Privacy

Email: info@leitwerch.com
Phone: +49 151 40312997

We are not required to appoint a data protection officer; the conditions of Section 38 of the German Federal Data Protection Act are not met. We answer privacy questions ourselves.

The pages are pre-built and delivered as finished HTML. When you open a page, your browser loads nothing from third-party servers. We verified this by opening every page and recording every request it triggered.

There is one exception, and you are the one who triggers it: if you fill in the contact form and send it, your entries go to this website and from there to our email dispatch provider. The section “Contact form and email” below describes exactly what happens then. Merely reading the contact page sends nothing.

Apart from that, in concrete terms:

• No analytics or statistics service. No Google Analytics, no Tag Manager, no Plausible, no Matomo, no Hotjar.
• No ad networks, no remarketing, no conversion pixels.
• No social media plugins, no embedded videos, no map services.
• No third-party fonts. The Geist typeface is served as a file from this website; no connection to Google Fonts is made.
• No third-party images and no third-party scripts. The logos of the tools we show come from this website as well.
• No browser storage via localStorage, sessionStorage or comparable techniques.

This website is delivered by Cloudflare on our behalf. Cloudflare runs a global network and serves the pages from whichever of its data centres is closest to you, so there is no one server location we could name – and we would rather say that than invent a city.

On every request, Cloudflare's server processes technically necessary connection data. This typically includes the IP address of the requesting device, the date and time, the address requested, information about the browser and operating system, and the amount of data transferred.

The sole purpose is secure, trouble-free operation. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to keep the site available and to detect attacks. We do not combine this data with other data and do not evaluate it to understand your behaviour.

Cloudflare processes this data for us as a processor, on the basis of a data processing agreement pursuant to Art. 28 GDPR. Because Cloudflare is a US company, the section “Transfers to third countries” applies as well.

Provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (delivered from Cloudflare's global network, usually from the data centre closest to you)

This website sets exactly one cookie: NEXT_LOCALE. It remembers which language you are reading the site in, so that the language switch works.

Its content is the language code “de” or “en”, nothing more. It is set without an expiry date and therefore disappears when you close your browser. It contains no identifier that could be used to recognise a device or a person, and it is not passed on to anyone.

That makes it strictly necessary for the service you have requested within the meaning of Section 25(2)(2) TDDDG. No consent is required for it. Because we use no other cookies and no other storage techniques, this website deliberately has no consent banner: a banner with nothing to ask would be an annoyance without a purpose. The legal basis for the subsequent processing is Art. 6(1)(f) GDPR.

You can delete or block cookies in your browser at any time. The website will keep working and will show the language given in the address.

The form on the contact page really does send. When you press “Send message”, your entries are transmitted over an encrypted connection to this website, which hands them to our email dispatch provider; it delivers them to us as an email. The form itself sets no cookie and leaves nothing behind in your browser. If you would rather not use it, the email address in the imprint reaches us just as well.

We process what you wrote: your name, your email address, your company if given, the topics you selected and the text of your message. We use this information solely to answer your enquiry. Your email address also becomes the reply address of that email, so that a reply goes straight back to you. A confirmation of receipt, including a copy of what you sent, also goes to the address you gave us – exactly one email per submitted form, no newsletter and no advertising.

The legal basis is Art. 6(1)(b) GDPR where the enquiry concerns entering into or performing a contract, otherwise Art. 6(1)(f) GDPR with our legitimate interest in answering enquiries. Giving us the data is voluntary – but without a name, an email address and a message we cannot reply.

The email is sent for us by Twilio Inc., 101 Spear Street, First Floor, San Francisco, CA 94105, USA, through its SendGrid service. SendGrid receives exactly what the form passes on – your name, your email address, your company and the topics if given, and the text of your message – and uses it for nothing but delivering those two emails: the notification to us and your confirmation of receipt. SendGrid acts as our processor on the basis of a data processing agreement pursuant to Art. 28 GDPR. For the dispatch itself, SendGrid logs sender, recipient, time and delivery status for a limited period, so that delivery can be traced. We have switched off SendGrid's tracking options: no opening is measured and no link in the email is rewritten. Because Twilio is a US company, the section “Transfers to third countries” applies here too.

We delete the correspondence once it is settled and no follow-up questions are to be expected, at the latest two years after the last contact. Where a message qualifies as commercial correspondence or as an accounting document, the statutory retention periods under Section 257 of the German Commercial Code and Section 147 of the German Fiscal Code apply. For their duration the data remains stored, but is kept for that purpose only.

Like any email, your message passes through the provider of our mailbox. Email is not end-to-end encrypted in transit. If you want to tell us something confidential, let us know and we will agree on another route.

We do not sell data and do not pass it on for advertising purposes. Only the service providers we need in order to operate have access: Cloudflare as the host of this website, Twilio/SendGrid as the dispatch provider for the contact form, and the provider of our mailbox. All of them are bound by our instructions under a data processing agreement pursuant to Art. 28 GDPR.

Beyond that, we pass on data only where we are legally required to.

Two of the providers named above are US companies: Cloudflare, Inc. and Twilio Inc. (SendGrid). That means personal data can be processed in the United States – with Cloudflare the connection data of every request, with SendGrid what you entered in the contact form.

Both companies are listed as active participants in the EU-US Data Privacy Framework. For transfers to a certified company, the adequacy decision of the European Commission of 10 July 2023 applies, so no further instrument is needed. On top of that, the data processing agreements of both providers incorporate the standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR); they take effect should the adequacy decision cease to apply.

We are aware that authorities in the United States have powers of access for which EU law has no equivalent, and that the Court of Justice struck down both predecessors of the current arrangement. We therefore keep what leaves the EU as small as we can: no tracking data at all, and from the contact form only what you wrote yourself.

Apart from these two providers, we do not transfer data to countries outside the EU and the European Economic Area.

You have the following rights in relation to us:

• Access to whether and which data we process about you (Art. 15 GDPR).
• Rectification of inaccurate data and completion of incomplete data (Art. 16 GDPR).
• Erasure, where we no longer need the data and no retention obligation applies (Art. 17 GDPR).
• Restriction of processing (Art. 18 GDPR).
• Receipt of the data you gave us, in a common format (Art. 20 GDPR).
• Withdrawal of consent you have given, with effect for the future (Art. 7(3) GDPR).

Where we process data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you can object at any time (Art. 21 GDPR). An informal message to the address above is enough. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests.

We answer requests concerning your rights within one month.

If you believe that we process your data unlawfully, you can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 27, 91522 Ansbach, Germany. You may also contact the authority where you live or work.

There is no automated decision-making in individual cases and no profiling within the meaning of Art. 22 GDPR. The artificial intelligence this website talks about works in projects for our clients. None of it runs on the website itself.

No. You can read this entire website without telling us anything. If you write to us, we need your name and an address to reply to – without those we cannot answer. Everything else is voluntary.

We update this text when the website changes. The last change was the contact form: it used to open your own email program, and now it sends through a dispatch provider. The date above shows which version you are reading.