Privacy Policy

This statement explains which personal data we process when you visit this website, on what legal basis this happens, and what rights you have.

This is a convenience translation of the German original. In the event of any discrepancy, the German version prevails.

Contents

• 1. Controller and contact
• 2. Your rights
• 3. Provision of the website and server log files
• 4. Cookies and similar technologies
• 5. Contacting us and booking appointments
• 6. Recipients and transfers to third countries
• 7. Retention periods
• 8. Data security
• 9. Changes to this statement

1. Controller and contact

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Otto ID Solutions GmbH Vilbeler Landstr. 36 60386 Frankfurt am Main Germany

Represented by the Managing Director Karsten Otto

Email: info@otto-id.com

Commercial register: Local Court of Frankfurt am Main, HRB 116593

Leanwave is a trading name of Otto ID Solutions GmbH.

We have not appointed a data protection officer, as the conditions of § 38 BDSG do not currently apply to us. For any data protection matter you can reach us at the address above or by email at info@otto-id.com.

2. Your rights

With regard to your personal data you have the following rights against us:

• Access (Art. 15 GDPR): you can find out whether and which data we process about you.
• Rectification (Art. 16 GDPR): you can have inaccurate data corrected and incomplete data completed.
• Erasure (Art. 17 GDPR): you can request the erasure of your data, unless statutory retention obligations prevent it.
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR): you can receive the data you provided in a structured, commonly used and machine-readable format.
• Withdrawal of consent (Art. 7 (3) GDPR): you can withdraw consent you have given at any time with effect for the future. The lawfulness of processing carried out until then remains unaffected.

Right to object under Art. 21 GDPR

Where we process data on the basis of a legitimate interest under Art. 6 (1) (f) GDPR, you have the right to object to that processing at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

Where we process your data for the purpose of direct marketing, you may object at any time without giving reasons. Your data will then no longer be used for that purpose.

Exercising your rights

A message to info@otto-id.com is sufficient. We will respond without undue delay and at the latest within one month of receiving your request. This period may be extended by a further two months where necessary because of the complexity or the number of requests; in that case we will inform you of the extension and the reasons for it.

Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement. The authority responsible for us is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit Wilhelmstraße 7, 65185 Wiesbaden (Postfach 3163, 65021 Wiesbaden) https://datenschutz.hessen.de

3. Provision of the website and server log files

When you access this website, your browser automatically transmits data to our hosting provider. The following in particular is recorded:

• IP address of the requesting device
• date and time of access
• name and URL of the file retrieved
• referrer URL
• browser type and version
• operating system
• volume of data transferred and notification of successful retrieval

This processing is technically necessary in order to deliver the website, to ensure its stability and security and to defend against attacks. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in the secure and trouble-free operation of the website.

Hosting

The website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Vercel processes the data mentioned above on our behalf as a processor under Art. 28 GDPR. This website is served from servers in Frankfurt am Main; access from the USA cannot be technically excluded. Vercel is certified under the EU-U.S. Data Privacy Framework; the European Commission has determined an adequate level of data protection for certified companies. Standard contractual clauses apply in addition.

Privacy notice: https://vercel.com/legal/privacy-notice

Server log files are deleted after 30 days.

4. Cookies and similar technologies

On this website we use exclusively technically necessary cookies and comparable technologies such as localStorage.

They enable the basic operation of the website, for example storing your language selection. They are set without consent pursuant to § 25 (2) no. 2 TDDDG; the legal basis for the subsequent processing is Art. 6 (1) (f) GDPR.

When you first visit the website, a notice asks whether you wish to allow statistics or marketing technologies beyond the technically necessary ones. We store your decision in your browser (localStorage, key leanwave.cookieConsent.v1) so that we do not have to ask again on every visit. This storage is necessary in order to give effect to your decision, § 25 (2) no. 2 TDDDG.

You can change or fully withdraw your selection at any time via “Manage Cookies” in the footer of the website.

We do not use any technologies for analytics, reach measurement or marketing on this website. No evaluation of your usage behaviour and no profiling takes place.

You can delete cookies in your browser or restrict their storage in general. If cookies are blocked entirely, individual functions of this website may be limited.

We do not respond separately to “Do Not Track” signals from your browser, as there is no uniform standard for this and we do not use any technologies that would require such control.

5. Contacting us and booking appointments

Contact form

If you write to us using the form on our contact page, we process the data you enter: name, company, email address, telephone number and your message. We also store the time of submission.

The purpose is to handle and respond to your enquiry. The legal basis is Art. 6 (1) (b) GDPR where your enquiry is directed at concluding or performing a contract, and otherwise Art. 6 (1) (f) GDPR with our legitimate interest in responding to enquiries.

Form submissions are transmitted by email to our mailbox and processed there. They are not stored in an external database.

The website and the form endpoint are operated on our behalf by EL Industries GmbH, Bahnhofstraße 17, 92637 Weiden i.d.OPf., Germany, as a processor under Art. 28 GDPR.

For sending the notification we use Sendinblue SAS (Brevo), 17 rue de Salneuve, 75017 Paris, France, as a further processor. Brevo processes your details for the purpose of delivery and stores sending logs for a limited period. The processing takes place within the European Union, so no transfer to a third country is involved.

Privacy notice: https://www.brevo.com/legal/privacypolicy/

Email and telephone

If you contact us directly by email or telephone, we process your contact details and the content of your message for the same purpose and on the same legal basis.

Booking appointments

We use Calendly to arrange appointments. When you click “Book a meeting” on our contact page, you are redirected to a Calendly page. Data is transmitted to Calendly only when that page is opened; no Calendly script is embedded on our own website.

Provider: Calendly LLC, 271 17th St NW, Atlanta, GA 30363, USA. When you book, we process your name, your email address, the appointment you selected and the details you provide in order to organise the meeting. The legal basis is Art. 6 (1) (b) GDPR. Calendly acts as a processor on our behalf; the transfer to the USA is based on the EU-U.S. Data Privacy Framework or, in addition, on standard contractual clauses.

Privacy notice: https://calendly.com/legal/privacy-notice

Erasure

We delete your enquiries once they have been dealt with conclusively and no statutory retention obligations prevent it, at the latest 24 months after the last contact.

6. Recipients and transfers to third countries

We do not pass your personal data to third parties for our own commercial purposes, and we neither sell nor rent it.

Access to your data is granted exclusively to:

• those of our employees who need the data to perform their duties,
• the service providers named in this statement, whom we have engaged as processors under Art. 28 GDPR,
• authorities and courts, insofar as we are legally obliged to provide information.

Transfers to third countries

Some of the service providers we use are based outside the European Union, predominantly in the USA. For providers certified under the EU-U.S. Data Privacy Framework, the European Commission determined an adequate level of protection by decision of 10 July 2023. In all other cases we base the transfer on standard contractual clauses under Art. 46 (2) (c) GDPR and, where applicable, on your explicit consent under Art. 49 (1) (a) GDPR.

We point out that a level of data protection fully comparable to that of the EU need not exist in third countries and that access by state authorities cannot be excluded in every case.

Which service providers we use, where they are based and what each transfer is based on can be found in section 3 and in section 5.

Transfer of the business

Should we become part of a merger, an acquisition or a sale of the business, personal data may pass to the acquirer. We ensure that this happens while preserving confidentiality, and we inform affected individuals in advance on our website or by email.

7. Retention periods

We store personal data only for as long as is necessary for the respective purpose or as required by statutory retention obligations.

For documents of tax or commercial law relevance, the retention periods under § 147 AO and § 257 HGB apply. Once the respective period has expired, we delete the data or restrict its processing.

The specific retention periods for individual processing activities can be found in the relevant sections of this statement.

8. Data security

Data is transmitted between your browser and our website in encrypted form via TLS. You can recognise this in the address bar of your browser.

We take technical and organisational measures under Art. 32 GDPR to protect your data against unauthorised access, loss and alteration, and we continuously adapt them to the state of the art. Complete protection against every conceivable attack is not technically achievable.

In the event of a personal data breach, we fulfil our notification and communication obligations under Art. 33 and 34 GDPR.

9. Changes to this statement

We adapt this privacy statement when our processing activities or the legal framework change. The version published on this page applies in each case. We will additionally inform you of material changes on our website or by email.

If you have any questions, you can reach us at info@otto-id.com.