Data Privacy

CRYOVASC GmbH takes the protection of personal data seriously. This Data Privacy explains how we collect, use and protect personal data when you visit our website www.cryovasc.com, contact us or otherwise interact with us through this website.

This Data Privacy is intended to comply with the European Union General Data Protection Regulation (GDPR) and applicable German data protection law.

1. Controller

The controller responsible for the processing of personal data in connection with this website is:

Cryovasc GmbH
Lottumstr. 9
10119 Berlin
Germany

Represented by: Dr. Boris Keweloh – Managing Director
Contact: b.keweloh@cryovasc.com

Commercial Register: HRB 224658 B
Registration Court: Amtsgericht Berlin-Charlottenburg, Germany
VAT ID Sales tax identification number according to Sect. 27 a of the Sales Tax Law: DE342986810

If you have any questions regarding this Data Privacy or the processing of your personal data, please contact us using the details above.

2. Scope of this Data Privacy

This Data Privacy applies to personal data processed in connection with:

  • your use of www.cryovasc.com;

  • communications with CRYOVASC;

  • enquiries submitted through our website or contact form;

  • the technical operation and security of the website;

  • website analytics, where enabled; and

  • cookies and similar technologies.

“Personal data” means any information relating to an identified or identifiable natural person.

3. Personal data we process

Depending on how you interact with our website, we may process different categories of personal data.

Website and technical data: When you visit our website, technical information may automatically be transmitted by your browser or device.

This may include:

  • IP address;

  • date and time of access;

  • pages or files accessed;

  • browser type and version;

  • operating system;

  • device information;

  • referring website;

  • language settings; and

  • server, log and diagnostic information.

We process these data to provide the website, maintain its functionality, ensure IT security and stability and prevent misuse.

Contact enquiries: If you contact us through the website, by email or through another communication channel, we may process information such as:

  • first and last name;

  • company, institution or organisation;

  • email address;

  • telephone number;

  • professional role;

  • content of your enquiry;

  • information voluntarily provided by you; and

  • related correspondence.

We use this information to respond to your enquiry and manage our communication with you.

4. No submission of patient or medical data

CRYOVASC develops a medtech device. However, our website and general contact form are not intended for the submission of individual patient information, medical records or other sensitive health data.

Please do not submit information concerning your own or another person's health, diagnosis, treatment or medical history through the general website contact form.

The website does not provide individual medical advice and is not intended as a patient treatment or diagnostic service.

5. Purposes of processing

We process personal data particularly for the following purposes:

  • operating and providing this website;

  • maintaining website and IT security;

  • responding to enquiries;

  • communicating with investors, potential investors, healthcare professionals, scientific collaborators, suppliers, business partners and other interested parties;

  • establishing and managing business relationships;

  • responding to requests concerning our company, technology or development activities;

  • improving the functionality and performance of our website;

  • analysing website usage where permitted;

  • preventing fraud, misuse and security incidents;

  • complying with legal and regulatory obligations; and

  • establishing, exercising or defending legal claims.

We do not sell personal data.

6. Legal basis for processing

Where we process personal data under the GDPR, we rely on one or more of the following legal bases.

Consent – Art. 6(1)(a) GDPR: Where you have given us consent, for example to the use of optional analytics or other non-essential cookies.

Contractual or pre-contractual measures – Art. 6(1)(b) GDPR: Where processing is necessary to respond to an enquiry made in connection with a potential or existing contractual or business relationship.

Legal obligation – Art. 6(1)(c) GDPR: Where processing is necessary to comply with applicable legal obligations.

Legitimate interests – Art. 6(1)(f) GDPR: We may process personal data where this is necessary for our legitimate interests, including:

  • operating and securing our website;

  • communicating with business contacts and interested parties;

  • responding to enquiries;

  • managing investor and business communications;

  • preventing misuse and cyber security incidents; and

  • improving our website and corporate communications.

We only rely on legitimate interests where these interests are not overridden by the interests, fundamental rights or freedoms of the individual concerned.

7. Website hosting and Squarespace

Our website is created and hosted using services provided by Squarespace. Squarespace provides the infrastructure required to host, operate and secure our website.

In connection with these services, Squarespace may process information including:

  • IP addresses;

  • device and browser information;

  • usage and log data;

  • cookie identifiers; and

  • information submitted through website forms.

Depending on the relevant service and processing activity, Squarespace may act as a processor on our behalf or as an independent controller.

We use Squarespace based on our legitimate interest in providing a reliable, secure and professionally operated website pursuant to Art. 6(1)(f) GDPR.

Where processing through Squarespace depends on optional cookies or similar technologies, the processing is carried out on the basis of your consent pursuant to Art. 6(1)(a) GDPR.

Further information on Squarespace's processing of personal data is available in Squarespace's Privacy Policy and Data Processing Addendum.

8. Contact form

Our website provides the possibility to contact CRYOVASC through a contact form.

When you submit a contact form, the information you provide is transmitted to us and may be processed through Squarespace infrastructure and our connected communication systems.

We process these data in order to:

  • respond to your request;

  • communicate with you;

  • establish or manage a potential business relationship; and

  • carry out related administrative activities.

Where your enquiry relates to a potential contractual relationship, the legal basis is Art. 6(1)(b) GDPR.

For other business or general enquiries, processing is generally based on our legitimate interest in responding to enquiries and maintaining business communications pursuant to Art. 6(1)(f) GDPR.

9. Investor and business enquiries

Our website may be used by potential investors, business partners, suppliers, healthcare professionals or other professional contacts to approach CRYOVASC.

Where you contact us in a professional capacity, we may process your business contact details and related communications for the purpose of evaluating and managing the relevant business relationship.

The legal basis is generally Art. 6(1)(b) GDPR where the processing relates to pre-contractual measures and Art. 6(1)(f) GDPR for general business relationship management and corporate communications.

Information relating to fundraising or potential investments submitted through the website does not constitute an offer or acceptance of an investment and is processed only for communication and evaluation purposes.

10. Cookies and similar technologies

Our website uses cookies and similar technologies.

Cookies are small files or pieces of information that may be stored on your device when you visit a website.

We distinguish between essential and optional cookies.

Essential cookies: Essential cookies are necessary for the operation, security or functionality of the website. These cookies may generally be used without separate consent where permitted by applicable law.

Optional cookies: Optional cookies may be used for purposes such as:

  • analytics;

  • performance measurement;

  • website optimisation; or

  • other non-essential functions.

Where consent is required, optional cookies are only used after you have made the relevant selection through our cookie consent banner.

You can accept or reject optional cookies and manage your choices through the cookie settings provided on our website.

Where processing is based on consent, you may withdraw your consent at any time with effect for the future.

Refusing optional cookies will not normally prevent you from accessing the essential functionality of our website.

11. Cookie consent management

When you first access our website, you may be shown a cookie consent banner.

You may choose whether to accept optional cookies or manage your individual cookie preferences.

We may store information about your cookie preferences so that we can respect your selection on subsequent visits.

The processing required to store and demonstrate your cookie preference is based on our legal obligation to comply with applicable consent requirements and our legitimate interest in documenting compliance.

12. Website analytics

Squarespace may provide analytics functions that allow us to obtain aggregated information about the use of our website.

Depending on the configuration of the website and your cookie choices, analytics data may include:

  • pages visited;

  • number of visits;

  • referring websites;

  • approximate geographic information;

  • device and browser information;

  • duration of visits; and

  • general interaction information.

Where analytics involve non-essential cookies or similar technologies requiring consent, they are only activated after consent has been provided.

The legal basis in such cases is Art. 6(1)(a) GDPR.

We use analytics to better understand how our website is used and to improve its usability and content.

13. Recipients of personal data

We may disclose personal data to third parties where this is necessary for the purposes described in this Data Privacy.

Recipients may include:

  • website and hosting providers;

  • IT and cloud service providers;

  • email and communication providers;

  • software and technical service providers;

  • legal advisers, auditors and other professional advisers;

  • contractual partners where necessary;

  • public authorities where required by law; and

  • other service providers acting on our behalf.

Where third parties process personal data on our behalf, we conclude appropriate data processing agreements where required by Art. 28 GDPR.

14. International data transfers

Some of our technology providers operate internationally.

As a result, personal data may be transferred to or processed in countries outside the European Economic Area.

In particular, Squarespace and certain Squarespace subprocessors may process personal data in the United States of America or other jurisdictions.

Where data is transferred to a country for which the European Commission has issued an adequacy decision, the transfer may take place on that basis.

Squarespace states that relevant U.S. entities participate in the EU-U.S. Data Privacy Framework.

Where an adequacy decision or applicable certification does not cover a transfer, appropriate safeguards may be used, including the European Commission's Standard Contractual Clauses pursuant to Art. 46 GDPR.

Where necessary, supplementary technical, contractual or organisational safeguards may also be applied.

15. Storage period

We retain personal data only for as long as necessary for the purposes for which it was collected.

The relevant retention period depends on the nature of the data and the reason for processing.

For example:

  • website and security logs are generally retained only as long as required for technical operation and security;

  • contact enquiries are retained for as long as necessary to process and respond to the enquiry;

  • business and investor correspondence may be retained for the duration of the relevant relationship and beyond where legitimate documentation interests apply;

  • contractual, tax and accounting documents may be retained for the statutory retention periods applicable under German law.

Where data is no longer required and no statutory retention obligation or overriding legitimate interest applies, it will be deleted or anonymised.

16. Data security

We use appropriate technical and organisational measures to protect personal data against:

  • unauthorised access;

  • accidental or unlawful loss;

  • destruction;

  • alteration;

  • disclosure; and

  • other unlawful processing.

Our website uses encrypted HTTPS/SSL connections for data transmission.

Nevertheless, internet-based communication and storage cannot be guaranteed to be completely secure.

17. Your rights under the GDPR

Subject to the statutory requirements, you have the following rights regarding your personal data.

Right of access – Art. 15 GDPR

You may request information about whether and how we process your personal data and receive a copy of such data.

Right to rectification – Art. 16 GDPR

You may request correction of inaccurate personal data and completion of incomplete information.

Right to erasure – Art. 17 GDPR

You may request deletion of your personal data where the statutory requirements are met.

Right to restriction of processing – Art. 18 GDPR

You may request restriction of the processing of your personal data in certain circumstances.

Right to data portability – Art. 20 GDPR

Where the statutory requirements are met, you may receive personal data that you have provided to us in a structured, commonly used and machine-readable format or request that it be transmitted to another controller.

Right to object – Art. 21 GDPR

You have the right to object, on grounds relating to your particular situation, to processing based on Art. 6(1)(e) or Art. 6(1)(f) GDPR.

Where personal data is processed for direct marketing purposes, you may object to such processing at any time.

Withdrawal of consent – Art. 7(3) GDPR

Where processing is based on your consent, you may withdraw that consent at any time with effect for the future.

Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

To exercise your rights, please contact: b.keweloh@cryovasc.com

We may request appropriate information to verify your identity before processing your request.

18. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes applicable data protection law.

The supervisory authority responsible for CRYOVASC GmbH is generally:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Berlin, Germany
https://www.datenschutz-berlin.de/

You may also contact another competent supervisory authority, in particular the authority at your habitual place of residence or workplace within the European Union.

19. Automated decision-making and profiling

We currently do not use personal data collected through this website for automated individual decision-making within the meaning of Art. 22 GDPR that produces legal effects or similarly significantly affects individuals.

20. Medical and regulatory information

CRYOVASC develops a medical device that is currently under development.

Information provided on this website regarding CRYOVASC's technology, research, potential applications or anticipated development is intended for general corporate and informational purposes.

The website is not intended to provide individual medical advice, diagnosis or treatment.

The product presented on this website is currently under development and has not yet received CE marking or FDA approval or clearance.

Nothing on this website should be understood as a promise, guarantee or representation of a particular therapeutic effect, clinical benefit or treatment outcome.

21. Links to third-party websites

Our website may contain links to websites operated by third parties, including scientific publications and other external sources.

Once you access a third-party website, the processing of personal data is governed by that third party's own privacy practices.

CRYOVASC is not responsible for the privacy practices or content of third-party websites.

22. Changes to this Data Privacy

We may amend this Data Privacy from time to time, particularly where:

  • our website changes;

  • we introduce new services or technologies;

  • we add additional analytics or marketing tools; or

  • applicable legal requirements change.

The current version published on our website applies.

Last updated: 3 October 2026