Privacy policy

Last updated: October 2026

1. Controller

Vostura GmbH
Residenzstraße 25
13409 Berlin
Germany
Email: info@vostura.com

For questions about data protection, please contact us at info@vostura.com.

2. General

We process personal data only in accordance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG). This privacy policy explains the nature, scope and purpose of the processing when you visit this website.

3. Hosting and server log files

This website is hosted by Lovable Labs Sweden AB, Regeringsgatan 25, 111 53 Stockholm, Sweden. When you access the website, technically necessary data is processed: IP address, date and time, page accessed, referrer URL, and browser and operating system information. This processing serves to deliver the website and keep it secure. The legal basis is Art. 6(1)(f) GDPR.

Fonts are loaded from our own server. No connection to Google Fonts is established.

4. Cookies and consent management

We only use cookies and similar technologies where they are strictly necessary to operate the website (Section 25(2) no. 2 TDDDG) or where you have given your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR).

We obtain your consent via HubSpot's cookie banner, where you can choose by category, for example whether to allow analytics cookies. We store your choice in the cookie __hs_cookie_cat_pref or __hs_opt_out for six months so that the banner does not reappear on every visit. To protect against bots, the cookie __cf_bm (30 minutes) may be set. Your choice applies to our product sites pony.vostura.com, cocat.vostura.com, condasync.vostura.com and parrot.vostura.com.

You can change or withdraw your consent at any time via the "Cookie settings" link in the footer of every page. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

5. Contact form (HubSpot)

For our contact form we use HubSpot, a service of HubSpot Ireland Ltd., Dublin, Ireland (parent company: HubSpot, Inc., USA). The form is loaded from HubSpot's servers, which transmits your IP address to HubSpot.

When you submit the form, we process the information you provide (first name, last name, company, phone number, email address and your message) to handle your request and contact you. The legal basis is Art. 6(1)(b) GDPR where your request relates to a contract, and otherwise Art. 6(1)(f) GDPR (our interest in answering enquiries).

The data is stored in data centres in the EU. We have concluded a data processing agreement with HubSpot. We delete your data once it is no longer required to handle your request, unless statutory retention obligations apply.

6. HubSpot tracking (only with consent)

If you allow analytics cookies, we use HubSpot's tracking code. It records which pages you visit and where you came from. If you later submit our contact form, this information is linked to your request. For this purpose the cookies __hstc and hubspotutk (six months each), __hssc (30 minutes) and __hssrc (until the end of the session) are set.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

7. Google Analytics 4 (only with consent)

If you allow analytics cookies, we use Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Without your consent, Google Analytics is not loaded (Google Consent Mode).

Google Analytics records, among other things, the pages viewed, time spent, origin of the visit, approximate location, device and browser, as well as interactions such as clicks on buttons and the contact form becoming visible or being submitted. Form contents are not transmitted to Google. According to Google, for users in the EU your IP address is only used to determine your approximate location and is not stored. The cookies _ga and _ga_<ID> are set with a lifetime of up to two years. The collected data is deleted automatically after 14 months.

A transfer to Google LLC in the USA cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework. We have concluded data processing terms with Google.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

8. YouTube videos

On some pages we embed videos from YouTube, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Videos are only loaded when you click on the placeholder. Only then is a connection to YouTube established; data such as your IP address is transmitted to Google, and YouTube may use cookies or similar technologies. We use the privacy-enhanced mode (youtube-nocookie.com).

The legal basis is your consent given by clicking (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). For more information, see Google's privacy policy: https://policies.google.com/privacy

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). Where we process data on the basis of Art. 6(1)(f) GDPR, you may object to the processing (Art. 21 GDPR). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3) GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, Germany.