Privacy Policy

The party responsible for data processing on this website is:

Apirion GmbH
Cuvilliésstraße 25
81679 München
Deutschland

Phone: [phone number, add before launch]
Email: contact@apirion.com

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of processing personal data.

We host the content of this website with Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located in Germany. Details are set out in Hetzner’s privacy policy at hetzner.com/de/legal/privacy-policy.

Hetzner is used on the basis of Art. 6 (1) (f) GDPR. We have a legitimate interest in the reliable presentation of our website.

A data processing agreement under Art. 28 GDPR is in place with the provider.

Backup copies of the website are stored, in encrypted form, in our Microsoft 365 environment. Further detail is given in the section on email infrastructure.

When you visit this website, the web server automatically records technical access data in log files: the IP address of the requesting device, the date and time of the request, the page or file requested, the referring page, the browser type and version, and the operating system. This data is not merged with other data sources and is not used to identify individual visitors.

The legal basis is Art. 6 (1) (f) GDPR. The legitimate interest lies in the secure and stable operation of the website and in the detection and defense of attacks. Log files are deleted after 14 days, unless a specific incident requires longer retention as evidence.

Our website uses cookies. Cookies are small data packets and do no harm to your device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (persistent cookies). Session cookies are deleted automatically at the end of your visit; persistent cookies remain until you delete them or your browser deletes them automatically.

This website sets technically necessary cookies only. These include a language cookie, which stores the language version you have chosen so that the site is shown to you in the same language on subsequent visits. This cookie is stored for a period of one year.

Technically necessary cookies, required to carry out the electronic communication process or to provide functions you have requested, are stored on the basis of Art. 6 (1) (f) GDPR. Their storage is exempt from the consent requirement under § 25 (2) no. 2 TDDDG.

This website sets no analytics, marketing or profiling cookies.

We use Matomo, an open-source web analytics tool, on our own web space with our hosting provider (a data processor). Data is not shared with third parties and is not processed outside the EU.

Matomo runs without cookies. A script reads technical characteristics of your browser for this purpose; nothing is stored on your device for the measurement. We record the time of your visit, the pages viewed, the referring page, your browser and its language, operating system, device type, screen resolution, and an IP address shortened by two bytes, from which only an approximate location can be derived. To group page views into a visit, Matomo creates a technical identifier from this data that changes daily. We do not create visitor profiles and analyze only aggregated data. Raw data is deleted after six months.

The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is improving the content and structure of the website.

You can object to this measurement using the option below. Your browser will then store a cookie recording your objection. Matomo also respects your browser’s “Do Not Track” setting.

For a uniform presentation of fonts, this website uses Google Fonts. The fonts are installed locally. No connection to Google’s servers is made when you visit this site. Further information is available at developers.google.com/fonts/faq and in Google’s privacy policy at policies.google.com/privacy.

To protect this website against unauthorized access and attacks, we use a security solution that operates locally on our server only. No personal data is transferred to third parties in the process.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in protecting our website against attacks.

For security reasons and to protect the transmission of confidential content, this website uses SSL/TLS encryption. An encrypted connection is indicated by the browser address line changing from http:// to https:// and by the lock symbol in the browser bar. When SSL/TLS encryption is active, the data you transmit to us cannot be read by third parties.

If you contact Apirion by email, the data you provide, such as your name, your email address and the content of your message, is processed in order to handle your enquiry.

The legal basis is Art. 6 (1) (b) GDPR where the enquiry relates to a contract or its initiation, and Art. 6 (1) (f) GDPR in all other cases, the legitimate interest being the proper handling of correspondence. Enquiry data is deleted once the matter is concluded and no statutory retention duty requires it to be kept.

Our email communication runs through Microsoft 365. This environment is provided and administered on our behalf by PLANET 33 AG, Hofmannstr. 52, 81379 München, Germany.

PLANET 33 holds administrative access rights in order to set up, manage and support our environment. In the course of that work, access to communication data may occur. A data processing agreement under Art. 28 GDPR is in place with PLANET 33, and the provider’s staff are bound to confidentiality.

The technical processing takes place in the Microsoft 365 environment. Microsoft acts as a sub-processor in this respect. Content and communication data is processed within Microsoft’s EU Data Boundary. Further information is available at privacy.microsoft.com/en-us/privacystatement.

The legal basis is Art. 6 (1) (f) GDPR, our legitimate interest being secure and reliable business communication, and Art. 6 (1) (b) GDPR where the communication serves the initiation or performance of a contract.

If you apply to Apirion, whether for a listed position, an internship or on a speculative basis, we process the data contained in your application: contact details, CV, the note accompanying your application, and any further documents you choose to submit.

The legal basis is Art. 6 (1) (b) GDPR and § 26 (1) BDSG, the processing being necessary for the decision on the establishment of an employment relationship.

Your documents are seen only by the people involved in the hiring decision. They are not passed to third parties. If an application does not lead to an offer, the application data is deleted no later than six months after the conclusion of the process, in order to meet obligations under the German General Equal Treatment Act (AGG). If you would like us to keep your application on file beyond that period, we will ask for your consent under Art. 6 (1) (a) GDPR, which you can withdraw at any time.

Please send applications by email to contact@apirion.com. Note that unencrypted email carries a residual risk in transit.

Where you have consented to processing, we process your personal data on the basis of Art. 6 (1) (a) GDPR and, where special categories of data under Art. 9 (1) GDPR are processed, Art. 9 (2) (a) GDPR. Where data is necessary to perform a contract or to carry out pre-contractual measures, we process it on the basis of Art. 6 (1) (b) GDPR. Where processing is necessary to fulfill a legal obligation, the basis is Art. 6 (1) (c) GDPR. Processing may also be based on our legitimate interest under Art. 6 (1) (f) GDPR. The relevant legal basis in each case is stated in the sections above.

Unless a more specific storage period is stated in this notice, your personal data remains with us until the purpose for processing no longer applies. If you assert a justified request for erasure or withdraw your consent, your data is deleted unless we have other legally permissible grounds for storing it, for example statutory retention periods under commercial or tax law. In that case, deletion takes place once those grounds cease to apply.

In the course of our business we work with various external parties. This sometimes requires the transfer of personal data to them. We pass on personal data only where necessary to perform a contract, where we are legally obliged to do so, where we have a legitimate interest under Art. 6 (1) (f) GDPR, or where another legal basis permits it. Where we engage processors, we pass on personal data only on the basis of a valid data processing agreement.

This website itself embeds no services that transfer data to third countries. Web analytics with Matomo runs on our own web space, and fonts are served locally.

For our email communication we use Microsoft 365, engaged as a sub-processor of our service provider. A transfer to the United States cannot be excluded in limited cases. Any such transfer is based on the European Commission’s standard contractual clauses and on the provider’s certification under the EU-US Data Privacy Framework.

Apirion does not use automated decision-making or profiling within the meaning of Art. 22 GDPR, on this website or in its application process.

With regard to your personal data you hold the following rights under the GDPR: the right of access (Art. 15), the right to rectification (Art. 16), the right to erasure (Art. 17), the right to restriction of processing (Art. 18), and the right to data portability (Art. 20).

Where processing is based on your consent, you may withdraw that consent at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected. To exercise any of these rights, contact the controller at the address given above.

Where processing is based on Art. 6 (1) (f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data (Art. 21 (1) GDPR). We will then no longer process your personal data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or of the alleged infringement. The competent authority for our registered office in Munich is the Bavarian State Office for Data Protection Supervision (BayLDA).

We will update this notice when the website or its data processing changes. The version published on this page is the current one.

Last updated: 1 September 2026