Privacy Policy

1. Controller

Claas Hansen Marketingberatung
trading under the brand lightparc
Owner: Claas Hansen
Münzplatz 10
56068 Koblenz
Germany

Telephone: +49 261 – 287 318 66
Email: service-expert@lightparc.de

2. General information

Personal data is processed only to the extent necessary and on the basis of the applicable statutory provisions.

This privacy policy provides information on the processing of personal data when you visit this website, when you make enquiries and in the course of our business relationships. Supplementary privacy notices may be required for certain projects or separate applications. The controller is Claas Hansen as owner of Claas Hansen Marketingberatung, trading as lightparc.

3. Visiting this website and server log data

When this website is accessed, technical access data is processed automatically by the hosting provider. This may include in particular:

• IP address of the accessing device
• Date and time of access
• Pages and files accessed
• Amount of data transferred and access status
• Browser type and version
• Operating system
• Referrer URL, where transmitted
• Host name of the accessing computer

The processing takes place to provide the website technically, to ensure secure and stable operation, to analyse errors and to prevent abusive access. The legal basis is Art. 6(1)(f) GDPR.

Server log data is stored only for as long as is necessary for secure operation. Longer storage may take place where a security-relevant incident has to be investigated or statutory retention obligations apply.

4. Contacting us via form

A contact form is available on this website. The data entered by the user, as well as the data technically required for transmission, is processed.

This applies accordingly to the enquiry forms for trade fair presence, hosting and cloud, SEO and SEA, print and promotional items, IT infrastructure and workplace, domains and website support, websites, shops and portals, and AI coaching and monitoring. There, the project-related details you provide are also processed, such as event, location, date, stand size and budget range; for hosting, the desired product, application, scale, location and service components; for online marketing, goal, budget range and target region; for print projects, product type, print run, format, date and delivery location; for IT projects, project type, locations, workplaces and budget range; for support, domain, number of domains and system; for website and shop projects, project type, system preference, scope and budget range; and for AI coaching and monitoring, topic, number of participants, format and question. The legal bases and storage rules correspond to the information on the contact form. Please do not enter passwords, access credentials or payment details in these forms.

This concerns in particular:

• Name
• Email address
• Enterprises
• Telephone number, where provided voluntarily
• Selected area of interest
• Description of the starting point and desired outcome
• Confirmation that you have read the privacy policy
• Technical time of submission
• Technical details for spam and abuse prevention

The data is processed in order to review and answer the enquiry personally and, where appropriate, to prepare an offer or a pre-contractual recommendation.

Art. 6(1)(b) GDPR is the legal basis where you yourself are a potential contracting party and the processing is necessary for pre-contractual measures at your request or for the performance of a contract. For contact persons at a company or institution and for general enquiries, the processing is based on Art. 6(1)(f) GDPR. Our legitimate interest is the proper handling of business enquiries and communication. Confirming the privacy notices is not consent to advertising.

The data submitted via the form is made accessible only to the persons responsible for handling it and to technically required processors.

Mere enquiries are deleted after final processing, once no further communication is to be expected and no retention obligation or specifically required legal defence stands in the way. Contract and billing documents are retained according to the criteria described under section 8. There is no blanket permanent storage of all enquiries.

4a. Mandatory fields and technical abuse prevention

The details marked as mandatory fields are needed to assign and answer your enquiry. There is no general legal obligation to use the contact form. Without these details the enquiry cannot be sent via the form; alternatively, you can contact us by email or telephone. The telephone number is optional.

To protect the form, the IP address, timestamp, browser identifier (user agent), input patterns, email domain and characteristics of the message are checked automatically. This includes a hidden check field, a timing check, a limit on repeated enquiries, a DNS check of the email domain and a risk-based spam assessment. DNS queries concern the domain, not the content of your message. No external CAPTCHA is used. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protection against spam, abuse and overload.

For limiting enquiries, a pseudonymous identifier is derived from the IP address and stored on the server together with the times of the enquiries. A time window of one hour is evaluated. This evaluation window is not an automatic deletion period: residual technical files may remain until the temporary server directory is cleaned. For forwarded enquiries, the notification email additionally contains the IP address, browser identifier and spam score; the storage rules for the enquiry apply to these.

Submissions classified as abusive may be rejected automatically. This does not decide on the conclusion of a consulting or service contract. If your enquiry does not arrive, you can request a personal review by email or telephone.

5. Contacting us by email or telephone

When you contact us by email or telephone, the personal data you provide is processed to handle your enquiry.

For enquiries concerning your own contract or its initiation, Art. 6(1)(b) GDPR applies. For general enquiries and communication with contact persons at companies or institutions, Art. 6(1)(f) GDPR applies; the legitimate interest is the handling and documentation of business communication.

6. Hosting and technical provision

Domain management is carried out through http.net Internet GmbH.

The website is hosted by Jolt, a company of the Freethought Group. The servers used for this website are located in the United Kingdom. For transfers of personal data to the United Kingdom, an adequacy decision of the European Commission under Art. 45 GDPR exists.

Where necessary, data processing agreements pursuant to Art. 28 GDPR exist with the service providers used.

7. Client portal and exchange platform (Nextcloud)

For the secure exchange of documents and for project organisation and collaboration, the controller operates a client portal based on the Nextcloud software (accessible at https://lightparc.de/cloud/). The portal is open to existing clients and project participants. Access credentials are issued by the controller. Merely visiting the website does not require logging in.

When using the portal, the following data in particular may be processed: user name, name, business email address, company affiliation, uploaded and downloaded files (for example layout files and project documents), file names, shares, access times and technical log data including the IP address.

The processing takes place to perform the contractual relationship and to provide files and documents pursuant to Art. 6(1)(b) GDPR, and on the basis of the legitimate interest in secure, traceable project organisation and in the security of the portal pursuant to Art. 6(1)(f) GDPR. Use of the portal is voluntary.

After logging in, the portal sets technically necessary cookies (in particular a session cookie for login and protection against abuse) and uses technically required storage functions of the browser. These are necessary for operating the portal; the legal basis is § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act). Analytics or marketing cookies are not used.

The data is accessible only to persons to whom the controller or a client has granted access, and to technically required processors (see section 12). Transmission is encrypted. Files and accounts are deleted when the purpose ceases to apply, in particular after the end of the project and expiry of relevant retention obligations (see section 8a). Log data is stored only for as long as is necessary for security and error analysis.

Please upload only files that you are entitled to upload. If files contain personal data of third parties, such as photos of identifiable people, please make sure that a legal basis exists for this.

8. Client, prospect and business partner data

In the context of contract initiation, offers, projects, managed services, IT infrastructure and consulting engagements, the controller processes in particular master and contact data, communication content, offer, contract and billing data, and project-related information.

For personal data of our own contracting parties, Art. 6(1)(b) GDPR applies where the processing is necessary for initiating or performing the contract. We process data of contact persons and supplementary project, documentation and security data under Art. 6(1)(f) GDPR for conducting business relationships, project control, record-keeping and IT security. Processing required by law is based on Art. 6(1)(c) GDPR.

Where, in the course of hosting, cloud, support, infrastructure or consulting services, lightparc processes personal data solely on the instructions of a client, this takes place on the basis of a separate data processing agreement pursuant to Art. 28 GDPR.

8a. Retention and deletion

The storage period depends on the respective purpose, the state of contract processing, specifically existing interests in evidence and legal defence, and statutory retention obligations. Where applicable, commercial and business letters must regularly be retained for six years, accounting vouchers for eight years, and books or annual financial statements for ten years (§ 257 HGB, § 147 AO). The start of the period depends on the respective law, regularly the end of the relevant calendar year. Not every enquiry is subject to these periods.

Documents needed to assert or defend specific claims may be retained until the relevant limitation period expires or proceedings are concluded. Access and use are restricted to this purpose. Once the purpose ceases and relevant obligations have expired, data is deleted. Data in backup copies is overwritten in the course of the respective backup rotation and is not reused for ongoing business operations.

9. Lexware Office

Lexware Office is used for offer, contract, invoicing and accounting processes.

In this context, name, company, address, email address, offer and contract data, invoice data and payment information in particular may be processed.

The processing is based on Art. 6(1)(b) GDPR, Art. 6(1)(c) GDPR and Art. 6(1)(f) GDPR.

Where necessary, a data processing agreement pursuant to Art. 28 GDPR exists with the provider.

10. Cookies and tracking

No analytics, marketing or tracking cookies are used for displaying the pages, the reference band and the processing of the contact form. These functions also do not require local storage or session storage. This applies to the public pages of this website. After login, the client portal sets technically necessary cookies, see section 7. No analytics or advertising services such as Google Analytics, Google Tag Manager, Meta Pixel or LinkedIn Insight Tag are embedded. Spam protection takes place on the server side and not through a tracking cookie. Any later use of technologies requiring consent will only take place after prior information and consent under § 25 TDDDG and, where required, the GDPR.

11. External links

This website contains links to external websites, for example to LinkedIn or to websites of technology and cooperation partners. After an external link is followed, the respective operator is responsible for the processing of personal data.

12. Recipients and processors

Personal data may be transmitted to technical service providers where necessary for hosting, domain management, email communication, cloud operation, project organisation, accounting or the provision of a requested service.

External specialists or cooperation partners receive personal data only if their involvement is necessary for handling an enquiry or performing an assignment and a legal basis under data protection law exists for this.

Depending on the agreed scope of services, recipients may in particular be hosting and cloud providers, data centres, domain registrars, software providers, distributors, manufacturers, technical specialists, payment and accounting service providers, and advisers bound to professional secrecy.

12a. Transfers outside the European Economic Area

The hosting in the United Kingdom described in section 6 is based on the relevant adequacy decision of the European Commission under Art. 45 GDPR. A transfer to other third countries requires that the respective conditions of Art. 44 et seq. GDPR are met. Where standard contractual clauses or other safeguards are used for this, data subjects receive the relevant information in the course of the respective processing; a copy can be requested via the contact details above.

12b. Project-related analysis, AI and social media monitoring

If personal data is processed for analyses, AI applications or social media monitoring under a separate assignment, the purpose, allocation of roles, data sources, recipients and deletion rules are defined for the specific project. Publicly accessible posts are not free of data protection requirements merely because they are publicly available. Any additional information required under Art. 13 or 14 GDPR is provided for the respective processing. This general website policy does not replace such project-related information.

13. Data security

This website uses SSL/TLS encryption. In addition, appropriate technical and organisational measures are used to protect personal data against loss, manipulation, unauthorised access and other misuse.

14. Rights of data subjects

Data subjects have in particular the following rights:

• Right of access
• Right to rectification
• Right to erasure
• Right to restriction of processing
• Right to data portability
• Right to object to processing

Right to object: You may object to processing under Art. 6(1)(f) GDPR on grounds relating to your particular situation. We will then no longer process the data unless we demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims. You may object to processing for direct marketing at any time without giving reasons.

Data subjects also have the right to lodge a complaint with a data protection supervisory authority.

Where processing is based on consent, it can be withdrawn with effect for the future. The lawfulness of processing carried out up to the withdrawal remains unaffected.

The competent authority is in particular:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz
Hintere Bleiche 34
55116 Mainz
Germany
www.datenschutz.rlp.de

To exercise your rights you can contact service-expert@lightparc.de. The rights exist under the respective statutory conditions. In particular, a right to lodge a complaint exists with a supervisory authority at your habitual residence, your place of work or the place of the alleged infringement.

15. Changes to this privacy policy

This privacy policy will be adapted if technical, organisational or legal changes make this necessary. The current version published on this website applies.