Last updated: 20 October 2026. In case of doubt, the German version applies.
1. Controller
Patrick Herbke (VIABLE)
Eginhardstr. 6, 10318 Berlin, Germany
Email: patrick@viable-id.com
No data protection officer has been appointed, as there is no legal obligation to do so.
2. Principles
We process personal data only insofar as this is necessary to operate this website, to answer your enquiries or to improve our offering. This website sets no tracking cookies, embeds no advertising networks and loads no third-party content (no external fonts, videos or social media plug-ins). The connection is encrypted with TLS.
3. Hosting and server log files
The website is operated on servers of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, in data centres in Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with IONOS.
When you access the website, the web server processes technically necessary data: IP address, date and time, page requested, amount of data transferred, browser and operating system, and the previously visited page. The purpose is to deliver the website, to fend off attacks and to analyse errors. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation). Log files are deleted after no more than 14 days.
4. Audience measurement with Umami
For statistical analysis of usage we use the open-source software Umami, which we operate ourselves on our server in Germany. No data is transferred to third parties.
Umami sets no cookies and stores nothing on your device. It records: pages viewed, the previously visited website, campaign parameters in links (e.g. utm_campaign), country (derived from the IP address), device type, browser, operating system, screen size and language setting. Your IP address is not stored; it is used only briefly to determine the country and to form an anonymous identifier that changes daily. Recognition across several days or attribution to you as a person is therefore not possible.
The purpose is to understand which content is read and through which channels visitors find us. The legal basis is Art. 6(1)(f) GDPR. As your device is not accessed, no consent under Section 25 TDDDG is required. Statistical data is deleted after 24 months.
If you enable “Do Not Track” in your browser or use a content blocker, no measurement takes place.
5. Contact form and email
If you write to us via the contact form or by email, we process the information you provide (name, email address, company, topic, message) and, to protect against misuse, your IP address and browser identifier. The purpose is to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract or a pilot project, and otherwise Art. 6(1)(f) GDPR.
Form submissions are sent via the email service of STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, and received in our mailbox at Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Workspace). Data processing agreements are in place with both providers. A transfer to the USA cannot be ruled out with Google; Google is certified under the EU-US Data Privacy Framework.
We store enquiries for as long as necessary to handle them and for possible further cooperation, and delete them no later than 2 years after the last contact, unless statutory retention obligations apply.
6. Customer relationships (CRM)
We manage contact details of prospects and business partners in a self-hosted CRM system on our server in Germany. The legal basis is Art. 6(1)(b) or (f) GDPR (maintaining business relationships).
7. Storage in your browser
We store your language selection and the fact that you have seen our privacy notice in your browser’s local storage (localStorage). This information does not leave your device and serves only to display the website in your language and not to show the notice again. The legal basis is Section 25(2) No. 2 TDDDG.
8. Demo applications
Our demo applications (e.g. aviation, HR, issuer/verifier) process only test data that you enter yourself. This data is deleted after 30 days. Please do not enter real identity document or health data in the demos.
9. Links to social networks
Our website links to our LinkedIn profile. These are simple links; data is only transferred when you click the link and open the provider’s page.
10. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR (Art. 21). To exercise these rights, simply contact patrick@viable-id.com.
You can also lodge a complaint with a data protection supervisory authority, for example the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin.
11. Changes
We update this privacy policy when our website or the legal situation changes. The version published here applies.