Privacy Policy
Effective Date: 9/03/2026 | Last Updated: 9/03/2026
At AveThera GmbH ("AveThera", "we", "our", or "us"), protecting personal data is an important part of our commitment to integrity, transparency, and responsible business practices. As a biopharmaceutical manufacturing company operating in Germany, we recognize the importance of safeguarding personal data while maintaining compliance with applicable legal, regulatory, and quality requirements.
This Privacy Policy explains how we collect, use, store, share, and protect personal data when you visit our website, communicate with us, apply for employment opportunities, engage with us as a customer or supplier, or otherwise interact with AveThera.
Our data processing activities are conducted in accordance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), the German Telecommunications Digital Services Data Protection Act (TDDDG), and other applicable laws governing privacy, data protection, and business operations within Germany and the European Union.
Who Is Responsible for Processing Your Data
The controller responsible for processing personal data collected through this website is: AveThera GmbH
Neuendorfstraße 18b 16761, Hennigsdorf, Germany
Phone: +49 3302 559500 Email: info[at]avethera.com
You may contact us at any time regarding questions about this Privacy Policy or the processing of your personal data.
Information We Collect
We only collect personal data that is provided by you. The information we collect depends on how you interact with our website and services.
When you contact us through our website, email, telephone, or other communication channels, we may collect information such as your name, company affiliation, job title, email address, telephone number, country of residence, and any information you choose to include in your message.
If you apply for a position at AveThera, we may collect information contained within your application materials, including your curriculum vitae, educational qualifications, professional experience, certifications, references, and any additional information you voluntarily provide during the recruitment process.
When you visit our website, certain technical information may be collected automatically. This may include your IP address, browser type, operating system, device information, pages visited, referral sources, and general website usage data. Such information helps us maintain website security, improve user experience, and ensure reliable operation of our digital services.
In the course of business activities, we may also collect professional contact information relating to customers, suppliers, partners, contractors, investors, regulatory authorities, consultants, and other stakeholders with whom we maintain business relationships.
Why We Process Personal Data
AveThera processes personal data for the following purposes based on the following legal bases.
Automated Collection of Log Data and Server Log Files
When you access our website, we process technical log data. We process this technical log data to ensure a smooth connection to the website. We also store the technical log data in the form of so-called log files to ensure the security and stability of the website. The log data or log files include the following data: IP address of the requesting computer, date and time of access, name and URL of the retrieved file, website from which access is made (referrer URL), browser used and, if applicable, the operating system of your computer and the name of your access provider. Log files are generally stored for 7 days and then automatically deleted.
The processing of your data for the above-mentioned purposes is carried out to protect our legitimate interests in ensuring the security and functionality of the website and the functions provided there. The legal basis for the processing of your data is Art. 6(1)(f) GDPR.
Contact
We use personal data to the extent necessary to respond to inquiries and provide the requested information if you decide to contact us via the contact options provided on our website (including by email, online contact form). If you use our contact form, this may include the following information: name, email address, telephone number, discussion topic and any further information you provide to us as part of the message. If you contact us via email, we process the information you provide to us such as your email address and the content of the email. The processing of your personal data serves our legitimate interest in properly handling your inquiry. The legal basis is Art. 6(1)(f) GDPR.
In many cases, processing is necessary to take steps prior to entering into a contract or to fulfill contractual obligations. This includes responding to business inquiries, evaluating partnership opportunities, processing employment applications, and managing commercial relationships. In case you contact us as our (potential) contractual partner, the processing of your personal data is necessary for the initiation or execution of a contractual relationship with you; the legal basis for processing is Art. 6(1)(b) GDPR. If, on the other hand, you are a contact person of our (potential) contractual partner, we process your personal data for the purpose of and based on our legitimate interest in initiating or executing a contract with our (potential) contractual partner; the legal basis for processing is Art. 6(1)(f) GDPR.
Applications
You may apply for advertised positions with us by sending your application via email. As part of the application process, we process the following personal data that you provide to us. The processing of your application data is carried out for the purpose of conducting the application procedure and deciding on the establishment of an employment relationship. The legal basis for processing is Art. 6(1)(b) GDPR.Legal Obligation and Defense Against Legal Claims Certain processing activities are required to comply with legal obligations, including obligations arising under tax law, employment law, corporate law, pharmaceutical regulations, quality management requirements, and other applicable legal frameworks. This may include transferring personal data to relevant authorities. We may process your personal data to the extent required by law pursuant to Art. 6(1)(c) GDPR.
Where necessary, we process your personal data to the extent required to exercise any legal claims or to defend against claims. This processing is based on our legitimate interest in the effective exercise or defense of rights and is based on the legal basis of Art. 6(1)(f) GDPR. This may include disclosing information to lawyers and other professional advisors for the purpose of obtaining legal advice, pursuing or defending legal proceedings, or exercising or protecting our legal rights and interests.
Newsletter
If you subscribe to our newsletter, we process your email address and, if provided, your name for the purpose of sending you regular information about our company, products, services, and relevant industry developments. Subscription to the newsletter is voluntary and requires your explicit consent. The legal basis for the processing of your data in connection with the newsletter is Art. 6(1)(a) GDPR. You can unsubscribe from the newsletter at any time by clicking on the unsubscribe link included in each newsletter or by contacting us directly. Upon unsubscription, your email address will be deleted from our distribution list.
Tracking and Analysis
Cookies and Similar Technologies
Our website may use cookies and similar technologies to provide essential functionality, improve website performance, analyze traffic, and enhance user experience. Cookies are small text files that are stored on your device when you visit the website. They enable certain information to be stored on the device and access to information already stored there (e.g. your language settings or login data). Depending on the stored or retrievable information, cookies enable the identification of the user of the website.
Certain cookies that we use are automatically deleted at the end of the browser session, i.e. after you close your browser (so-called session cookies). Other cookies remain on your device and enable us to recognize your browser on your next visit (so-called persistent cookies).
We use the following types of cookies on our website:
Strictly Necessary Cookies: These cookies are necessary for website functionality, security and management of cookie preferences. They cannot be deactivated. The legal basis for the use of strictly necessary cookies is Art. 6(1)(f) GDPR, Section 25(2) No. 2 TDDDG.
Functional/Preference Cookies: These cookies are used to remember user preferences, such as language or region, where applicable. They are only set with your consent. The legal basis is Art. 6(1)(a) GDPR, Section 25(1) TDDDG.
Analytics/Performance Cookies: These cookies are used to understand website traffic and how visitors interact with the website. They are only set with your consent. The legal basis is Art. 6(1)(a) GDPR, Section 25(1) TDDDG.
Marketing/Advertising Cookies: These cookies are applicable only where advertising, remarketing or campaign tracking technologies are used. They are only set with your consent. The legal basis is Art. 6(1)(a) GDPR, Section 25(1) TDDDG.
You may manage your cookie preferences through our cookie consent platform or through your browser settings. Please note that disabling certain cookies may affect the functionality of parts of the website.
Cookie Consent Management Tool
We use a cookie consent management tool to obtain, document, and manage your consent to the use of cookies and similar technologies on our website. The consent management tool processes information regarding your consent decisions (in particular the categories of cookies accepted or rejected), the time of your decision, technical information about your browser and your IP address (in anonymized form) for the purpose of providing evidence of consent. The legal basis for the use of the consent management tool is Art. 6(1)(f) GDPR. The processing serves our legitimate interest in managing consents in a legally compliant manner according to our legal obligation to demonstrate consent.
Google Tag Manager
We use Google Tag Manager on our website. Google Tag Manager is a tag management system that enables us to manage and update tracking codes and associated code fragments (so-called “website tags”) on our website. The provider of Google Tag Manager in the European region is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland. Website tags are small pieces of code that are inserted into a website and can come from various providers (e.g. from providers of analytics and marketing services). These website tags make it possible to record actions performed by users (e.g. clicking a button or an ad, visiting a specific page). Google Tag Manager enables us to integrate these website tags on our website and define the actions to be recorded. When a tag is triggered by an action, the data recorded by the tag is transmitted to the analytics or marketing services integrated via Google Tag Manager. Google Tag Manager itself does not create any user profiles and does not perform any independent evaluations. Google Tag Manager collects data as part of standard HTTP request logging. These are deleted within 14 days of receipt. Google also collects aggregated data on tag triggering to monitor system stability, performance and installation quality. This aggregated data does not contain any addresses or measurement IDs that can be attributed to a specific person. In addition, we have activated the Conversion Linker in Google Tag Manager. This is a special website tag that serves to measure click data so that conversions can be effectively recorded. Specifically, information about clicking behavior in relation to (advertising) ads is collected and stored. The use of Google Tag Manager is based on your consent pursuant to Art. 6(1)(a) GDPR.
Google Analytics
We use Google Analytics on our website. We use Google Analytics to track the use of our website and the functions and services provided there and to derive which functions and services are of particular interest to users and how we can improve the website. The provider responsible for the operation of Google Analytics in the European region is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland. During your visit to the website, your user behavior is recorded in the form of “events”. Events can include: page views, first visit to the website, start of session, your “click path”, interaction with the website, scrolls (whenever a user scrolls to the bottom of the page (90%)), clicks on external links, internal search queries, interaction with videos, file downloads, ads viewed/clicked, language setting. In addition, the following data is collected: your approximate location (region), your IP address (in truncated form), technical information about your browser and the devices you use (e.g. language setting, screen resolution, device model), your internet service provider, the referrer URL (via which website/advertising medium you came to this website). Google Analytics uses cookies that enable an analysis of your use of our website. The information collected by means of cookies about your use of this website may be transferred to and stored on a Google server in the USA. Google LLC is certified under the EU-US Data Privacy Framework (DPF). Google Analytics 4 has IP anonymization by default. IP address data is only used to derive location data (e.g. city, region, country) and is then immediately deleted. Through IP anonymization, your IP address is truncated by Google within member states of the EU or in other contracting states to the Agreement on the European Economic Area (EEA). Google processes the above information to evaluate your use of the website and to compile reports on website activity for us. The reports provided to us by Google Analytics serve to analyze the performance of the website. The use of the service is based on your consent. The legal basis for the processing of personal data in connection with the use of Google Analytics is Art. 6(1)(a) GDPR. You can revoke your consent at any time by deactivating the use of the service in the “Cookie settings”. You can also prevent the collection of data generated by the cookie and related to your use of the website to Google as well as the processing of this data by Google by downloading and installing the browser add-on provided by Google to disable Google Analytics: https://tools.google.com/dlpage/gaoptout?hl=en
Google Maps
We use the Google Maps mapping service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (“Google”) on our website. When you access a page that contains Google Maps, a connection to Google’s servers is established upon your consent. In doing so, certain data — including your IP address, location data, and information about your visit to our website — is transmitted to Google. Google may also place cookies on your device. When Google Maps is used, personal data may be transferred to Google servers in the United States.
Google LLC is certified under the EU-U.S. Data Privacy Framework (DPF), for which the European Commission has issued an adequacy decision pursuant to Art. 45 GDPR. Legal basis for this data processing is your consent pursuant to Art. 6(1)(a) GDPR.
For further information on how Google handles user data, please refer to Google’s Privacy Policy: https://policies.google.com/privacy.
Embedding of YouTube Videos
We use YouTube to embed videos on our website so that we can present relevant video content to you directly. YouTube is a video platform operated by YouTube, LLC, 901 Cherry Ave, San Bruno, CA 94066, USA. As part of the Google Group, the controller responsible for processing personal data in connection with the use of YouTube in the European Economic Area is Google Ireland Limited, Gordon House, Barrow St, Dublin 4, D04 E5W5, Ireland.
Before any YouTube video embedded on our website is loaded, you need to activate such video by providing your consent via the cookie-banner. Once the video is activated, your browser automatically connects to YouTube’s servers and various data are transmitted by placing cookies. This includes your IP address, the URL of our website, session duration, bounce rate, approximate geographic location, technical information such as browser type, screen resolution or your internet provider.
Additionally, all YouTube videos embedded on our website use the “Privacy Enhanced Mode”. This means that YouTube serves the embedded player via the domain “youtube-nocookie.com” for the embedded player, which prevents cookies from being placed on your device when you merely load the page containing the video. Once you activate and play a video, data (including your IP address) will still be transferred to YouTube/Google servers. When Privacy Enhanced Mode is enabled, the viewing of an embedded player will not be used to personalize the YouTube browsing experience, either within your Privacy Enhanced Mode embedded player or in the viewer’s subsequent YouTube viewing experience. If ads are served on a video shown in the Privacy Enhanced Mode of the embedded player, those ads will likewise be non-personalized. In addition, the view of a video shown in the Privacy Enhanced Mode of the embedded player will not be used to personalize advertising shown to the viewer outside of our website.
If you are logged into your Google account in the same browser while watching an embedded video, Google may associate the data collected with your user profile.
The use of YouTube involves the transfer of personal data to Google’s servers located in the United States. To the extent that data is transferred to the United States or other third countries, we base the transfer on the EU Standard Contractual Clauses (SCCs) and, additionally, on the certification of Google LLC under the EU-U.S. Data Privacy Framework. For further information on data protection at Google/YouTube, please refer to Google’s privacy policy at https://policies.google.com/privacy.
The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. Further information on data processing by Google is available here: https://support.google.com/google-ads/answer/1722022 and https://business.safety.google/privacy
Sharing of Personal Data with Third Parties
AveThera does not sell personal data to third parties.
We may share personal data with carefully selected service providers who assist us in operating our website, managing information technology systems, supporting recruitment activities, providing cloud infrastructure, conducting security monitoring, or performing other business-related services. In particular, we share your personal data with the following recipients: Google Ireland Limited and Google LLC as providers of Google Tag Manager, Google Analytics and Google Maps as set out above; We may also disclose information to professional advisors such as lawyers, auditors, accountants, and consultants where necessary for legitimate business purposes as set out above.
In certain circumstances, information may be disclosed to regulatory authorities, government agencies, courts, law enforcement bodies, or other competent authorities where required by law or necessary to protect legal rights and interests as set out above. Should AveThera undergo a merger, acquisition, restructuring, financing transaction, or similar corporate event, personal data may be transferred as part of that transaction subject to appropriate safeguards based on our legitimate interest pursuant to Art. 6(1)(f) GDPR in the execution of the relevant corporate event.
International Data Transfers
Although AveThera primarily operates within Germany and the European Union, some service providers or business partners may be located outside the European Economic Area. We transfer personal data to service providers and recipients in countries outside the EU/EEA (so-called third countries) to the extent necessary for the purposes set out in this Privacy Notice.
Where personal data is transferred internationally, we take appropriate measures to ensure an adequate level of protection. This means that your data will only be transferred to the extent that European Commission Standard Contractual Clauses, adequacy decisions, or other safeguards recognized under GDPR are in place.
Specifically, in connection with the use of the Website, your data is transferred to the following recipients who process your data in a third country: Google LLC, in connection with Google Tag Manager, Google Maps and Google Analytics subject to the DPF mentioned above.
Data Retention
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected and to satisfy legal, regulatory, contractual, and operational retention requirements.
The retention period may vary depending on the nature of the information and the applicable legal obligations. For example, employment application records, contractual documents, financial records, quality documentation, and regulatory records may be retained for different periods based on applicable laws and business requirements. Where information is no longer required, it will be securely deleted or anonymized in accordance with our data retention procedures.
Information Security
Protecting information is a fundamental component of AveThera’s operational and quality culture. We maintain technical and organizational safeguards designed to protect personal data against unauthorized access, disclosure, alteration, misuse, loss, or destruction. These safeguards may include access controls, encryption technologies, security monitoring, backup procedures, network protection measures, employee training programs, confidentiality obligations, and regular reviews of our security practices.
While no system can guarantee absolute security, AveThera continually evaluates and improves its security measures to align with industry best practices and regulatory expectations.
Obligation to Provide Personal Data
You are neither legally nor contractually obliged to provide us with personal data.
When using the website, your browser automatically transmits log data (see section on Automated Collection of Log Data and Server Log Files). Without this technical data, it is not possible to access the website. Otherwise, you are only asked to provide the data necessary for the provision of our functions and services on the website.
Your Rights
Depending on your location and applicable law, you may have rights regarding your personal data. With regard to the processing of your personal data, you have the following rights:
- the right of access (Art. 15 GDPR),
- the right of rectification (Art. 16 GDPR),
- the right to erasure (Art. 17 GDPR),
- the right to restriction of processing (Art. 18 GDPR),
- and the right to data portability (Art. 20 GDPR).
You may withdraw any consent you have given at any time with effect for the future pursuant to Art. 7(3) GDPR. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before withdrawal.
You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR).
To the extent that we base the processing of your personal data on a legitimate interest pursuant to Art. 6(1)(f) GDPR, you may object to the processing. Further information is provided below:
Special information on your right to object under Art. 21 GDPR
You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you on the basis of Art. 6(1)(f) GDPR (processing of personal data on the basis of a balancing of interests); this also includes profiling based on these provisions (Art. 4(4) GDPR).
If you object to the processing, we will stop processing the personal data concerning you unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
You also have the right to object at any time to the processing of your personal data for advertising purposes; this also applies to profiling insofar as it is connected with advertising (where applicable). If you object to processing for advertising purposes, we will stop processing your personal data for these purposes.
The objection is not subject to any particular form. Ideally, it should be sent by email to the contact specified in Section “Who Is Responsible for Processing Your Data”.
To exercise any of these rights, please contact us using the details provided in this Privacy Policy. We may request information necessary to verify your identity before responding to your request.
Automated Decision-Making
AveThera does not make decisions based solely on automated processing that produce legal or similarly significant effects on individuals unless permitted by law and subject to appropriate safeguards.
Children's Privacy
Our website and services are intended for business, professional, and scientific audiences. We do not knowingly collect personal data from individuals under the age of 18.
Changes to This Privacy Policy
AveThera may update this Privacy Policy from time to time to reflect changes in legal requirements, business practices, technologies, or services. Updated versions will be posted on this website together with the revised effective date.
Contact Us
If you have questions regarding this Privacy Policy or the processing of personal data, please contact: AveThera GmbH
Neuendorfstraße 18b, 16761 Hennigsdorf, Germany
Email: info[at]avethera.com
Phone: +49 3302 559500