Privacy Policy

The controller responsible for the processing of personal data on this website is:

Lokalaise GmbH
Am Strandkai 8
20457 Hamburg
Germany

Represented by the managing directors:
Hendrik-Hauke Rux, Marius Gill, Niklas Köpps

Email: moin@lokalaise.de
Phone: +49 40 18030693

Register court: Amtsgericht Hamburg
Registration number: HRB 199263

We have not appointed a data protection officer, as we are not required to do so under Art. 37 GDPR and Section 38 of the German Federal Data Protection Act (BDSG). Contact for data protection matters: Hendrik-Hauke Rux, Managing Director, reachable at moin@lokalaise.de or at the controller's postal address.

This privacy policy informs you, in accordance with Art. 13 GDPR, which personal data we process when you visit this website, for which purposes and on which legal basis, to whom we transfer it and how long we keep it. We treat your data confidentially and in accordance with statutory data protection law.

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

Our website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. On every request, Vercel processes the data your browser transmits for technical reasons: IP address, date and time, the address requested, referrer URL, browser type and version, and operating system. The website cannot be delivered without this data.

Server-side functions, such as sending the contact form or logging in to the investor area, run in Vercel's data centre in Frankfurt am Main (EU). Static content is delivered by Vercel's content delivery network (CDN) worldwide from the nearest location. Access by Vercel Inc. from the USA is possible; it is covered by the EU-U.S. Data Privacy Framework (Art. 45 GDPR). We log error messages from the server-side functions without any form content. Vercel keeps access and runtime logs for at most 30 days and then deletes them automatically (see section 12).

We have concluded a data processing agreement with Vercel under Art. 28 GDPR; Vercel processes this data exclusively on our behalf and in accordance with our instructions. Vercel Inc. is certified under the EU-U.S. Data Privacy Framework; transfers to the USA are therefore covered by an adequacy decision of the European Commission (Art. 45 GDPR).

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in the secure and reliable operation of the website).

We use Vercel Web Analytics, provided by Vercel Inc. (address in section 3), to measure reach. Vercel Web Analytics does not set cookies and does not store any information on your device. For each page view it records: time, page viewed, referrer, approximate location (country, region, city), device type, and browser and operating system with version. To tell visits apart, Vercel generates a hash value from the request on the server, which is discarded after 24 hours. No user profiles are created; we only see aggregated statistics.

In addition, we record interaction events with Vercel Web Analytics (e.g. clicks on buttons, opening FAQ entries, selecting tabs, reaching form steps, loading the booking calendar, and downloads). These events contain only categorical values (such as the label of a button or tab) and never your name, email address, company, or any free text you enter.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in analysing website usage to improve our offering). Web analytics is not required to use the website; you can object to it at any time (see section 13).

This website uses the typefaces “Space Grotesk”, “Inter” and “IBM Plex Mono”. The fonts are downloaded once when the website is built and are then served together with the website by our host. No connection to servers of Google or any other font provider is established when you visit the website.

On our “Book a meeting” page, you can schedule an appointment via an embedded booking tool. The provider is HubSpot, Inc., Two Canal Park, Cambridge, MA 02141, USA. The tool is loaded from meetings-eu1.hubspot.com, which belongs to HubSpot's European data region. It is not loaded automatically: only when you click “Load calendar” is a connection to HubSpot established, your IP address and browser data transmitted to HubSpot, and HubSpot able to set cookies (including __hstc, hubspotutk, __hssc and __hssrc). Before this click, no data is transmitted to HubSpot and no cookies are set. You can remove the tool again with the “Hide booking tool again” button.

When you book an appointment, HubSpot processes the information requested in the booking form (e.g. name, email address and the selected slot) in our HubSpot account; we receive the booking for handling. HubSpot acts as our processor; we have concluded a data processing agreement with HubSpot under Art. 28 GDPR. Online booking is not possible without this information. Alternatively, you can reach us by email or phone (see section 1).

Even with a data region in the EU, HubSpot may transfer data to the USA or access it from there. HubSpot, Inc. is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR); within the HubSpot group, HubSpot additionally relies on the EU Standard Contractual Clauses (Art. 46 GDPR). For further information, please see HubSpot's privacy policy.

Legal basis for loading the tool and setting cookies: Art. 6 (1) (a) GDPR in conjunction with Section 25 (1) TDDDG (consent by active click; for withdrawal see section 9). Legal basis for processing your booking data: Art. 6 (1) (b) GDPR (pre-contractual measures at your request).

On the “Contact” page, you can request a demo via a form. We collect the following mandatory information:

• Name
• Email address
• Company
• Company size and topic (each a selection from predefined options)
• if you arrive via the price calculator: the number of users selected there

We use this data exclusively to process your inquiry and to get in touch with you. Without the mandatory information we cannot process your inquiry. If you write to us directly by email or call us, we process your details for the same purpose.

To deliver your form inquiry by email to our team, we use the service Resend provided by Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. Resend is a processor of Lokalaise GmbH; we have concluded a data processing agreement with Resend under Art. 28 GDPR. Resend processes your information, including your email address as the reply-to address, exclusively on our behalf, in the USA. Resend is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR); in addition, the EU Standard Contractual Clauses (Art. 46 GDPR) apply. Resend uses sub-processors in the USA, for sending in particular Amazon Web Services, Inc. (AWS); Resend publishes the current list at resend.com/legal/subprocessors.

The inquiry is delivered to the email inboxes of our managing directors; it is not stored in a database of our own. Our email inboxes are operated with Google Workspace; the contracting party is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes the messages as our processor; we have concluded a data processing agreement with Google under Art. 28 GDPR. This also applies if you email us directly. Google processes data in data centres worldwide, including in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR); in addition, the EU Standard Contractual Clauses (Art. 46 GDPR) apply.

To protect against automated abuse (spam), the form contains an additional field that is invisible to humans; if it is filled in, the inquiry is discarded. We also accept at most five inquiries per IP address within 15 minutes. For this purpose, your IP address and the times of your inquiries are held only in the volatile working memory of the respective server instance, are not written to disk, are not included in the inquiry, and are discarded at the latest when the server instance ends.

Legal basis: Art. 6 (1) (b) GDPR (pre-contractual measures at your request); where the inquiry is not aimed at concluding a contract, Art. 6 (1) (f) GDPR (legitimate interest in answering business inquiries). For abuse protection: Art. 6 (1) (f) GDPR.

The investor area is password-protected and intended for invited persons only. After the password has been verified successfully, we set a session cookie (“__Host-lk_investor”). It contains a signed access token with a random session identifier, the identifier of the access used and the validity period, but neither your name nor your email address. It is valid for 8 hours, is only transmitted over an encrypted connection and cannot be read by scripts in the browser (HttpOnly, SameSite=Lax). It is technically necessary to keep your access after login; it is deleted when you log out.

To protect against password guessing, we count failed attempts per sender. For this purpose we derive an HMAC-SHA-256 hash value (a hash with a secret key) from your IP address; this is pseudonymisation, not anonymisation. At most 5 attempts per 10 minutes are allowed, with an increasing waiting time between attempts; the counter and the lock expire automatically afterwards. On a successful login we log the time and the identifier of the access used, not your IP address.

This data is held in the working memory of our server-side functions and in a key-value store (Upstash Redis, EU data region). The provider is Upstash, Inc., USA, acting as our processor; a data processing agreement under Art. 28 GDPR is in place with Upstash, which covers transfers to the USA through the EU-U.S. Data Privacy Framework and, as a fallback, the EU Standard Contractual Clauses (Art. 45 and 46 GDPR). The login record also appears in the runtime logs of our host (see section 3); in the key-value store we keep logins for at most 90 days, and no more than the most recent 1,000 logins.

Legal basis: Section 25 (2) no. 2 TDDDG (the cookie is strictly necessary for us to provide the access you expressly requested) and Art. 6 (1) (f) GDPR (legitimate interest in protecting confidential documents from unauthorised access).

We do not set cookies for analytics, reach measurement or marketing. We set one technically necessary cookie, exclusively in the investor area after login (see section 8). Further cookies only arise if you load the embedded HubSpot calendar on the “Book an appointment” page yourself with an active click (see section 6). Beyond that, we do not store any information on your device.

You can withdraw your consent to loading the HubSpot calendar at any time with effect for the future by hiding the booking tool again. Cookies that have been set can also be deleted in your browser settings.

Personal data is only transferred to third parties in the cases described in this privacy policy. The recipients are our processors, each bound by a data processing agreement under Art. 28 GDPR:

• Vercel Inc., USA (hosting, server-side functions in the Frankfurt am Main data centre, and web analytics; see sections 3 and 4) — EU-U.S. Data Privacy Framework
• HubSpot, Inc., USA (appointment booking, only after your click; EU data region; see section 6) — EU-U.S. Data Privacy Framework, additionally EU Standard Contractual Clauses
• Plus Five Five, Inc. (Resend), USA, with Amazon Web Services, Inc. as sub-processor (sending form inquiries by email; see section 7) — EU-U.S. Data Privacy Framework and EU Standard Contractual Clauses
• Google Ireland Limited, Ireland (Google Workspace; email inboxes for form inquiries and direct emails; see section 7) — for transfers to Google LLC in the USA: EU-U.S. Data Privacy Framework, additionally EU Standard Contractual Clauses
• Upstash, Inc., USA (key-value store for the investor area, EU data region; see section 8) — EU-U.S. Data Privacy Framework, as a fallback EU Standard Contractual Clauses

Beyond that, we only disclose personal data if we are legally obliged to do so.

Our website contains links to third-party websites (e.g. sources in articles, or share links to LinkedIn and X). No content from these providers is loaded automatically. Data is only transmitted to the respective provider once you follow a link; that provider's privacy policy applies to this processing.

We store personal data only for as long as is necessary to fulfil the respective purposes or as required by statutory retention periods. The data is deleted thereafter. In detail:

• Access and runtime logs at the host: at most 30 days, then deleted automatically
• Analytics hash value: 24 hours
• Investor area: session cookie and session identifier 8 hours; failed-attempt counter 10 minutes; login record in the key-value store: at most 90 days, no more than the most recent 1,000 logins
• IP address for limiting form inquiries: evaluated for a 15-minute window, in volatile working memory only
• Form inquiries, emails and appointment bookings: until finally processed; beyond that only while a contractual relationship exists or statutory retention obligations apply (six years for commercial and business letters under Section 257 of the German Commercial Code (HGB), ten years for accounting records under Section 147 of the German Fiscal Code (AO))

Subject to the statutory requirements, you have the right to:

• Access to your stored personal data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent given, with effect for the future (Art. 7 (3) GDPR)
• Lodge a complaint with a data protection supervisory authority (Art. 77 GDPR)

To exercise your rights, an email to moin@lokalaise.de is sufficient.

You may lodge a complaint with any data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information (Hamburgischer Beauftragter für Datenschutz und Informationsfreiheit), Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany (datenschutz-hamburg.de).

For security reasons, our website uses SSL/TLS encryption. You can recognize an encrypted connection by the address bar of your browser changing from “http://” to “https://”. Please note that data transmission over the internet may nevertheless involve security vulnerabilities. Complete protection against access by third parties is not possible.

We update this privacy policy when our processing activities or the legal requirements change. The version published on this page applies.