Privacy policy

The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Benjamin Okkenga, Wieselweg 7, 49733 Haren (Ems), Germany, email: mail@luna-and-elio.com.

The controller for the processing of personal data is the natural or legal person who alone or jointly with others determines the purposes and means of processing personal data.

If you use our website for information purposes only, that is, if you do not sign up for the newsletter or send us information in any other way, we only collect the data your browser transmits to the server (known as server log files): the page visited, the date and time of access, the amount of data sent, the source or referrer from which you reached the page, the browser used, the operating system used and the IP address used.

Processing takes place pursuant to Art. 6 (1) (f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data is not passed on or used in any other way. We do, however, reserve the right to review the server log files retrospectively should concrete indications suggest unlawful use.

For security reasons and to protect the transmission of personal data, this website uses SSL or TLS encryption. You can recognize an encrypted connection by the string https:// and the padlock symbol in your browser bar.

We use Lovable Labs Incorporated for hosting our website and displaying its content. All data collected on our website is processed on this provider's servers. We have concluded a data processing agreement with the provider which safeguards the data of our visitors and prohibits unauthorized disclosure to third parties.

We also use a content delivery network from the following provider: Cloudflare Inc., 101 Townsend St, San Francisco, CA 94107, USA. This service enables us to deliver page content faster through a network of regionally distributed servers. Processing takes place to safeguard our legitimate interest in improving the stability and functionality of our website pursuant to Art. 6 (1) (f) GDPR. We have concluded a data processing agreement with this provider as well.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which ensures compliance with the European level of data protection on the basis of an adequacy decision of the European Commission.

We analyze how this website is used, on two levels. Without your consent, only our own server counts visits, with no cookie to recognize you; the only cookies placed on your device are then strictly necessary ones, such as the one that stores your choice itself (le_einwilligung, see below). Only if you choose “Accept all” in the cookie notice do we add a cookie that lets us recognize you when you return, along with the analytics service Metricool. You can change your choice at any time through the “Privacy settings” link in the footer.

Without consent, we use a measurement tool of our own to record the time of a page view, the page visited, the website that brought you to us, campaign details in the address (known as UTM parameters), the country, the type of device (phone, tablet or computer, derived from your browser's identifier), the sections of the page you saw, the links and buttons you clicked, the part of the page and the kind of spot (image, text or other surface) where you clicked several times in quick succession or without any effect (but not where exactly you clicked), the field of the sign-up form you tapped, whether an entry failed validation because the email field was empty or invalid or the consent box was not checked (but never the entry itself), whether you submitted the sign-up and confirmed it through the link in the confirmation email, and technical error messages from your browser with file name and line number, truncated and without web addresses. This counting takes place within our own infrastructure, not through an external analytics service. We do not store your IP address in the process: together with your browser's identifier, it goes into a code number whose key changes every day, so visits on different days cannot be linked to one another. The legal basis is our legitimate interest pursuant to Art. 6 (1) (f) GDPR. You can object to the counting at any time, either with the “Object to visit counting” button at the end of this section or without any formalities by email to the address given above. Once you have objected, the website no longer counts visits from this browser, sets no cookie to recognize you and does not load Metricool; the only thing stored is the objection itself, in the cookie le_einwilligung.

The measurement data is held in a database operated by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, which is restricted to data centers in the European Union. We delete individual entries after 400 days; after that, only daily totals remain.

With your consent, we also set the cookie le_b. It contains the code number of the day on which you consented and keeps it for six months. This lets us tell whether you come back and on which visit you, for example, sign up for the newsletter. Without our secret key, the code number cannot be traced back to any IP address.

Also only with your consent, we load the web analytics service of Metricool Software, S.L., c/ Téllez 12, Entreplanta H, 28007 Madrid, Spain. This loads a script from the provider's server at tracker.metricool.com, which also reads the size of your browser window. It records page views and visits, the approximate origin by country and region, and the source that brought you to us; what we receive are aggregated figures, not details about individual people. We have concluded a data processing agreement with the provider; according to its own statements, the data is processed on servers within the European Union.

The legal basis for the le_b cookie and for Metricool is your consent pursuant to Section 25 (1) of the German TDDDG and Art. 6 (1) (a) GDPR. You may withdraw it at any time with effect for the future by choosing “Accept necessary only” under “Privacy settings” in the footer. We then delete the le_b cookie from your device, and Metricool is no longer loaded. Withdrawal does not affect the lawfulness of processing carried out beforehand.

Beyond that, this website embeds no advertising services, no maps, no videos and no fonts from third-party servers. All fonts and images are hosted on our own server.

This website also sets three strictly necessary cookies. __cf_bm comes from Cloudflare, distinguishes human visitors from automated access and expires after 30 minutes. __dpl is set by our hosting provider when a page is opened, expires after 24 hours and ties the files loaded to the version of the website currently published; its version marker is the same for every visitor. le_einwilligung stores nothing but your choice, saved in German: “ja” (yes) or “nein” (no) from the cookie notice for six months, so that we do not have to ask you again on every visit, or “widerspruch” (objection) for twelve months once you have objected to the counting. Cookies of this kind require no consent under Section 25 (2) no. 2 TDDDG.

Your browser stores your scroll position in session storage so that you return to the same place when going back. That entry contains no personal data and is deleted as soon as you close the tab.

When you contact us (for example by email), personal data is processed exclusively for the purpose of handling and answering your inquiry and only to the extent necessary for that purpose. The legal basis for processing this data is our legitimate interest in answering your inquiry pursuant to Art. 6 (1) (f) GDPR.

Your data is deleted once the circumstances indicate that the matter concerned has been conclusively settled, provided that no statutory retention obligations prevent this.

If you sign up for the newsletter, we process your email address, the time of sign-up and the language version you used.

Sign-up uses double opt-in: you first receive an email with a confirmation link. Only when you click it do we add you to the list. This makes sure nobody can enter somebody else's address.

The legal basis is your consent pursuant to Art. 6 (1) (a) GDPR. You may withdraw it at any time with effect for the future, through the unsubscribe link in every email or informally to the address given above. Withdrawal does not affect the lawfulness of processing carried out beforehand.

We use the following provider to send the newsletter: Brevo GmbH, Koepenicker Str. 126, 10179 Berlin, Germany. We have concluded a data processing agreement with the provider which protects the data of our visitors and prohibits disclosure to third parties.

Your address remains stored until you unsubscribe. After that we keep it only as long as necessary to prevent it being added again.

Applicable data protection law grants you the following rights vis-a-vis the controller regarding the processing of your personal data: right of access pursuant to Art. 15 GDPR; right to rectification pursuant to Art. 16 GDPR; right to erasure pursuant to Art. 17 GDPR; right to restriction of processing pursuant to Art. 18 GDPR; right to notification pursuant to Art. 19 GDPR; right to data portability pursuant to Art. 20 GDPR; right to withdraw consent given pursuant to Art. 7 (3) GDPR; right to lodge a complaint pursuant to Art. 77 GDPR.

Right to object: where we process your personal data on the basis of our overriding legitimate interest following a balancing of interests, you have the right at any time to object to this processing with effect for the future on grounds relating to your particular situation. If you exercise your right to object, we will end the processing of the data concerned. Further processing remains reserved if we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or if the processing serves the establishment, exercise or defense of legal claims.

If we process your personal data for direct marketing purposes, you have the right to object to this processing at any time. If you exercise that right, we will end the processing for direct marketing purposes.

The supervisory authority responsible for us is the State Commissioner for Data Protection of Lower Saxony, Prinzenstrasse 5, 30159 Hannover, Germany.

The duration of storage of personal data is determined by the respective legal basis, the purpose of processing and, where applicable, the relevant statutory retention period.

Where processing is based on express consent pursuant to Art. 6 (1) (a) GDPR, the data concerned is stored until you withdraw your consent.

Where processing is based on Art. 6 (1) (f) GDPR, the data is stored until you exercise your right to object pursuant to Art. 21 (1) GDPR, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms.

Otherwise, stored personal data is deleted when it is no longer necessary for the purposes for which it was collected or otherwise processed.