Privacy policy

Controller

Levisteria GbR
Parkallee 18
20144 Hamburg
Germany

Partners: Ayite Eddy-Romeo Lackmann, Anna Karoline Flügge

Email: hello@levisteria.com
Phone: +49 155 66453444

Further details: Legal notice

Overview of processing

Data processed: master data (e.g. names), contact data (e.g. email, phone), content data (e.g. messages,
booking details), usage data (e.g. pages visited, clicks, time spent), meta and communication data
(e.g. IP addresses, timestamps, device and browser information).

Data subjects: visitors of the website, communication partners, prospective clients.

Purposes: providing and securing the website, handling enquiries, appointment booking, reach measurement
and optimisation, company presence on social networks.

Legal bases

We process personal data on the following bases under the General Data Protection Regulation (GDPR):

• Consent (Art. 6 (1) (a) GDPR): you have consented to processing for specific purposes.
• Contract and pre-contractual enquiries (Art. 6 (1) (b) GDPR): processing is necessary for a contract with you or for steps taken at your request.
• Legal obligation (Art. 6 (1) (c) GDPR): we must process data to comply with legal duties, e.g. retention obligations.
• Legitimate interests (Art. 6 (1) (f) GDPR): processing is necessary for our legitimate interests and your interests do not override them.

Storing and reading information on your device: cookies and similar technologies are additionally
governed by § 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG). We use
technologies that are not strictly necessary only with your consent under § 25 (1) TDDDG. Strictly necessary
technologies are used under § 25 (2) TDDDG.

National rules: the German Federal Data Protection Act (BDSG) applies in addition.

Security measures

Pursuant to Art. 32 GDPR we take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk. These include encrypted transmission (TLS/HTTPS), access restrictions, a firewall, regular updates and backups.

Recipients and processors

We use service providers that process data on our behalf, e.g. for hosting, maintenance and backups. We have concluded data processing agreements with them pursuant to Art. 28 GDPR. The individual providers are named in the following sections.

Transfers to third countries

Our website and the services it loads run on servers in Germany and the EU. No transfer to third countries takes place. Should we use services outside the EU in future, this will only happen if an adequate level of data protection is ensured: by an adequacy decision of the European Commission (Art. 45 GDPR), by standard contractual clauses (Art. 46 (2) (c) GDPR) or with your explicit consent (Art. 49 (1) (a) GDPR). We will state the basis for each service.

Retention and deletion

We delete personal data as soon as the purpose no longer applies and no statutory retention obligations prevent deletion. We retain business correspondence and records for up to six, eight or ten years in accordance with commercial and tax law (§ 257 HGB, § 147 AO). Specific periods are stated for each processing activity.

Your rights

Under the GDPR you have the following rights:

• Right to object (Art. 21 GDPR): you may object at any time, for reasons arising from your particular situation, to processing based on Art. 6 (1) (e) or (f) GDPR. You may object to processing for direct marketing purposes at any time without giving reasons.
• Withdrawal of consent (Art. 7 (3) GDPR): you may withdraw consent at any time with effect for the future.
• Access (Art. 15 GDPR) to the data stored about you and a copy of that data.
• Rectification (Art. 16 GDPR) of inaccurate data and completion of incomplete data.
• Erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR) within the limits of the law.
• Data portability (Art. 20 GDPR) for data you have provided to us.
• Complaint to a supervisory authority (Art. 77 GDPR). The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany, datenschutz-hamburg.de.

A message to hello@levisteria.com is enough to exercise your rights.

Hosting and server log files

Our website runs as a static site on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data center in Germany. We manage the server ourselves with Coolify. When you access the website, the server automatically processes your IP address as well as the page requested, date and time, amount of data transferred, referring URL, browser type and operating system (server log files).
Purposes: delivering the website, stability and security, e.g. defence against attacks.
Legal basis: legitimate interests (Art. 6 (1) (f) GDPR).
Retention: log files are stored for a maximum of 30 days and then deleted or anonymised. Data needed to clarify a security incident is kept until the matter is resolved.
Processing agreement: we have a contract with Hetzner pursuant to Art. 28 GDPR.
The site is fully static. There is no database, no user accounts and no forms that store data on our server.

Contact

If you contact us by email, phone or messenger, we process your details to handle your enquiry.

Data processed: name, contact details, content of the enquiry, time.

Legal basis: pre-contractual measures or contract (Art. 6 (1) (b) GDPR), otherwise legitimate interests in answering enquiries (Art. 6 (1) (f) GDPR).

Retention: until the enquiry is closed; for business correspondence according to statutory retention periods.

WhatsApp: our website links to WhatsApp. Only when you click the link and write to us does WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland, process your data under its own terms: whatsapp.com/legal/privacy-policy-eea. For confidential content we recommend email or phone.

Website chat (Chatwoot)

You will find our chat in the bottom right corner. It runs on our own Chatwoot instance (helpdesk.levisteria.com), which we operate ourselves; the server is provided by Hetzner Online GmbH in Germany. The chat loads while the page loads, without you having to open it.

Data processed: IP address, browser and device information, pages visited, time, content of your message, contact details you provide.

Purpose: answering your questions, also outside our phone hours.

Legal basis: legitimate interests in a low-threshold way to get in touch (Art. 6 (1) (f) GDPR); for an enquiry, pre-contractual measures (Art. 6 (1) (b) GDPR).

Storage: technically necessary storage in your browser for the session (§ 25 (2) TDDDG). We delete chat histories as soon as the purpose no longer applies and no retention obligations prevent deletion.

If you do not want the chat to load, block helpdesk.levisteria.com in your browser or use email and phone.

Online booking (Cal.com)

On the contact page you can book a call with us using a booking calendar. We use the Cal.com software, which we operate ourselves on our own server (calendar.levisteria.com). The server is located in a Hetzner Online GmbH data center in Germany. No data is transferred to Cal.com, Inc.
Data processed: name, email address, chosen slot, your notes about the reason for the call, technical data such as IP address and time zone.
Purpose: arranging and holding the appointment, sending confirmations and reminders.
Legal basis: pre-contractual measures at your request (Art. 6 (1) (b) GDPR).
Retention: we delete booking data no later than twelve months after the appointment unless a business relationship arises or retention obligations apply.
Processing agreement: we have a contract with Hetzner pursuant to Art. 28 GDPR.
The calendar only loads when you scroll to it on the contact page. Alternatively, you can arrange a call by email.

Analytics (OpenPanel)

We measure how our website is used in order to improve content and usability. For this we use OpenPanel on
our own instance, which we operate ourselves: the measurement script is loaded from
op-dashboard.levisteria.com and the measurements are sent to op-api.levisteria.com.

Data processed: pages and page titles visited, clicks, outgoing links clicked, referrers, device and
browser information including the browser identification (user agent), screen size, language and your IP
address.

Location: we derive the approximate location (country, region, city) from your IP address at the time of
the request. We do not store the IP address itself.

Recognition without a cookie: we do not set any cookies for analytics. Instead of an identifier in your
browser, OpenPanel creates the identifier on our server: a hash that cannot be reversed is calculated from
your IP address, the browser identification and the project identifier, combined with an additional value
(salt). That value changes every 24 hours. Requests within those 24 hours can therefore be attributed to
the same identifier, but not beyond that.

Storage in your browser: the measurement script reads and writes a single entry in your browser’s
session storage for measurements that have not been transmitted yet. It is not set during normal browsing
and ends with the session at the latest.

Purpose: reach measurement and improving the website.

Legal basis: legitimate interests in privacy-friendly analytics (Art. 6 (1) (f) GDPR); for access to
your browser’s session storage § 25 (2) TDDDG.

Retention: we keep the analyses for [analytics retention period] and delete them afterwards. The IP
address is discarded once the identifier has been created, and the additional value changes every 24 hours.

We do not record your session (no session replay). Tracking is active only in the published website, not in
local development.

Social media presences

LinkedIn: we operate a company page on LinkedIn. For the statistics LinkedIn provides to us about the
use of our page (Page Insights) we are jointly responsible with LinkedIn Ireland Unlimited Company, Wilton
Place, Dublin 2, Ireland (Art. 26 GDPR). The agreement:
legal.linkedin.com/pages-joint-controller-addendum.
Legal basis: legitimate interests in communicating with prospects (Art. 6 (1) (f) GDPR). Privacy policy:
linkedin.com/legal/privacy-policy.

Instagram and GitHub: we only link to these profiles. Data is transferred only when you click the link.
The privacy terms of the respective provider then apply.

No embedded third-party content

We do not embed videos, maps, ad networks or fonts from external servers. All fonts are hosted on our own server; there is no Google Fonts, no YouTube and no map embed on this website. Images of projects are shown only with the explicit consent of the people involved.

Changes

We update this privacy policy when our website or the legal situation changes. The current version on this page applies.