+49 6772 9198690
Book a call →
Rechtliches

Privacy policy

This is a translation of our German legal texts, provided for convenience. In the event of any discrepancy, the German version at lucksmith.de is the legally binding one.

1. Data protection at a glance

General information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data by which you can be personally identified. For detailed information on data protection, please refer to this privacy policy.

2. Controller

The controller responsible for data processing on this website is:

LUCKSMITH e.K.
Dennis Acker
Untere Trift Straße 11
56357 Bogel
Germany

Telephone: +49 6772 9198690
Email: info@lucksmith.de

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

3. General information and mandatory disclosures

Legal bases for processing

We process personal data on the basis of the GDPR, in particular for the performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR), on the basis of your consent (Art. 6(1)(a) GDPR), to comply with legal obligations (Art. 6(1)(c) GDPR) and to safeguard our legitimate interests (Art. 6(1)(f) GDPR).

Withdrawal of your consent

Many data processing operations are only possible with your express consent. You can withdraw consent you have already given at any time. The lawfulness of the data processing carried out up to the withdrawal remains unaffected by the withdrawal.

SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, this site uses SSL/TLS encryption. You can recognise an encrypted connection by the “https://” prefix and the padlock symbol in your browser bar.

4. Hosting and server log files

We host the content of our website on our own servers (CIAB platform) in data centres in Germany. When the website is accessed, the server automatically collects and stores information in what are known as server log files, which your browser transmits automatically. These are: browser type and version, operating system used, referrer URL, host name of the accessing computer, time of the server request and the IP address. This data is not merged with other data sources. The legal basis is Art. 6(1)(f) GDPR; we have a legitimate interest in the technically error-free presentation and the security of our website.

5. Cookies and consent

Our website uses cookies. Cookies are small text files and do no harm to your device. Technically necessary cookies are set on the basis of Art. 6(1)(f) GDPR or § 25(2) TDDDG. Non-essential cookies as well as the loading of external services (e.g. analytics and marketing services) only take place with your consent via our cookie banner (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can adjust or withdraw your selection at any time via the cookie settings.

6. Enquiry and contact form

If you send us enquiries via the project enquiry or contact form, the details you provide in the form (name, email address, telephone number, company and your message) are stored by us for the purpose of processing the enquiry and in case of follow-up questions. Processing takes place in order to carry out pre-contractual measures or to perform a contract (Art. 6(1)(b) GDPR) and otherwise on the basis of our legitimate interest in processing the enquiry (Art. 6(1)(f) GDPR) as well as, where applicable, your consent (Art. 6(1)(a) GDPR). The data remains with us until the purpose of storage ceases to apply or you ask us to delete it and no statutory retention obligations prevent this.

7. Web analytics with Matomo

This website uses the open-source web analytics service Matomo. The processing serves to analyse and improve our offering. Matomo runs on our own servers; the data collected remains with us and is not passed on to third parties. Where consent is requested, processing takes place exclusively on the basis of Art. 6(1)(a) GDPR; otherwise the legal basis is our legitimate interest in anonymised reach measurement (Art. 6(1)(f) GDPR). IP addresses are processed in anonymised form.

8. Google Fonts

This site uses what are known as Google Fonts, provided by Google, for the uniform display of typefaces. When you call up a page, your browser loads the required fonts from servers of Google Ireland Limited or Google LLC, whereby your IP address is transmitted to Google. This may involve a transfer to the USA. Use takes place on the basis of your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG) where such consent is requested, and otherwise on the basis of our legitimate interest in a uniform presentation (Art. 6(1)(f) GDPR). Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

9. Google Ads and conversion tracking

We use Google Ads including conversion tracking (Google tag). If you reach our website via a Google advertisement and perform an action (e.g. submit an enquiry), Google can evaluate this in order to measure the effectiveness of advertisements. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; this may involve a transfer to the USA.

Two states, two legal bases. We use what is known as consent mode (Google Consent Mode v2). This means:

Before you consent, the Google tag is loaded, but with storage blocked: no cookies are set and no identifiers are stored on or read from your device. Only cookieless signals including your IP address are transmitted. The legal basis for this is our legitimate interest in a basic measurement of advertising effectiveness (Art. 6(1)(f) GDPR). You may object to this processing at any time under Art. 21 GDPR – an informal message to the address given under section 2 is sufficient.

After you consent via the cookie banner, cookies are additionally set and information is stored on and read from your device. The legal basis is then your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time with effect for the future by opening the cookie settings again in the footer of any page and selecting “Essential only”; storage is then blocked again.

10. Google Analytics 4

Where a measurement ID is stored in our settings, we use Google Analytics 4 for reach measurement. The service is integrated via the same Google tag as the conversion tracking described under section 9; the same consent mode applies.

Before you consent, no cookies are set and no identifiers are stored on or read from your device. Cookieless signals including your IP address are transmitted; from these, Google derives modelled metrics that cannot be traced back to you. The legal basis is our legitimate interest in a basic measurement of reach (Art. 6(1)(f) GDPR). You may object to this at any time under Art. 21 GDPR.

After you consent, cookies are additionally set and information is stored on and read from your device. What is then processed includes in particular the pages you visit, the time you spend, your approximate location at city level, the device and browser used and the source of the visit. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which can be withdrawn via the cookie settings in the footer of any page.

According to the provider, the IP address is truncated by Google Analytics 4 and not stored permanently. The retention of event-related data depends on the setting in the Google account; the default is 14 months. A transfer to the USA cannot be ruled out. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

11. Meta pixel (Facebook and Instagram)

Where a pixel ID is stored in our settings, we use the Meta pixel in order to measure the effectiveness of our advertisements on Facebook and Instagram and to display suitable advertisements there.

Before you consent, the pixel script is loaded from a Meta server, but is set to “denied”: it sends no events and sets no cookies. When the script is loaded, your IP address is transmitted to Meta; this cannot be avoided technically. The legal basis for this is our legitimate interest in keeping the measurement setup operational (Art. 6(1)(f) GDPR). You may object to this at any time under Art. 21 GDPR.

After you consent, the pixel is enabled. It then sets cookies on your device (in particular _fbp and _fbc) and transmits to Meta which pages you visit and whether you submit an enquiry. Details about your browser and device are also transmitted. If you are logged in to Facebook or Instagram, Meta can associate this information with your user account there. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). If you withdraw consent, the pixel is set back to “denied” and the cookies mentioned are deleted.

For the collection and transmission of data via the pixel we are joint controllers with Meta (Art. 26 GDPR). The essential content of this agreement is available at facebook.com/legal/controller_addendum. Meta is solely responsible for the subsequent processing of the data.

You can withdraw your consent at any time via the cookie settings in the footer of any page; the cookies set by the pixel are deleted in the process. Independently of this, you can object to the use of your data for advertising purposes in the settings of your Meta account. A transfer to the USA cannot be ruled out. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

12. Google Tag Manager

Where a container ID is stored in our settings, we use Google Tag Manager. It does not itself process personal data for its own purposes, but is a tool with which the services described under sections 9 to 11 can be managed and delivered. When the container is loaded, your IP address is transmitted to Google; this cannot be avoided technically.

The consent requirements apply here too: the container adopts the state you have set via the cookie settings and only releases the services it manages after you have consented. The legal basis for loading the container is our legitimate interest in a maintainable measurement setup (Art. 6(1)(f) GDPR); the bases stated in each case apply to the services delivered through it. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

13. LinkedIn Insight Tag

Where a partner ID is stored in our settings, we use the LinkedIn Insight Tag in order to measure the effectiveness of our advertisements on LinkedIn and to display suitable advertisements there.

The tag is loaded solely after your express consent. If you decline or make no selection, it is not integrated and no processing takes place. There is no cookieless intermediate state here as there is with the Google services.

After you consent, the tag sets cookies on your device (in particular li_sugr, UserMatchHistory, lidc and bcookie) and transmits to LinkedIn which pages you visit. Your IP address and details about your browser and device are also transmitted. If you are logged in to LinkedIn, LinkedIn can associate this information with your member account there. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

For the collection and transmission of data via the tag we are joint controllers with LinkedIn (Art. 26 GDPR); LinkedIn provides the essential content of the agreement. LinkedIn is solely responsible for the subsequent processing. You can withdraw your consent at any time via the cookie settings in the footer of any page; the cookies mentioned are deleted in the process. A transfer to the USA cannot be ruled out. The provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.

14. Payment processing via Stripe

For processing payments (e.g. when an offer is accepted) we use the payment service provider Stripe. If you enter payment details, these are transmitted directly to Stripe and processed there; we ourselves do not receive complete payment instrument data. The legal basis is performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in secure payment processing (Art. 6(1)(f) GDPR). Provider: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. Further information: https://stripe.com/de/privacy.

15. Free initial website analysis

On the “Free website analysis” page you can request an automated examination of a website. The following is processed: the internet address you enter, your email address, optionally company name, contact person and telephone number, the time of your consent as well as your IP address and your browser identifier.

Voluntary details on key figures. You may additionally state revenue, balance sheet total, net profit, number of employees and financial year. These fields are expressly voluntary; the analysis runs in full without them. We use the details solely in order to express the result for you in euros rather than as a percentage. They are not published, not passed on to third parties and not used for credit assessment.

What happens during the measurement. Our software retrieves publicly accessible pages of the address given – at most 50 pages at one request per second – and evaluates technical characteristics (loading time, accessibility, security headers, structured data, findability for AI crawlers). Only content that any visitor to the respective page can likewise retrieve is collected.

Evaluation by an AI on our own servers. To formulate the findings we use language models that run on our own infrastructure in Germany. No transmission to OpenAI, Google, Anthropic or other providers takes place, and the content processed is not used to train models.

Processing in our own analysis tool. The analysis runs in an application operated by ourselves on our own infrastructure. This does not create a processor relationship with a third party; it is the same controller as named under section 2.

Legal bases. Sending the result by email takes place on the basis of your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future. Carrying out the analysis itself takes place in order to perform pre-contractual measures at your request (Art. 6(1)(b) GDPR). The storage of the IP address serves solely to limit abusive requests and is based on our legitimate interest in protecting our systems (Art. 6(1)(f) GDPR).

Retention period. We keep the request, the record of consent and the measurement result for the duration of the business initiation and beyond that for as long as is necessary to demonstrate consent; otherwise we delete them as soon as the purpose ceases to apply or you request deletion and no statutory retention obligations prevent this. The IP address stored to limit abuse expires after 24 hours at the latest.

If you enter a third-party website. Please only request analyses for websites for which you are responsible or for which you have been commissioned. We do not carry out an analysis for domains that belong to us or that we have blocked.

Paid reports. If you subsequently decide on a paid report, section 14 of this policy applies to the payment processing.

16. Your rights

Within the scope of the applicable statutory provisions, you have the right at any time to free information about your stored personal data (Art. 15 GDPR), its origin and recipients and the purpose of the processing, as well as, where applicable, a right to rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and objection (Art. 21 GDPR). You can contact us at any time regarding this and any further questions on data protection.

Right to lodge a complaint with the supervisory authority

In the event of infringements of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the member state of their habitual residence, their place of work or the place of the alleged infringement. The supervisory authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz).