Data processing on this website
WE TAKE DATA PROTECTION SERIOUSLY
The protection of your personal data is very important to us. We process personal data exclusively in accordance with applicable data protection regulations, in particular the General Data Protection Regulation (DSGVO) and the Federal Data Protection Act (BDSG).
1. Data Controller and Data Protection Officer
The data controller responsible for data processing on this website and for the processing described in this Privacy Policy is:
Lacuna GmbH
Ziegetsdorfer Straße 109
93051 Regensburg
Phone: +49 941 992088-0
Email: info@lacuna.de
Our company data protection officer is:
Mr. Gerald Lill
Projekt 29 GmbH & Co. KG
Ostengasse 14
93047 Regensburg
Phone: +49 941 2986930
Email: anfragen@projekt29.de
2. Principles and Scope of Data Processing
Personal data refers to any information relating to an identified or identifiable natural person. This may include your name, address, email address, phone number, IP address, and other information you provide to us when contacting us, initiating a contract, or during a business relationship.
In general, you can visit our website without actively providing personal data. To the extent that personal data is processed, it is done primarily for the technical operation and security of our website, to process inquiries, to initiate and execute contracts, and to comply with legal obligations.
We generally process only data that is necessary for the respective purpose or that you voluntarily provide to us.
3. Purposes, Categories, and Legal Bases for Processing
Depending on the nature of your interaction with us, the following categories of personal data may be processed:
• Contact information, such as name, address, email address, and phone number;
• Contract and business data, including information regarding contracts, orders, sales, receipts, customer and supplier relationships, and consulting documents;
• Communication and content data, information from contact requests, and other information you provide to us while communicating with us;
• Technical data, in particular IP address and login data;
• Payment and banking data, to the extent necessary for the fulfilment of a contract or a business relationship;
• Applicant and employee data, to the extent that you apply for a position with us or are employed by us and the processing is necessary and legally permissible for the respective purposes;
• Data from business partners, company and representation data, as well as contact information for the respective points of contact.
Data processing is carried out for the following purposes:
• to provide, operate, and ensure the technical security of our website;
• to process contact requests and other inquiries;
• to initiate, execute, and fulfil contracts and other business relationships;
• to fulfil legal and regulatory obligations;
• to protect our legitimate interests, to ensure secure and functional IT and business operations, as well as to assert, exercise, or defend legal claims;
The respective legal bases are derived in particular from Art. 6 Abs. 1 lit. a DSGVO (consent), Art. 6 Abs. 1 lit. b DSGVO (performance of a contract and pre-contractual measures), Art. 6 Abs. 1 lit. c DSGVO (compliance with legal obligations), and Art. 6 Abs. 1 lit. f DSGVO (protection of legitimate interests).
4. Visits to Our Website and Server Log Files
Each time our website is accessed, the web server automatically collects certain technical information and stores it in so-called server log files.
This includes:
• Date and time of the request;
• Name of the requested file;
• The previously visited website from which the file was requested;
• Access status;
• Web browser used;
• Operating system used;
• IP address of the requesting computer;
• Amount of data transferred.
This data is processed for the technical provision of the website, to ensure its stability and functionality, and to detect and defend against attacks on our web server.
The legal basis is Art. 6 Abs. 1 lit. f DSGVO. Our legitimate interest lies in ensuring the secure and uninterrupted operation of our website, as well as in preventing misuse and attacks on our IT systems.
Server log files are stored only temporarily for technical security reasons. After no more than seven days, the IP address is anonymized by truncating it to the domain level, so that it can no longer be linked to a specific individual. The anonymized data may then be used for statistical purposes.
The server log data is not combined with any other data sets. Personal server log data is generally not disclosed to third parties unless there is a legal obligation to do so.
5. Contacting Us
When you contact us (for example, via the contact form, email, or phone) we process the data you provide to the extent necessary to handle your inquiry and carry out the actions you have requested.
We may process your name, your contact information, as well as the content and other details you submit.
Depending on the reason for contacting us, processing is based on Art. 6 Abs. 1 lit. b DSGVO if your inquiry serves to initiate or fulfil a contract, or on Art. 6 Abs. 1 lit. f DSGVO if processing is necessary to safeguard our legitimate interest in properly handling and responding to your inquiry.
To the extent that you voluntarily provide us with additional information, this will be processed only to the extent necessary to handle your request or if you have consented to further processing.
6. Cookies and Similar Technologies
When you visit our websites, we may store information on your computer in the form of cookies. Many cookies contain what is known as a cookie ID. A cookie ID is a unique identifier for the cookie. It consists of a string of characters that allows websites and servers to associate the cookie with the specific web browser in which it was stored. This enables the websites and servers visited to distinguish the data subject’s individual browser from other web browsers that contain different cookies. A specific web browser can be recognized and identified via the unique cookie ID.
By using session cookies, the controller can provide users of this website with a user-friendly service that would not be possible without setting cookies. Without consent, we use only technically necessary cookies on the legal basis of legitimate interest pursuant to Art. 6 Abs. 1 lit. f DSGVO.
We use personal data cookies to improve our website or for marketing and advertising purposes only with your consent. On your first visit, you can voluntarily consent to tracking or analytics via the cookie banner that appears on the screen. Your data may be shared with partners or third-party providers. These cookies will only be stored if you explicitly consent to them; the legal basis in this case is your consent pursuant to Art. 6 Abs. 1 lit. a DSGVO. You can change your cookie settings at any time.
7. Cookiebot
Our website uses Cookiebot’s consent technology to obtain your consent to the storage of certain cookies on your device or to the use of certain technologies, and to document this in compliance with data protection regulations. (Provider: Cybot A/S, Havnegade 39, 1058 Copenhagen, Denmark, hereinafter “Cookiebot”).
When you visit our website, a connection is established with Cookiebot’s servers to obtain your consents and other statements regarding cookie usage. Cookiebot then stores a cookie in your browser to associate the consents you have granted—or their revocation—with your session. The data collected in this manner is stored until you request that we delete it, delete the Cookiebot cookie yourself, or the purpose for storing the data no longer applies. Mandatory statutory retention requirements remain unaffected.
Cookiebot is used to obtain the legally required consents for the use of cookies. The legal basis for this is ist Art. 6 Abs. 1 lit. c DSGVO.
We have entered into a data processing agreement (DPA) pursuant to Art. 28 DSGVO with the provider. This is a contract required under data protection law that ensures the provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the DSGVO.
8. Google Tag Manager
We use Google Tag Manager. (Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland).
Google Tag Manager is a tool that allows us to integrate tracking or analytics tools and other technologies into our website. Google Tag Manager itself does not create user profiles, store cookies, or perform independent analyses. It is used solely to manage and deploy the tools integrated through it. However, Google Tag Manager records your IP address, which may also be transferred to Google’s parent company in the United States.
The use of Google Tag Manager is based on Art. 6 Abs. 1 lit. f DSGVO.
The website operator has a legitimate interest in the quick and straightforward integration and management of various tools on its website. If consent has been requested, processing is carried out exclusively on the basis of Art. 6 Section 1 lit. a DSGVO and 25 Section 1 TDDDG, insofar as the consent covers the storage of cookies or access to information on the user’s device (e.g., device fingerprinting) within the meaning of the TDDDG. Consent may be revoked at any time. Google’s privacy policy regarding this tool can be found here: https://www.google.com/analytics/terms/tag-manager/
9. Google Analytics
To the extent that you have given your consent, we use Google Analytics on our website, a web analytics service (Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland).
Google Analytics is used to analyse the use of our website to continuously improve its functionality and user-friendliness, as well as to evaluate the effectiveness of our marketing measures.
As part of the use of Google Analytics, cookies and similar technologies are used that enable your device to be recognized. The information collected in this process may include details about the use of our website, pages visited, events, technical information about the device, and truncated IP addresses.
Google processes the transmitted information on our behalf to generate reports on the use of our website, provide statistical analyses, and perform other services related to website usage.
To the extent that personal data is transferred to servers operated by Google LLC in the United States as part of the processing, this is done based on the European Commission’s Standard Contractual Clauses and other appropriate safeguards pursuant to Art. 46 DSGVO. In addition, Google is certified under the EU-U.S. Data Privacy Framework.
Processing is carried out exclusively based on your consent pursuant to Art. 6 Abs. 1 lit. a DSGVO and § 25 Section 1 TDDDG, to the extent that consent is required for the storage of or access to information on your device. You may revoke your consent at any time with future effect via the cookie settings on our website.
For more information on data processing by Google, please visit:
https://policies.google.com/privacy
https://support.google.com/analytics
If you visit our site using a mobile device (smartphone or tablet), you must instead click this link to prevent future tracking by Google Analytics on this website. This is also available as an alternative to the browser add-on mentioned above. Clicking the link sets an opt-out cookie in your browser that is valid only for that browser and this domain. If you delete the cookies in this browser, the opt-out cookie will also be deleted, so you will need to click the link again.
10. Newsletter
We use the service provider Brevo (Provider: Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany) to send newsletters.
It is not possible to actively subscribe to a newsletter on our website; no data is collected via this website for advertising purposes or to send emails. Newsletters are sent exclusively to existing contacts from our ongoing business activities. For this purpose, your email address and, if applicable, your name is processed.
The processing and sending of newsletters are based on our legitimate interest in maintaining relationships with customers and business partners in accordance with Art. 6 Abs. 1 lit. f DSGVO. To ensure compliance with data protection regulations, we have entered into a data processing agreement with Brevo GmbH, which obligates the provider to process your data strictly in accordance with our instructions and within the European Union.
You may object at any time to receiving our business communications and to the use of your data for this purpose with future effect. To do so, a corresponding unsubscribe link is provided in every email we send, or you may contact us informally via email. Further information on data protection at Brevo can be found here: Brevo Privacy Policy
11. Recipients of Personal Data
We disclose personal data only if there is a legal basis under data protection law and the disclosure is necessary for the respective purpose.
We may engage service providers who process personal data on our behalf. These may include IT and hosting service providers as well as other technical or organizational service providers. We carefully select these processors and contractually bind them to comply with legal requirements.
In addition, personal data may be transferred to other recipients to the extent necessary if this is required for the initiation or performance of a contract or if there is a legal obligation to do so. Depending on the specific business transaction, this may include banks, insurance companies, tax advisors, legal advisors, government agencies, and courts.
A transfer will only take place if there is a corresponding legal basis for doing so.
12. Retention Period
We store personal data only for as long as is necessary for the respective processing purposes.
To the extent that personal data is processed for the purpose of conducting a business relationship, we generally store it for the duration of that business relationship. In addition, statutory retention requirements may necessitate longer storage periods, particularly due to commercial and tax law provisions.
Once the respective retention periods have expired, the data will be deleted unless there is another legal basis for further storage.
In addition, data may be stored for as long as necessary to assert, exercise, or defend legal claims.
13. Your Data Protection Rights
You have the following rights in accordance with the statutory requirements:
Right of Access – Art. 15 DSGVO
You may request information regarding whether we process personal data about you and, if so, what data we process. This includes information about the purposes of processing, the categories of personal data, recipients or categories of recipients, the retention period, and the source of the data, unless it was collected directly from you.
Right to Rectification – Art. 16 DSGVO
You may request the rectification of inaccurate personal data and the completion of incomplete data.
Right to Erasure – Art. 17 DSGVO
You may request the erasure of your personal data under the conditions set forth by law. The right to erasure applies when the data is no longer necessary for the purposes for which it was collected or when the processing is unlawful. Erasure may be precluded if statutory retention obligations or other legal grounds prevent it.
Right to Restriction of Processing – Art. 18 DSGVO
You may request the restriction of processing under the conditions set forth by law, in particular if you contest the accuracy of your data, the processing is unlawful, we no longer need the data but you need it to assert, exercise, or defend legal claims, or as long as a decision has not yet been made regarding an objection you have filed.
Right to Data Portability – Art. 20 DSGVO
Subject to the legal requirements, you have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format. Subject to the legal requirements, you may also request that this data be transmitted directly to another controller.
Right to Object – Art. 21 DSGVO
To the extent that we process your personal data based on Art. 6 Section 1 lit. f DSGVO, you may object to such processing at any time for reasons arising from your situation. We will then generally no longer process the data in question, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defence of legal claims.
You may object at any time, without providing a reason, to the processing of personal data for direct marketing purposes.
Withdrawal of Consent – Art. 7(3) DSGVO
To the extent that processing is based on your consent, you may withdraw this consent at any time with future effect. The lawfulness of the processing carried out prior to the withdrawal remains unaffected.
To exercise your rights, you may contact us or our Data Protection Officer directly using the contact information provided above. In individual cases, we may request additional information necessary to verify your identity.
Right to File a Complaint with a Data Protection Supervisory Authority
Without prejudice to other administrative or judicial remedies, you have the right to file a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates data protection regulations.
14. Data Security
We implement technical and organizational measures to protect your personal data against loss, destruction, manipulation, and unauthorized access.
Whenever we collect and process personal data, it is encrypted before being transmitted. This means that your data cannot be misused by third parties.
Our security measures are continuously reviewed and updated in line with technological developments.
15. Updates to This Privacy Policy
We reserve the right to amend this Privacy Policy if required due to legal, technical, or organizational changes.
The most recent version of the Privacy Policy published on our website is always the one that applies. In the event of significant changes, we will announce them on our website as required by law.
Last updated: 09/26