This is an English translation of our German privacy policy for your convenience. Only the German version is legally binding.
1. Controller
Lorenz Ritter von Stein, CRM and automation consulting
Lottestraße 52a
22529 Hamburg
Germany
info@lorenzrvs.de
+49 17640 546265
2. General information on data processing
We process personal data only to the extent necessary to provide our website, to initiate and perform contracts, to communicate with prospects, customers, suppliers and other business partners, and to comply with legal obligations. Where we collect personal data directly from you, this privacy policy informs you of the purposes, legal bases, recipients, storage periods or the criteria used to determine them, and your rights under applicable data protection law. Our services are aimed exclusively at businesses and other commercial market participants. Nevertheless, we process personal data of natural persons, for example contact persons, employees, users or applicants.
3. Website provision, hosting and server log files
Our website is hosted by Cloudflare and delivered through Cloudflare’s network (Cloudflare Workers with static assets). The provider is Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When you access our website, Cloudflare, as our hosting provider, processes the technically necessary access data, in particular IP address, date and time of access, requested URL, referrer URL, browser type and version, operating system, host name of the accessing computer and amount of data transferred. This processing serves to provide the website, ensure stability and security, analyze errors and prevent abusive access. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing our website securely, stably and efficiently. Where information is stored on or read from your device in the process, this is permitted under Section 25(2) No. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) because it is strictly necessary to provide the website you requested. The recipient is Cloudflare. Processing of data in the USA cannot be ruled out; Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework (see Section 19). For more information, see Cloudflare’s privacy policy at https://www.cloudflare.com/privacypolicy/.
The font used on our website (Satoshi) is embedded locally and delivered together with the website. No connections to third-party servers (such as Google Fonts) are made for this purpose.
4. Storing your language choice
Our website is available in German and English. If you click the language switcher (DE/EN in the header, or “English” or “Deutsch” in the menu and footer), we store your choice in your browser’s local storage (key “sprache”). After that, the home page no longer redirects you automatically to another language version. Nothing is stored there unless you click the switcher. Visitors whose browser is not set to German see a notice about the English version on German subpages; if you close this notice, your browser remembers this for the current session (session storage). For the redirect on the home page and for this notice, a script in your browser checks the languages set there. This information is not transmitted to us or to third parties. The local storage entry remains until you delete it in your browser; the session storage entry is deleted when you close the browser window. The legal basis is Section 25(2) No. 2 TDDDG, as storing and reading this information is strictly necessary to provide the language version you have expressly requested. To the extent personal data is processed, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in a user-friendly bilingual website.
5. Contacting us by email, form or other means
If you contact us by email, contact form, booking form or by any other means, we process the data you provide, in particular name, company, position, contact details, content of communications and, where applicable, references to contracts or projects. This processing serves to handle your inquiry, initiate contracts, carry out pre-contractual measures, document communications and, where applicable, establish, exercise or defend legal claims. The legal basis is Art. 6(1)(b) GDPR insofar as your inquiry is aimed at concluding or performing a contract, and otherwise Art. 6(1)(f) GDPR. Our legitimate interest lies in proper, traceable and efficient communication. We delete inquiries once they have been fully handled and no statutory retention obligations or legitimate interests in keeping records prevent deletion. Sections 6 and 7 also apply to the “Ask a quick question” form and to meeting bookings.
6. “Ask a quick question” form and forwarding via Make
When you submit the “Ask a quick question” form, we process your name, email address and question and, if provided, your company and how you heard about us. In addition, the address of the page on which you submitted the form, the time of submission and the language of the page are transmitted automatically. The data is transmitted in encrypted form to a webhook address of the automation service Make. Make then creates or updates a contact in our CRM HubSpot (see Section 8) and creates a note or task so that we can answer your question. Make is provided by Celonis, Inc., One World Trade Center, 87th Floor, New York, NY 10007, USA. We use Make’s EU region (eu1); according to the provider, processing therefore takes place on servers in the EU. Access from the USA, for example for support and maintenance, cannot be ruled out; Celonis, Inc. is certified under the EU-U.S. Data Privacy Framework (see Section 19). Make stores the execution logs of our workflow for a limited period that depends on the subscription plan. The form itself does not set any cookies or store anything in your browser. The legal basis is Art. 6(1)(b) GDPR insofar as your inquiry is aimed at concluding or performing a contract, and otherwise Art. 6(1)(f) GDPR. Our legitimate interest lies in handling your inquiry quickly and traceably. Section 5 applies to the storage period. If you have consented to the “Statistics” or “Marketing” category, we also report the successful submission as an event to Google Analytics, Meta or HubSpot, as applicable (see Sections 11 to 13); only HubSpot receives your email address in this process.
7. Meeting bookings via HubSpot Meetings
To book an intro call, we embed the HubSpot Meetings scheduling calendar (for the provider, see Section 8). The calendar is not loaded automatically. Only when you click “Show available times” is it loaded from HubSpot’s servers; alternatively, you can open it in a new window via a link. Only then is data transmitted to HubSpot, in particular your IP address and technical access data. When you book a meeting, we process the data you enter or transmit, in particular name, email address, company, preferred time, time zone, content of communications and technical metadata. This processing serves to organize meetings, communicate, initiate contracts and carry out projects. After booking, HubSpot redirects you to our confirmation page. If you have given consent, we report the booking there as an event to Google Analytics or Meta, as applicable (see Sections 11 and 12). The legal basis is Art. 6(1)(b) GDPR and, in addition, Art. 6(1)(f) GDPR for the efficient coordination of our business processes. Where information is stored on or read from your device when the calendar loads, this is permitted under Section 25(2) No. 2 TDDDG because you have expressly requested the calendar. The recipient is HubSpot.
8. CRM, lead management and sales processes via HubSpot
We process contact details, company data, communication histories, quote and contract information, and information about interactions with our sales and marketing processes in our CRM system. This processing serves to maintain relationships with prospects and customers in a structured manner, initiate contracts, track quotes, coordinate projects and document communications. The legal basis is Art. 6(1)(b) GDPR for contract-related or pre-contractual matters and Art. 6(1)(f) GDPR for the efficient management of sales and customer relationship processes. The recipient is HubSpot. HubSpot’s contracting entity for customers in Germany is HubSpot Germany GmbH, Am Postbahnhof 17, 10243 Berlin, Germany; its parent company is HubSpot, Inc., Two Canal Park, Cambridge, MA 02141, USA. Our HubSpot account is hosted in HubSpot’s EU data center. Access by HubSpot, Inc. from the USA cannot be ruled out; HubSpot, Inc. is certified under the EU-U.S. Data Privacy Framework (see Section 19). For more information, see HubSpot’s privacy policy at https://legal.hubspot.com/privacy-policy.
9. Newsletters and marketing communications via HubSpot
Where we send newsletters, event invitations or other marketing communications by email, we process in particular name, email address, company, interests, proof of consent and information on how the messages sent are used. We send these on the basis of your consent under Art. 6(1)(a) GDPR or, where permitted by law, on the basis of our legitimate interest under Art. 6(1)(f) GDPR in direct marketing to existing contacts to the extent permitted. You may withdraw your consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. The recipient is HubSpot Marketing Hub.
10. Consent management / Consent Management Platform Cookiebot
We use the consent management platform (CMP) Cookiebot to obtain, manage and document your consent to technologies that require consent. The provider is Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark. In the consent banner, in addition to the necessary technologies, you can individually select the categories “Statistics” (Google Analytics 4, see Section 11) and “Marketing” (Meta Pixel and HubSpot tracking code, see Sections 12 and 13). We run Cookiebot in manual mode: the scripts from Google, Meta and HubSpot are blocked and only load after you have consented to the respective category. No connection to these providers is made before you consent. We also use Google’s consent mode (Google Consent Mode v2): by default, consent for analytics and advertising purposes is set to denied; only after you consent does Cookiebot report the updated status to Google.
In this process, we process in particular your consent decision, date and time, browser and device information, your IP address in truncated form, the address of the page visited, a randomly generated consent ID and the specific consent status. Your choice is also stored in the “CookieConsent” cookie in your browser so that it is respected on subsequent page views. This processing serves to fulfill data protection documentation and control obligations and to manage optional website technologies in compliance with the law. The legal basis is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (proof of consent) and, in addition, Art. 6(1)(f) GDPR. Storing the “CookieConsent” cookie is permitted under Section 25(2) No. 2 TDDDG because it is strictly necessary to implement your choice.
You can change or withdraw your consent at any time with effect for the future by clicking “Cookie settings” in the footer of any page. The following overview is generated automatically by Cookiebot and lists the cookies and similar technologies we use, with their purpose, provider and storage period:
11. Google Analytics 4
We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to analyze and improve the reach, usage patterns and effectiveness of our website. Google Analytics is only loaded if you have consented to the “Statistics” category. The script is loaded from googletagmanager.com/gtag/js; this is the Google Analytics library (gtag.js), not Google Tag Manager, which we do not use. In particular, device and browser data, page views, time spent on pages, events, referrer information and approximate location information are processed. As events, we also record the successful submission of the “Ask a quick question” form and completed meeting bookings; Google does not receive the details you enter in the form. For this purpose, Google Analytics stores cookies (such as “_ga”) in your browser that allow your browser to be recognized on subsequent visits. According to Google, the IP addresses of users in the EU are only used to derive approximate location and are then discarded without being stored. Processing is based exclusively on your consent under Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. Without your consent, the tool remains deactivated. A transfer of data to Google LLC in the USA cannot be ruled out; Google LLC is certified under the EU-U.S. Data Privacy Framework (see Section 19). For more information, see https://policies.google.com/privacy. You may withdraw your consent at any time with effect for the future by adjusting your choice via the “Cookie settings” link in the footer.
12. Meta Pixel (Facebook Pixel)
We use the Meta Pixel on our website, provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The Meta Pixel allows us to track the behavior of website visitors after they click on a Meta ad, measure the success of our ads and build audiences for ad delivery. The Meta Pixel is only loaded if you have consented to the “Marketing” category. In particular, page views, the events “Lead” (successful submission of the “Ask a quick question” form) and “Schedule” (completed meeting booking), your IP address, device information, browser information and identifiers stored in cookies (such as “_fbp”) may be processed. Meta does not receive the details you enter in the form. Processing is based exclusively on your consent under Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. Without your consent, the Meta Pixel remains deactivated. The recipient is Meta Platforms Ireland Limited. We and Meta Platforms Ireland Limited are joint controllers (Art. 26 GDPR) for the collection of data on our website and its transmission to Meta; the details are set out in Meta’s joint controller agreement (https://www.facebook.com/legal/controller_addendum). Meta is solely responsible for any further processing after transmission. You can exercise your rights both against us and directly against Meta. A transfer of data to servers of Meta Platforms, Inc. in the USA cannot be ruled out; Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework (see Section 19). For more information on data processing by Meta, see https://www.facebook.com/privacy/policy. You may withdraw your consent at any time with effect for the future by adjusting your choice via the “Cookie settings” link in the footer.
13. HubSpot tracking code
If you have consented to the “Marketing” category, we load the HubSpot tracking code (for the provider, see Section 8; our account is hosted in HubSpot’s EU data center). It records which pages of our website you visit and when, and through which source you reached us, as well as device and browser information and your IP address. For this purpose, HubSpot stores cookies (such as “hubspotutk” and “__hstc”) and entries in your browser’s local storage. As long as we do not know who you are, this data is only associated with a pseudonymous identifier. When you submit the “Ask a quick question” form, we also transmit your email address to HubSpot via the tracking code. HubSpot then links your page views to your contact record in our CRM. This shows us which content you have viewed, so we can better understand your inquiry and respond appropriately. Without your consent, the tracking code remains deactivated; your inquiry is still stored in HubSpot (see Section 6), but it is not linked to your page views. Processing is based exclusively on your consent under Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. A transfer to HubSpot, Inc. in the USA cannot be ruled out; HubSpot, Inc. is certified under the EU-U.S. Data Privacy Framework (see Section 19). You may withdraw your consent at any time with effect for the future by adjusting your choice via the “Cookie settings” link in the footer. We delete page views already linked to your contact record at your request or together with your contact record (see Section 20).
14. Communication via video, chat and collaboration tools
Depending on the occasion, we use email, calendar, video conferencing, chat and collaboration services to communicate with prospects, customers, partners and service providers, in particular Google Workspace, Google Meet, Zoom, Microsoft Teams, Slack, Notion or Gather. In doing so, we process in particular master and contact data, organizational data, content of communications, appointment and meeting metadata, shared files and technical usage data. This processing serves to initiate, perform and document contractual and project relationships, to collaborate on projects and to communicate efficiently. The legal basis is Art. 6(1)(b) GDPR and, in addition, Art. 6(1)(f) GDPR. If recordings, transcriptions or AI-supported additional features are to be used, we will indicate this separately and review the legal basis separately.
15. Contract performance, project work and use of specialist tools
When initiating, carrying out and completing client projects, we process in particular contact person data, communication data, contract data, project and ticket information, access and authorization data and (depending on the project) data from the specialist systems used by the client. This may include in particular CRM, support, automation, integration, data and reporting tools such as HubSpot, Zendesk, Make, n8n, Zapier, Fivetran, dbt Labs, Google Cloud or Looker Studio, to the extent they are actually used in a specific project. Where we process such data on behalf of and on the instructions of our client, we act as a processor; primary responsibility under data protection law then lies with the respective client as the controller. In such cases, data subjects should generally contact our client first. The legal basis for processing our own contract and project data is Art. 6(1)(b) GDPR; where we act on behalf of a client, the legal basis is determined by the controller.
16. Accounting, invoicing and dunning
For invoicing, payment processing, receivables management and accounting, we process in particular master, contact, contract, billing and payment data of our customers, suppliers and business partners. The legal bases are Art. 6(1)(b) GDPR for contract processing, Art. 6(1)(c) GDPR for compliance with statutory retention and documentation obligations, and Art. 6(1)(f) GDPR for efficient receivables management. For this purpose, we may use in particular Lexware Office, Paywise and other finance and administration tools.
17. Applications and collaboration with freelancers and employees
If you apply to us or initiate a collaboration as a freelancer, we process the application and contract data you provide, such as master and contact data, résumé, qualifications, references, compensation information and correspondence. This processing serves to decide on establishing and carrying out an employment or freelance relationship and to administer the collaboration. The legal basis is Art. 6(1)(b) GDPR or Art. 88 GDPR in conjunction with applicable national law, where relevant.
18. Recipients and categories of recipients
We only transfer personal data to third parties if this is necessary for the purposes stated, if there is a legal obligation, if you have consented or if another legal permission under data protection law applies. Recipients may include in particular hosting and infrastructure providers, CRM and marketing service providers, communication and collaboration services, accounting and payment services, lawyers and tax advisors, banks, subcontractors and other technical service providers. The service providers used on this website are named in the respective sections. Where we use external service providers, they are engaged, where required, through data processing agreements or other contractual instruments that comply with data protection law.
19. Transfers to third countries
For some of the service providers we use, processing of personal data outside the European Union (EU) or the European Economic Area (EEA) cannot be ruled out, in particular with global cloud, communication, CRM and analytics providers. In such cases, we ensure that an adequate level of data protection is guaranteed. This may be done in particular through an adequacy decision, by concluding standard contractual clauses or through other safeguards permitted under Chapter V GDPR.
For the USA, the European Commission adopted an adequacy decision on July 10, 2023, the EU-U.S. Data Privacy Framework (DPF). Transfers to U.S. companies certified under the DPF are permitted on this basis. According to their own statements, the following companies named in this privacy policy are certified: Cloudflare, Inc., Google LLC, Meta Platforms, Inc., HubSpot, Inc. and Celonis, Inc. (Make). You can check their current status in the U.S. Department of Commerce list at https://www.dataprivacyframework.gov/list.
20. Storage period
We store personal data only for as long as necessary for the respective processing purposes or as required by statutory retention obligations. Relevant criteria for the storage period include in particular the completion of the handling of the inquiry or contract, the expiry of legitimate documentation and evidentiary interests, any limitation periods and retention obligations under commercial and tax law. We generally delete data that we process solely on the basis of consent after consent is withdrawn, unless another legal basis or retention obligation applies. You can find the storage period of cookies and similar technologies in the overview in Section 10.
21. Your rights
Subject to the statutory requirements, you have the right to access the personal data we process about you, to rectification of inaccurate data, to erasure, to restriction of processing, to data portability and to object to certain processing. Where processing is based on your consent, you may withdraw it at any time with effect for the future. You can change or withdraw your consent to cookies and similar technologies at any time via the “Cookie settings” link in the footer of any page. To exercise your rights, please use the contact details above.
22. Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data. The authority responsible for us is in particular the Hamburg Commissioner for Data Protection and Freedom of Information (Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit), Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany.