Privacy Policy
1) Controller
The controller responsible for data processing on this website under the GDPR is Lucky Systems GmbH, Mergenthalerallee 73-75, 65760 Eschborn, Germany, phone +49 173 4776461, email info@luckysystems.de.
2) Server logs and transport encryption
When you use our website for informational purposes only, our servers process technically necessary access data, in particular your IP address, date and time of access, requested URL, referrer, browser type, operating system, and transferred data volume. This processing is necessary to serve the website, maintain stability and security, and defend against misuse on the basis of Art. 6(1)(f) GDPR.
Our website is transmitted using TLS/SSL encryption.
3) Hosting
We host this website on servers within the European Union. As part of the hosting, the technically required data listed above is processed. Where necessary, we use processors under data processing agreements.
4) Cookies, local storage, and consent management
We use technically necessary storage mechanisms to save your consent decision, language preferences, and essential website state. The legal basis is Art. 6(1)(f) GDPR and, where storage is strictly necessary, Section 25(2) TDDDG.
We use a consent management tool for optional analytics. Analytics loads only after you explicitly opt in to the “Analytics” category. You can change or withdraw your choice at any time via the cookie settings in the footer.
5) Website analytics with PostHog Cloud EU
If you consent to analytics, we use PostHog Cloud EU for privacy-focused reach, landing-page, and conversion analytics on our website. The provider is PostHog Inc.; we use the EU cloud with data residency in Germany.
We intentionally limit this integration to a documented and narrow scope. We measure pageviews, landing pages, referrer domain and campaign parameters (for example UTM parameters), and a small set of manually defined interactions such as booking, CTA, service, language, and contact clicks. In that context, PostHog also processes the IP address and technical browser/device metadata that arise as part of web analytics; we restrict that processing to privacy-oriented project defaults (for example IP anonymization). We do not use autocapture, session recording, heatmaps, form data capture, surveys, marketing pixels, cross-domain tracking, or user identification.
The processing is based solely on your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time with future effect by reopening the cookie settings. After withdrawal, we do not load any further analytics functions.
More information about PostHog is available at posthog.com/privacy.
6) Contacting us by email
If you contact us by email, we process the information you submit solely to handle and respond to your request. The legal basis is Art. 6(1)(f) GDPR, and additionally Art. 6(1)(b) GDPR where the request relates to pre- contractual or contractual matters.
7) Appointment booking and embedded booking view
We link to our booking system at booking.luckysystems.de and embed a booking view on our contact page. When you open or use this functionality, your browser processes technically necessary connection data. If you book an appointment or submit information there, the data you enter is processed in order to handle your request and take pre-contractual steps.
We operate the booking system (Cal.com) ourselves on our servers in the European Union. We process in particular your name, email address, phone number where provided, the selected appointment, your answers in the booking form and campaign parameters from the booking link (e.g. UTM parameters). So that we can attend the appointment, it is transferred to our Google Calendar (Google Ireland Limited). The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps at your request).
8) Contact requests via ads on Facebook and Instagram (Lead Ads)
We run ads on Facebook and Instagram. Some ads contain a contact form provided by Meta ("Lead Ads"). If you complete this form, Meta transmits the information you choose to share (in particular name, email address, phone number and your answers in the form) as well as technical details about the ad (e.g. campaign, ad, time) to us.
We use this data only to contact you about your request, to offer you an appointment for the free initial consultation (potential analysis) and to measure how many requests and appointments result from our ads. The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps at your request) and, for evaluating our campaigns, Art. 6(1)(f) GDPR (legitimate interest in effective advertising). We use an advertising agency to manage the campaigns; it acts as our processor under Art. 28 GDPR, follows our instructions and may not use the data for its own purposes.
We and Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, are joint controllers (Art. 26 GDPR) for collecting the data in the form and transmitting it to us; we have concluded an agreement with Meta for this (Meta Controller Addendum). Meta alone is responsible for any further processing by Meta. Meta explains how it processes your data and which legal basis it relies on at facebook.com/privacy/policy, where you can also exercise your rights towards Meta. Meta may transfer data to the USA; Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework.
We delete requests that do not lead to an appointment or a collaboration no later than twelve months after the last contact. Data from a later collaboration is kept for as long as statutory retention obligations apply.
9) Recipients and third-country transfers
We disclose personal data only where necessary for the purposes described, where we are legally required to do so, or where you have consented. To the extent transfers to third countries cannot be fully excluded when using PostHog or other service providers, we rely on appropriate safeguards such as EU standard contractual clauses or applicable certifications.
10) Storage duration
We store personal data only for as long as necessary for the relevant purpose or for as long as statutory retention obligations apply. Consent-based processing ends no later than your withdrawal, unless legal obligations require otherwise.
11) Your rights
You have the statutory rights of access, rectification, erasure, restriction of processing, data portability, withdrawal of consent, and objection to processing based on Art. 6(1)(f) GDPR. You also have the right to lodge a complaint with a supervisory authority.