Privacy
1. Controller
Marco Penning – LUMVEO
Lattenkamp 96, 22299 Hamburg, Germany
Email: hello@lumveo.eu
2. Hosting and server logs
This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When the website is accessed, technically necessary connection and log data may be processed, including IP address, date and time, requested page or file, referrer URL, browser type, operating system and other technical connection data.
To the extent that this processing falls within our responsibility, the legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure, stable and efficient operation of the website and the prevention and analysis of technical attacks. Data is retained only as long as necessary for these purposes or to comply with legal obligations.
Vercel may also process data in the United States. According to Vercel, applicable safeguards for international transfers are used, including the EU-U.S. Data Privacy Framework and, where required, the European Commission's Standard Contractual Clauses.
3. Contact by email and website form
If you contact us by email, we process the information you provide, including your contact details and message content, in order to handle your request. The legal basis is Article 6(1)(b) GDPR where the communication relates to steps prior to entering into a contract or performance of a contract; otherwise Article 6(1)(f) GDPR based on our legitimate interest in responding to business enquiries.
On lumveo.eu and lumveo.de you can also write to us through a contact form. We process the details you enter: name, company, email address, your message and, on lumveo.eu, optionally your website and the starting point you selected (for example “Explore”). Purpose and legal basis are the same as for contact by email.
Delivery through Resend. Form entries are passed through our web server at Vercel (see section 2) to the email delivery service Resend, which turns them into an email and delivers it to our mailbox. The provider is Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, USA. Resend acts as our processor; we have concluded a data processing agreement with Resend under Article 28 GDPR. Emails are sent from the EU data centre we selected (Ireland). Resend stores account and delivery data such as sender, recipient, time and delivery status in the United States. Resend is certified under the EU-U.S. Data Privacy Framework, so the transfer is based on the European Commission’s adequacy decision (Article 45 GDPR); the Commission’s Standard Contractual Clauses also form part of the agreement. More information: Resend privacy policy, sub-processors.
Spam protection. The form contains a field that is invisible to people and checks how long filling it in took, so automated submissions can be recognised. No cookies are set and no additional data is stored for this. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is protection against spam and abuse.
Server log. When a form is submitted, our hosting provider Vercel’s runtime logs record only whether delivery succeeded and on which website. Form contents, names and email addresses are not logged.
Fallback through your email application. If form delivery is temporarily unavailable, your local email application may open with a prepared message, depending on your device. In that case the message only reaches us if you send it yourself, and the rules for email communication apply.
Retention. Your enquiry is kept as an email in our mailbox. We delete it when the matter has been completed and no statutory retention obligation or other legitimate reason requires further storage. Resend keeps delivery logs for a limited period under its contractual terms.
4. External links, including LinkedIn
This website contains links to external services, including LinkedIn. No LinkedIn social plugin or embedded LinkedIn tracking element is integrated. Data may be processed by the external provider under its own privacy terms only after you choose to follow the external link and leave this website.
5. Optional website measurement, browser storage and fonts
With your consent, we measure page visits, selected link and call-to-action clicks, the start of contact-form entry and the result of a submitted contact form: either “sent” (delivered to our mail service) or “mailto_handoff” (handed to your email application, which does not establish that you sent an email). The purpose is to understand which market-entry pages and contact routes are useful.
Measurement is off until you select “Allow measurement”. You can decline without affecting the website or contact form and withdraw consent at any time through “Privacy settings”. The legal basis for optional measurement is Article 6(1)(a) GDPR and, for access to or storage on your device, Section 25(1) TDDDG. Withdrawal does not affect processing carried out before withdrawal.
Event data contains only the event type, an approved page path, the first measured page in the tab, a coarse referrer category, an approved source and medium category, and an approved destination or the contact-form outcome (“sent” or “mailto_handoff”). Full referrer URLs, arbitrary query parameters, names, email addresses, message text and visitor identifiers are not included in event payloads. Unknown sources are grouped as “other”. We do not use fingerprinting, advertising profiles or cross-site tracking.
Your allow/decline choice is stored in sessionStorage as “lumveo-measurement-choice-v1” to respect your preference in this browser tab. Only after consent, “lumveo-measurement-entry-v1” stores the limited entry context described above. It is removed when you withdraw consent; both entries normally expire when the tab session ends. No analytics cookies are set.
Events are sent to our own website endpoint and recorded in the hosting provider Vercel’s runtime logs. They are available within the hosting plan’s short log-retention window, currently up to one hour; no separate long-term analytics database is used. The hosting provider may process connection data, including your IP address, when receiving these requests as described in section 2. The application does not copy IP addresses or browser identifiers into the measurement event. The same hosting and international-transfer safeguards described in section 2 apply.
We do not integrate Google Analytics, Google Tag Manager, Meta Pixel, LinkedIn Insight Tag, Hotjar or Microsoft Clarity. Web fonts are served from the website bundle. More information is available in our cookie information.
6. Retention
Unless a more specific retention period is stated above, personal data is stored only for as long as necessary for the relevant purpose. Statutory retention duties, including tax and commercial-law requirements, remain unaffected.
7. Your rights
Subject to the statutory requirements, you have rights including access, rectification, erasure, restriction of processing and data portability. Where processing is based on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation.
8. Right to lodge a complaint
You have the right to lodge a complaint with a data-protection supervisory authority. The supervisory authority responsible for our place of establishment is, in particular, the Hamburg Commissioner for Data Protection and Freedom of Information.
9. Status and changes
Last updated: October 2026. We update this notice if the website, the services used or applicable legal requirements change.