatGPT, Perplexity, Grok, Claude or Gemini about Convien. These are plain links that open in a new tab. The address carries only our fixed question ("Create a short summary with the most important benefits of Convien."), no personal data. For Gemini we copy the question to your clipboard. The links to LinkedIn (company page, sharing posts) are plain links without a plugin too. Only when you follow a link does the provider process data, under its own responsibility.

If you ask to be notified when our AI connector is ready, we process your business email address, company and the AI assistant you use, to let you know. The legal basis is Art. 6(1)(b) GDPR. We store the details in HubSpot and confirm them by email (see above).

The following services load only with your consent in their category, and only if we have switched them on. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can withdraw at any time via "Cookie settings"; we then delete these services' cookies on our domain.

HubSpot tracking (Analytics), HubSpot Ireland Ltd., Dublin: records the pages visited and connects your visits with enquiries you send us through our forms. Cookies __hstc, hubspotutk, __hssc, __hssrc (up to 13 months). We also use HubSpot to see which steps (such as the free trial, a demo booking or an offer request) happen on the website.

Vercel Web Analytics (Analytics), Vercel Inc., San Francisco, USA: counts page views, referring pages, country, device and browser, without cookies. Vercel recognises a visit only on the same day, through a hash of the request that is discarded after 24 hours; IP addresses are not stored. Data may be transferred to the USA (EU-US Data Privacy Framework).

Vercel Speed Insights (Analytics), Vercel Inc., San Francisco, USA: measures how fast our pages load and respond (Core Web Vitals), together with the page visited, country, device type, browser and operating system, without cookies. We see only aggregated values, not individual visits; IP addresses are not stored. Data may be transferred to the USA (EU-US Data Privacy Framework).

We use the following service providers. Where they act on our behalf, we have signed data processing agreements under Art. 28 GDPR with them. Transfers to countries outside the EU are based on an adequacy decision (EU-US Data Privacy Framework, Art. 45 GDPR) or on standard contractual clauses (Art. 46(2)(c) GDPR).

We delete personal data as soon as the purpose ends, unless a legal retention obligation applies. In detail:

• Server log files: 30 days at the most
• Requests and contacts without a contract: 24 months after the last contact
• Rate limiting: ten minutes; booking markers: 24 hours
• Cookie consent: six months
• Invoices and accounting vouchers: eight years, books and annual financial statements: ten years, business letters: six years (§ 147 AO, § 257 HGB)

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent with effect for the future (Art. 7(3) GDPR).

Right to object: where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). You can object to processing for direct marketing at any time without giving reasons (Art. 21(2) GDPR).

Just write to us at info@convien.com.

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de (opens in a new tab).

You are not obliged to provide us with data. Without the fields marked as required, however, we cannot process your request, trial or order. We do not use automated decision-making, including profiling, under Art. 22 GDPR.

We update this privacy policy when our website or the law changes. The version published here applies. Status: version 0.3 (draft), 29 October 2026.