Privacy Policy

1. Controller

The controller responsible for data processing on this website within the meaning of the Data Protection Act (DSA) of the Principality of Liechtenstein (LGBl. 2019 No. 8 as amended) and Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR), which applies in Liechtenstein through the EEA Agreement, is:

2. Data Protection Officer

Pursuant to Art. 37 GDPR in conjunction with the DSA-FL, Nutrion GmbH is not required to appoint a data protection officer, as it is neither a public authority nor a public-law body and does not carry out large-scale, systematic processing of special categories of personal data (Art. 9 GDPR).

For data protection matters, please contact the controller directly at info@veylon.li.

3. Legal Bases for Data Processing

Data processing on this website is carried out on the following legal bases under Art. 6(1) GDPR:

• Art. 6(1)(a) GDPR — Consent: where you have given explicit consent to the processing (e.g. contact form).
• Art. 6(1)(b) GDPR — Performance of a contract: where processing is necessary for the initiation or performance of a contract.
• Art. 6(1)(f) GDPR — Legitimate interests: where processing is necessary for the legitimate interests of the controller or a third party and those interests are not overridden by the data subject's rights.

4. Hosting and Server Log Files

a) Hosting Provider

This website is hosted by cyon AG, Brunngässlein 12, 4052 Basel, Switzerland («cyon»). cyon's servers are located in Switzerland. Switzerland provides an adequate level of data protection recognised by the European Commission (adequacy decision pursuant to Art. 45 GDPR).

A data processing agreement (DPA) pursuant to Art. 28 GDPR has been concluded with cyon. The DPA is available at cyon.ch/legal/avv.

b) Automatic Collection of Access Data

Each time this website is accessed, cyon automatically collects data in server log files, including:

• IP address of the requesting device (generally anonymised after storage)
• Date and time of access
• Requested URL
• Referrer URL (previously visited page, if transmitted)
• Browser and operating system used
• Data volume transferred and HTTP status code

c) Legal Basis and Legitimate Interest

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest consists in the technical necessity of operating the website and ensuring its security and stability (detection and prevention of attacks, error diagnosis).

d) Retention Period

Server log files are automatically deleted after 30 days.

5. Fonts (Locally Hosted)

This website uses the fonts «Cinzel» and «Inter». Both fonts are served exclusively from our hosting server. No connections are established to external servers; no data is transferred to third parties.

6. Contact Form and Contact by E-mail

a) Contact Form

A contact form is available on our website. When you use it, the data you enter (name, e-mail address, topic, message) is transmitted to us and stored.

Messages submitted via the contact form are sent exclusively through the mail servers of cyon AG (Basel, Switzerland). No external third-party provider is used. Processing takes place within Switzerland; no transfer to third countries occurs. The DPA with cyon also covers e-mail transmission. Mail server logs are deleted by cyon after 30 days.

b) Legal Basis

The legal basis for processing data submitted via the contact form is Art. 6(1)(a) GDPR (consent through active submission of the form and confirmation of this privacy policy) and Art. 6(1)(b) GDPR (pre-contractual measures), where the enquiry relates to the conclusion of a contract.

c) Retention Period

Data transmitted as part of a contact enquiry is deleted once the relevant conversation has concluded and no statutory retention obligations prevent deletion.

d) Contact by E-mail

Alternatively, you may contact us by e-mail at info@veylon.li. In this case, your e-mail address and the information transmitted will be stored to process your enquiry. Data will not be passed on to third parties. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in processing incoming enquiries).

7. Cloudflare Turnstile (Bot Protection)

a) Description and Scope

Our contact form is protected by Cloudflare Turnstile, a bot-detection service provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA («Cloudflare»). When the form is submitted, Turnstile automatically analyses browser signals (e.g. IP address, user agent, interaction patterns) to determine whether the visitor is a human or an automated bot. No personal data is processed for advertising purposes and no individual user profile is created.

In the process, the cookie __cf_bm is set (technically necessary, duration 30 minutes).

b) Legal Basis

The legal basis is Art. 6(1)(f) GDPR (legitimate interests). The legitimate interest consists in protecting the website against abusive automated requests (spam, bot attacks) and ensuring the integrity of the contact form.

c) Transfer to the USA

Cloudflare, Inc. is based in the USA. For the transfer of personal data to the USA, we rely on the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023) and on the Standard Contractual Clauses approved by the European Commission pursuant to Art. 46(2)(c) GDPR. Cloudflare is certified under the EU-US Data Privacy Framework. For further information, please refer to Cloudflare's privacy policy: cloudflare.com/privacypolicy .

8. External Links to Partner Websites

This website contains links to external third-party websites (partners). These links are identifiable as such. By clicking an external link, you leave our website; data processing on those sites is the sole responsibility of the respective operator.

We have no influence over data processing on linked websites and accept no liability in this regard. When accessing external links, we recommend reading the privacy policy of the respective website.

9. Google Analytics 4

a) Description and Scope

This website uses Google Analytics 4 (GA4), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland («Google Ireland»). GA4 uses cookies to analyse how this website is used. The information generated is generally transmitted to a server of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and stored there.

IP anonymisation is enabled. Accordingly, your IP address is truncated by Google within member states of the European Union or other contracting states to the Agreement on the European Economic Area before transmission to the USA.

Google Analytics is operated on this website exclusively with Consent Mode v2. This means: GA4 is loaded but does not collect personal measurement data or set analytics cookies unless you have given your consent.

b) Legal Basis

The legal basis is Art. 6(1)(a) GDPR (consent). You may withdraw your consent at any time with effect for the future via the «Cookie Settings» link in the footer of this website.

c) Transfer to the USA

Google LLC is based in the USA. For the transfer of personal data to the USA, we rely on the Standard Contractual Clauses approved by the European Commission pursuant to Art. 46(2)(c) GDPR and on the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023). For further information, please refer to Google's privacy policy: policies.google.com/privacy .

d) Opt-out

You may withdraw your consent at any time via the «Cookie Settings» link in the footer of this website. Any analytics cookies already set will be deleted automatically. You may also permanently prevent GA4 tracking using the Google Analytics Opt-out Browser Add-on: tools.google.com/dlpage/gaoptout .

10. Cookies and Tracking

a) What Are Cookies?

Cookies are small text files stored on your device when you visit a website. This website uses exclusively first-party cookies (i.e. cookies set directly by us or by integrated services).

b) Cookie Categories and Cookies Used

We distinguish between necessary cookies (always active) and optional statistics cookies (only with your consent). The table below lists all cookies in use:

Statistics cookies are only set if you have actively consented via the cookie banner. You may withdraw your consent at any time via the «Cookie Settings» link in the footer of this website.

c) Profiling

No automated profiling within the meaning of Art. 22 GDPR takes place.

11. Your Rights as a Data Subject

Under the DSA-FL in conjunction with the GDPR, you have the following rights against the controller:

• Right of access (Art. 15 GDPR): You may request information at any time as to whether and which personal data we process about you, as well as copies of such data.
• Right to rectification (Art. 16 GDPR): You have the right to have inaccurate or incomplete data corrected.
• Right to erasure (Art. 17 GDPR): You may request the deletion of your personal data, provided no statutory retention obligations or other grounds for retention apply.
• Right to restriction of processing (Art. 18 GDPR): You may request that the processing of your data be restricted.
• Right to data portability (Art. 20 GDPR): You have the right to receive the data concerning you in a structured, commonly used and machine-readable format.
• Right to object (Art. 21 GDPR): Where processing is based on Art. 6(1)(f) GDPR (legitimate interests), you have the right to object. We will then no longer process the data unless we can demonstrate compelling legitimate grounds.
• Right to withdraw consent (Art. 7(3) GDPR): Where processing is based on your consent, you may withdraw it at any time with effect for the future. The lawfulness of processing carried out prior to withdrawal is not affected.

To exercise your rights, please contact: info@veylon.li

12. Right to Lodge a Complaint with the Liechtenstein Data Protection Authority

You have the right to lodge a complaint with the competent data protection supervisory authority if you believe that the processing of your personal data infringes the DSA-FL or the GDPR:

13. Currency and Amendments to this Privacy Policy

This privacy policy is current as of April 2026.

As this website evolves or due to changes in statutory or regulatory requirements, it may be necessary to update this privacy policy. The current version is available at any time at veylon.li/en/privacy.