Legal

Data Privacy Policy

Last updated: 28.02.2025

1. Introduction

1.1 Contact Details

The data controller is Lhotse Technologies GmbH, Mindspace, Münzstraße 12, 10178 Berlin, Germany.

Email: security@lhotse.de

Legal representative: Can Akin

Data protection officer: heyData GmbH, Schützenstraße 5, 10117 Berlin, Germany (datenschutz@heydata.eu)

1.2 Legal Bases for Processing

We process personal data based on the following legal grounds under GDPR:

  • Consent (Art. 6(1)(a) GDPR)
  • Contract performance (Art. 6(1)(b) GDPR)
  • Legal obligations (Art. 6(1)(c) GDPR)
  • Legitimate interests (Art. 6(1)(f) GDPR)

1.3 Data Transfers Outside the EEA

The security of data during transfer is guaranteed by adequacy decisions of the EU Commission for certain countries. For other transfers, standard contractual clauses apply per Art. 46(2)(b) GDPR.

1.4 Storage Duration

Data is deleted when no longer necessary for its purpose, unless legal retention obligations exist. Data may be restricted rather than deleted if required for other lawful purposes.

1.5 Data Subject Rights

You have the right to:

  • Access your personal data
  • Correction or deletion of your data
  • Restriction of processing
  • Object to processing
  • Data portability
  • Revoke consent at any time

Complaints may be filed with the competent data protection authority.

1.6 Data Provision Requirements

Mandatory data needed for business relationships is clearly marked. Without such data, contract formation or service provision may be refused.

1.7 Automated Decision-Making

We do not use fully automated decision-making processes in accordance with Article 22 GDPR.

1.8 Contact Communications

Contact inquiries are processed based on our legitimate interest to respond to questions. Data is deleted when no longer necessary or restricted per retention obligations.

1.9 Customer Surveys

Survey data collection relies on our legitimate interest in understanding customer preferences (Art. 6(1)(f) GDPR). Data is deleted after evaluation.

2. Newsletter

Existing customers may receive email offers unless they object. The legal basis is our legitimate interest in direct advertising.

Newsletter subscriptions require explicit consent via our website. Consent can be revoked at any time, e.g. by clicking the corresponding link in the newsletter.

We measure opening and click-through rates based on recipient consent. HubSpot (HubSpot, Inc., 25 1st Street, Cambridge, MA 02141, USA) handles newsletter distribution, processing data in the USA.

3. Data Processing on Website

3.1 Informative Website Use

During passive browsing, we collect: IP address, request timestamps, timezone data, page content, HTTP status codes, data transfer amounts, referrer information, and browser/OS details. This data is stored in log files and deleted when no longer necessary, at the latest after 14 days.

3.2 Web Hosting & CDN

Webflow (Webflow, Inc., 398 11th St., San Francisco, CA 94103, USA) hosts the website and provides content delivery. They process usage, content, and meta/communication data in the USA under standard contractual clauses.

3.3 Contact Form

Form submissions are stored to respond to inquiries based on legitimate interest (Art. 6(1)(f) GDPR). Data is deleted when no longer necessary or per retention obligations.

3.4 Vacant Positions

Job application data is processed for recruitment under Art. 88 GDPR and German Data Protection Act Section 26(1). Required application data is marked; additional information requires consent. Applicant data is shared with HR personnel, recruiters, and involved employees. Data is deleted six months post-rejection, or one year if consent for future consideration was granted.

3.5 Appointment Booking

Appointment scheduling relies on legitimate interest (Art. 6(1)(f) GDPR). Third-party tools may be used.

3.6 Technically Necessary Cookies

Cookies for language settings, search terms, and media playback are based on legitimate interest in providing functional website access (Art. 6(1)(f) GDPR).

3.7 Third-Party Services

  • Google Webfonts — Processes meta/communication data in the EU. Legal basis: Art. 6(1)(f) GDPR.
  • HubSpot LiveChat — Processes usage, content, and meta/communication data in the EU. Legal basis: Art. 6(1)(a) GDPR (consent).
  • HubSpot (CRM/Forms) — Processes usage, content, and meta/communication data in the EU. Legal basis: Art. 6(1)(f) GDPR.
  • Weglot — Translation service processing meta/communication data in the EU. Legal basis: Art. 6(1)(a) GDPR (consent).
  • Vimeo Videos — Video hosting processing usage and meta/communication data in the USA. Legal basis: Art. 6(1)(a) GDPR (consent).
  • Google Tag Manager — Analytics and advertising via Google Ireland Limited, processing data in the USA. Legal basis: Art. 6(1)(a) GDPR (consent) with standard contractual clauses.
  • YouTube Videos — Google Ireland Limited processes usage and meta/communication data in the USA. Legal basis: Art. 6(1)(a) GDPR (consent).
  • Google Analytics — Google Ireland Limited processes usage and meta/communication data in the USA. Legal basis: Art. 6(1)(a) GDPR (consent) with standard contractual clauses.
  • Webflow (Website Builder) — Processes usage and meta/communication data in the USA. Legal basis: Art. 6(1)(f) GDPR.
  • Microsoft Clarity — Analytics tool processing usage and meta/communication data in the EU. Legal basis: Art. 6(1)(a) GDPR (consent).
  • Calendly — Call scheduling processing usage, content, and meta/communication data in the USA. Legal basis: Art. 6(1)(a) GDPR (consent).

4. Data Processing on Social Media

We maintain profiles on multiple social media platforms where network operators process user behavior for advertising purposes.

4.1 Facebook

Profile operator: Facebook Ireland Ltd, 4 Grand Canal Square, Dublin 2, Ireland. Joint controllership arrangement exists under Art. 26 GDPR.

4.2 LinkedIn

Profile operator: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.

4.3 Xing

Profile operator: XING AG, Dammtorstraße 29-32, 20354 Hamburg, Germany.

5. Policy Changes

We reserve the right to modify this privacy policy prospectively. The current version remains available on our website.

6. Questions & Contact

For inquiries regarding this policy, please contact us at security@lhotse.de.