Privacy

1. Data protection at a glance

This website sets no cookies, uses no analytics or marketing tools and loads no content from third parties. Fonts, images and scripts are served exclusively from our own web presence.

We only process personal data where it is technically necessary to provide the website or where you give it to us yourself, for example through the contact form, by email or phone.

2. Controller

The controller responsible for data processing on this website is:

Lipsia Digital GmbH
Reichsstraße 1–9
04109 Leipzig, Germany
Phone: +49 341 989 73 112
Email: info@lipsia.digital

The controller is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data.

3. Hosting and delivery

This website is delivered via Cloudflare Workers, provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (“Cloudflare”). When you open the website, Cloudflare processes the data technically required to deliver it, in particular your IP address, and protects the website against attacks.

This is based on Art. 6(1)(f) GDPR. Our legitimate interest is the secure, fast and reliable provision of our website.

We have a data processing agreement with Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework; transfers to the USA are based on the European Commission's adequacy decision (Art. 45 GDPR) and additionally on the European Commission's standard contractual clauses.

4. Data collected on this website

Access data

When you open the website, Cloudflare automatically processes the data your browser transmits that is needed to deliver and protect the website:

• IP address
• requested address (URL) and referrer URL
• time of the request
• browser identifier (user agent), which reveals browser and operating system

We keep no access logs ourselves. Cloudflare processes this data on our behalf (see section 3) and deletes it within the periods set out in its data processing agreement.

This data is not combined with other data sources. It is collected on the basis of Art. 6(1)(f) GDPR; we have a legitimate interest in presenting the website securely and without technical errors.

Contacting us

When you submit the contact form, your details (name, company, email address, type of project, description, desired start) are forwarded via our host Cloudflare to an internal Google Chat space of our team. They are not stored on the web server itself.

Google Chat is part of Google Workspace, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We have a data processing agreement with Google. Data may be transferred to the USA; Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).

We need the required fields (all except the desired start) to answer your enquiry. Without them the form cannot be sent; you can always reach us by email or phone instead.

To prevent abuse, your IP address is used briefly to limit the number of requests per minute. It is not stored permanently.

If you contact us by email or phone, your enquiry including all resulting personal data (name, request) is stored and processed by us to handle your request. We receive and store emails via Google Workspace (Google Ireland Limited, see above). We do not pass this data on without your consent.

Processing is based on Art. 6(1)(b) GDPR where your enquiry relates to the performance of a contract or is necessary for pre-contractual measures. In all other cases it is based on our legitimate interest in handling enquiries effectively (Art. 6(1)(f) GDPR).

The data remains with us until you ask us to delete it or the purpose for storing it no longer applies (e.g. once your request has been dealt with). Mandatory statutory provisions, in particular retention periods, remain unaffected.

Job applications

If you apply by email to hr@lipsia.digital, we process your details and documents to decide whether to establish an employment relationship. The legal basis is Art. 6(1)(b) GDPR in conjunction with Section 26 BDSG. The emails are received and stored via Google Workspace (Google Ireland Limited, see above).

If you are hired, we transfer the data to your personnel file. Otherwise we delete it no later than six months after the application process has ended, unless you have consented to longer storage. This period serves to defend against possible claims, for example under the General Equal Treatment Act (AGG) (Art. 6(1)(f) GDPR).

Storage in your browser

If you switch between the light and dark theme, we store this choice in your browser's local storage (localStorage). The information never leaves your device and is not transmitted to us. Storing it is strictly necessary for the service you explicitly requested (Section 25(2) no. 2 TDDDG). You can delete it at any time in your browser settings.

If you choose a filter on the “Projects” or “Insights” pages, we remember that choice for the session in your browser's session storage (sessionStorage). It is deleted when you close the tab, never leaves your device and is likewise strictly necessary (Section 25(2) no. 2 TDDDG).

5. General information and mandatory disclosures

Storage period

Unless a more specific storage period is stated in this notice, your personal data remains with us until the purpose for processing it no longer applies. If you make a justified request for deletion, your data will be deleted unless we have other legally permissible reasons for storing it (e.g. retention periods under tax or commercial law); in that case it will be deleted once those reasons cease to apply.

No automated decision-making

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

SSL/TLS encryption

For security reasons this website is only served over an encrypted connection (TLS). You can recognise an encrypted connection by “https://” in your browser's address bar.

6. Your rights

Within the scope of the applicable law you have the right at any time to:

• free information about your stored personal data, its origin, recipients and the purpose of processing (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdraw consent you have given, with effect for the future (Art. 7(3) GDPR).

For these and any other questions about data protection, you can contact us at any time at info@lipsia.digital.

Right to object (Art. 21 GDPR)

Where processing is based on Art. 6(1)(e) or (f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint with a supervisory authority

In the event of breaches of the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is the Saxon Data Protection and Transparency Commissioner (Sächsische Datenschutz- und Transparenzbeauftragte). This right is without prejudice to any other administrative or judicial remedies.