Privacy

01Controller

Georgia is not a member of the European Union and is not covered by an EU adequacy decision. Where we process personal data of individuals in the EU, the EEA or Switzerland, we do so on the basis of the appropriate safeguards described in section 8.

02Visiting this website

This website sets no cookies and uses no local storage, no tracking pixels and no advertising tools. Fonts, images and videos load from our own domain. That is why you see no cookie banner here: there is nothing to consent to.

Audience measurement with Umami

We measure how this website is used with Umami, an open-source analytics tool that we run ourselves (analytics.sabala-mentoring.com). Umami records the page requested, the referring source, the approximate region of origin, and the browser and device type. It sets no cookies, stores nothing on your device and builds no profiles across websites. IP addresses are not stored. The legal basis is our legitimate interest in privacy-friendly audience measurement (Art. 6(1)(f) GDPR). The software runs on Vercel Inc., and the analytics data is stored by Supabase Inc., both as our processors.

Server log files

When a page is requested, our hosting provider automatically records technical data: IP address, date and time, the page requested, referrer, browser and operating system. This is necessary to deliver the website and keep it secure (Art. 6(1)(f) GDPR). The provider deletes or anonymizes the logs after a short period and does not combine them with other data. Hosting is provided by Vercel Inc. as our processor. Vercel delivers this website through its global network.

03Your application through the form

You can send us an application via “Apply”. We then process the details you enter: name, brand name, email address, phone number, your current website if you wish, your industry, your plans and your message.

Your browser sends these details encrypted to a server function of our hosting provider Vercel in Frankfurt am Main. It checks them and forwards them as an email to our mailbox: applications in English to contact@luxus-websites.com, in German to kontakt@luxus-websites.com. At the same time, we send a confirmation to the email address you provided. The server function itself stores nothing.

We handle applications in our own email program. It sorts incoming messages, also with the help of an AI model that runs exclusively on our own computer. Your details are not passed to any other provider in the process.

A field that is invisible to people keeps automated spam out. It collects no data about you.

Legal basis

Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract) and your consent, given with the checkbox in the form (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future.

Provision

voluntary. We need the fields marked as required to review your application and reply to you.

Retention

as for inquiries by email (section 4): up to 24 months. If you tell us you are not interested, we delete your application within 30 days, except for what we must keep under tax or commercial law.

Recipients

Vercel (server function in Frankfurt am Main) and our email provider, both as processors. We do not sell application data or pass it on for other purposes.

04When you email or call us

When you contact us by email or phone, we process the information you provide, such as your name, your contact details and the content of your message. We use it to reply to you and to prepare a conversation.

To prepare, we look at your website and at publicly available information about your company, such as your visibility on Google and in AI answers, loading times and directory listings.

Legal basis

Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract) and Art. 6(1)(f) GDPR (legitimate interest in answering business inquiries).

Provision

voluntary. Without contact details we cannot reply.

Retention

we keep inquiries for up to 24 months so that we can continue conversations, and delete them afterwards. If you tell us you are not interested, we delete your inquiry within 30 days, except for what we must keep under tax or commercial law.

Recipients

only your contact person with us and our email provider as processor. We do not sell inquiry data or pass it on for other purposes.

05The appointment

If an appointment takes place as a video call, the conferencing service processes video, audio, names and technical connection data to the extent required for the call. We name the service in the invitation.

Recording only with your consent

We record a conversation only if you expressly agree at the start. We use the recording and its transcript solely to capture your wishes accurately and to prepare our proposal. For this we use Fathom (Fathom Video, Inc., USA) as our processor. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time. We delete recordings no later than twelve months after the conversation, or immediately on request.

06If you are our client

To carry out an assignment, we process your contract and contact data and the content you provide for your website and your brand (Art. 6(1)(b) GDPR). We keep invoicing data for the statutory periods. Where we process personal data on your behalf, for example when running your website or your inquiry form, we first conclude a data processing agreement with you.

07Processors we use

• Vercel Inc. (USA): hosting of this website, server log files and the server function of the application form (Frankfurt am Main region), and running the analytics tool Umami
• Supabase Inc. (USA): database of the analytics tool Umami
• Serverprofis GmbH (Germany): mailboxes, receiving and sending emails, data center in Germany
• Fathom Video, Inc. (USA): recording and transcription of conversations, only with your consent

Each of them acts on our documented instructions on the basis of a data processing agreement.

08International transfers

We are established in Georgia, and some of our processors are in the USA. Where personal data from the EU, the EEA or Switzerland is transferred to us or to these processors, the transfer is based on the European Commission’s standard contractual clauses, supplemented by technical measures, in particular encryption in transit. Where a provider is certified under the EU-US Data Privacy Framework, the transfer is additionally based on it. You can request a copy of the relevant safeguards from us.

09Your rights

You have the right to access your personal data, to have inaccurate data corrected, to erasure, to restriction of processing, to data portability and to object to processing based on legitimate interests. Where processing is based on consent, you can withdraw it at any time with effect for the future.

To exercise these rights, contact datenschutz@luxus-websites.com. We reply within 30 days. You also have the right to lodge a complaint with a data protection supervisory authority, in the EU usually the authority at your place of residence or work.

10Security

Transmission is encrypted (TLS), including the application form and the confirmation email. Messages arrive in a protected mailbox that only your contact person can access. We secure accounts with strong passwords and, where available, two-factor authentication.

11Changes

We update this policy when our processing changes. The date at the top always shows the current version.