data policy

Privacy Policy

With the following privacy policy, we would like to inform you about the types of your personal data (hereinafter also referred to as "data") that we process, for what purposes and to what extent in connection with the provision of our website. This privacy policy applies regardless of the domains, systems, platforms and devices used to operate the website.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Lunovon GmbH
Oberlohnstr. 3
78467 Konstanz
Germany

Represented by the Managing Director: Johannes Deuser
Phone: +49 7531 717040
Email: sales@lunovon.de

2. Legal Bases for Processing

Below we set out the legal bases of the GDPR on which we process personal data. The applicable legal basis may vary depending on the individual processing activity:

• Consent (Art. 6 (1) (a) GDPR) – The data subject has given consent to the processing of their personal data for one or more specific purposes.
• Performance of a contract and pre-contractual requests (Art. 6 (1) (b) GDPR) – Processing is necessary for the performance of a contract or to carry out pre-contractual measures.
• Legal obligation (Art. 6 (1) (c) GDPR) – Processing is necessary for compliance with a legal obligation to which we are subject.
• Legitimate interests (Art. 6 (1) (f) GDPR) – Processing is necessary to protect our legitimate interests or those of a third party, provided that the interests, fundamental rights and freedoms of the data subject do not override these interests.

Insofar as consent is required for the storage of information on the user's terminal equipment or access to such information, Section 25 of the German Telecommunications and Digital Services Data Protection Act (TDDDG) additionally applies.

3. General Information on Data Processing

Data Security

We take appropriate technical and organisational measures to ensure a level of security appropriate to the risk. For security reasons and to protect the transmission of personal data, this website uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address bar of your browser changes from "http://" to "https://" and by the lock symbol in your browser bar.

Erasure of Data

The data we process will be erased as soon as it is no longer required for the purposes for which it was processed and no statutory retention obligations prevent erasure. If data must be retained due to legal requirements, its processing will be restricted accordingly; the data will be blocked and not processed for other purposes.

4. Provision of the Website and Server Log Files

When you access our website, the browser used on your device automatically sends information to the server of our website and stores it in so-called server log files. The following data is collected:

• browser type and version used
• the operating system of the accessing system
• the website previously visited (referrer URL)
• the sub-pages accessed
• date and time of access
• the IP address in anonymised form
• the internet service provider of the accessing system

This data is processed for the purpose of delivering the website content, ensuring functionality and the security of our information technology systems. The legal basis is our legitimate interest pursuant to Art. 6 (1) (f) GDPR. The log files are stored for security reasons for a maximum of [e.g. 7 / 14] days and then deleted.

5. Hosting

Our website is hosted by an external service provider. The personal data collected on this website is stored on the servers of the host. Processing is carried out for the purpose of providing our online offering securely, quickly and efficiently on the basis of our legitimate interest (Art. 6 (1) (f) GDPR) and, where applicable, for the performance of a contract (Art. 6 (1) (b) GDPR). We have concluded a data processing agreement with the host in accordance with Art. 28 GDPR.

Host: [Insert name and address of the hosting provider]

6. Cookies and Consent Management

Our website uses cookies. Cookies are small text files that are stored on your device. Some cookies are technically necessary for the website to function correctly; others are used to analyse usage or to embed external media.

Technically necessary cookies are used on the basis of our legitimate interest (Art. 6 (1) (f) GDPR) and Section 25 (2) TDDDG. We only use all other cookies and technologies (e.g. statistics and external media) if you have given your prior consent via our consent banner (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG).

You can withdraw or adjust your consent at any time with effect for the future by reopening the privacy settings on our website. You can also prevent cookies from being stored via your browser settings or delete cookies that have already been set.

7. Contacting Us

If you contact us via the contact form, by email or by telephone, the data you provide (e.g. name, email address, telephone number and the content of your enquiry) will be stored by us for the purpose of processing your request and in case of follow-up questions.

This data is processed on the basis of Art. 6 (1) (b) GDPR if your enquiry is related to the performance of a contract or is necessary to carry out pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Art. 6 (1) (f) GDPR) or on your consent (Art. 6 (1) (a) GDPR).

The data will be deleted as soon as your enquiry has been conclusively dealt with and no statutory retention obligations prevent deletion.

8. External Media

Google Maps

We embed map material from the Google Maps service on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. In order to use the functions of Google Maps, it is necessary to store and transmit your IP address to Google; this may involve a transfer to the USA. Use takes place exclusively on the basis of your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG). Further information can be found in Google's privacy policy: https://policies.google.com/privacy.

OpenStreetMap

We embed map material from the OpenStreetMap service on our website. The provider is the OpenStreetMap Foundation (OSMF), St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. When a map is loaded, your IP address is transmitted to the OpenStreetMap servers. Use takes place on the basis of your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG). Further information can be found in OpenStreetMap's privacy policy: https://wiki.osmfoundation.org/wiki/Privacy_Policy.

YouTube

We embed videos from the YouTube platform on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you access a page with an embedded YouTube video, a connection to the YouTube servers is established and your IP address and other data are transmitted; this may involve a transfer to the USA. The embedding takes place on the basis of your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG). Further information can be found in Google's privacy policy: https://policies.google.com/privacy.

9. Statistics and Web Analytics

Google Analytics

We use the web analytics service Google Analytics. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics enables us to analyse the behaviour of website visitors and to optimise our offering. Among other things, information about pages visited, time spent, approximate location and the device used is processed. The IP address is processed in shortened or anonymised form. A data transfer to the USA may occur.

The use of Google Analytics takes place exclusively on the basis of your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG). We have concluded a data processing agreement with Google in accordance with Art. 28 GDPR. Further information: https://policies.google.com/privacy.

Matomo Analytics

We use the open-source web analytics service Matomo. With Matomo, we collect and analyse data on the use of our website in order to improve our offering. Among other things, the shortened IP address, pages visited, access time, referrer and the device used are processed. [Add if Matomo is self-hosted: The data is stored exclusively on our own servers and is not passed on to third parties.]

The use of Matomo takes place on the basis of your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG). Further information on data protection at Matomo can be found at: https://matomo.org/privacy-policy/.

10. Data Transfers to Third Countries

Insofar as we use services whose providers transfer data to third countries (in particular the USA), this only takes place if an adequate level of data protection is ensured – for example through an adequacy decision by the EU Commission (e.g. the EU-US Data Privacy Framework) or through the agreement of EU standard contractual clauses pursuant to Art. 46 GDPR. Where processing is based on your consent, the transfer additionally takes place on the basis of Art. 49 (1) (a) GDPR.

11. Rights of Data Subjects

Under the GDPR, you have the following rights:

• Right of access (Art. 15 GDPR) to the data stored about you
• Right to rectification (Art. 16 GDPR) of inaccurate or incomplete data
• Right to erasure (Art. 17 GDPR) of the data stored by us
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw consent given (Art. 7 (3) GDPR) with effect for the future

To exercise your rights, an informal message to the contact details listed under "Controller" is sufficient.

Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The competent supervisory authority for Lunovon GmbH is:

The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg
(Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg)
Lautenschlagerstraße 20
70173 Stuttgart
Website: https://www.baden-wuerttemberg.datenschutz.de

12. Objection to Direct Marketing

If personal data is processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to any related profiling. Following an objection, the data concerned will no longer be used for direct marketing purposes.

13. Currency and Amendment of this Privacy Policy

This privacy policy is currently valid. Due to the further development of our website or as a result of changes in legal or regulatory requirements, it may become necessary to amend this privacy policy. The current version of the privacy policy can be accessed on this website at any time.

Last updated: [insert month/year]