LimeByte

01Legal text

Privacy Policy of LimeByte GmbH

How we process personal data when you visit this website or contact us – and what rights you have.

This English version is provided for convenience. In case of any discrepancy, the German version prevails.

1. Controller

The controller responsible for the processing of personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

LimeByte GmbH
Im Mediapark 5
50670 Cologne
Germany

Represented by its managing director, Martin Stroschein
Phone: +49 221 16834135
Email: info@limebyte.de

For questions about data protection and to exercise your rights, please contact us at this email address or by post at the address above.

2. Summary

  • This website sets no cookies and uses no analytics, tracking or advertising services.
  • When you visit, your browser does not connect to any third-party servers: we serve fonts, images, scripts and the location map ourselves. Only once you start filling in the contact form does the spam check by Cloudflare load (section 10).
  • Our server logs store your IP address only in shortened form.
  • Information you send us via the contact form, by email or by phone is used solely to handle your request.
  • We do not sell personal data or pass it on for advertising purposes.

Each processing operation is explained in detail below.

We only process personal data where the law permits it. The relevant legal bases are in particular:

  • Art. 6(1)(a) GDPR – your consent;
  • Art. 6(1)(b) GDPR – the performance of a contract with you or pre-contractual steps taken at your request;
  • Art. 6(1)(c) GDPR – compliance with legal obligations, such as retention obligations under commercial and tax law;
  • Art. 6(1)(f) GDPR – our legitimate interests, unless your interests or fundamental rights override them;
  • Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) – for storing information in your browser where this is strictly necessary for a service you have explicitly requested.

We state the applicable legal basis for each processing operation.

4. Hosting

This website runs on servers operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located in a data centre in Falkenstein/Vogtland, Germany. Hetzner processes the data generated when you visit the website solely on our behalf and on our instructions; we have concluded a data processing agreement with Hetzner in accordance with Art. 28 GDPR.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing our website securely, reliably and efficiently.

5. Visiting the website and server logs

When you visit our website, your browser necessarily transmits data to our server. To deliver the pages to you, the server processes your IP address; it is held in working memory for the duration of the connection.

For each request, our server log stores:

  • your IP address in shortened form – for IPv4 without the last octet, for IPv6 only the first 48 bits; the address is shortened before the entry is written;
  • the date and time of the request;
  • the request method, the requested address without any appended parameters and the protocol used;
  • the HTTP status code and the amount of data transferred;
  • your browser's identifier (user agent).

We do not store the address of the previously visited page (referrer). The shortened IP address does not allow us to attribute an entry to any particular person, and we do not combine the logs with other data sources. The server in front of our web server that establishes the encrypted connection (reverse proxy) keeps no access log.

The purposes are to ensure technical operation, analyse errors and detect and prevent attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest follows from these purposes. The logs are rotated continuously, older entries being overwritten automatically.

6. Encryption and data security

This website is delivered exclusively over an encrypted connection (TLS/HTTPS); unencrypted requests are redirected to HTTPS. Strict security policies – including a content security policy – prevent injected code from running in your browser. We explain the details on the page Security of this website.

In addition, we take appropriate technical and organisational measures in accordance with Art. 32 GDPR to protect your data against loss, manipulation and unauthorised access, and keep them up to date with the state of the art.

7. No cookies, no tracking

This website sets no cookies. We use no web analytics (such as Google Analytics), no audience measurement, no advertising or tracking services, no social media plugins and no embedded third-party content such as videos or maps. Fonts, images and scripts are hosted on our own server, so your browser does not connect to any third-party servers when you visit. The only exception is the spam check on the contact form: it only loads once you start filling in the form and is described in section 10. It, too, sets no cookies for advertising or analytics. For these reasons, no consent banner is needed.

8. Storage in your browser (light or dark theme)

If you switch between the light and dark theme in the menu, we store your choice in your browser's local storage (localStorage, entry “lb-theme” with the value “light” or “dark”) so that the setting is kept the next time you visit. As long as you make no choice, no entry is created. The entry contains no identifier, is not transmitted to us or third parties and is not used to recognise you.

The storage is strictly necessary for this service you have explicitly requested; the legal basis is Section 25(2) no. 2 TDDDG. You can delete the entry at any time by removing the stored site data for limebyte.de in your browser.

9. Measurement in your browser

On the homepage, we show how many requests the page made, how many of them went to external servers, how much data was transferred and how many cookies were set. These figures are calculated by a script entirely within your browser using the standard “Resource Timing” interface. The results are only displayed; they are neither stored nor transmitted to us or third parties.

10. Contact form

You can send us a message via our contact form. We process:

  • first name, last name, email address and company (required);
  • your phone number (optional);
  • your message (required);
  • the subject of your request (for example a general enquiry or an IT security check) and the date and time of the request.

Required fields are marked with an asterisk; without them we cannot handle your request. All other information is voluntary.

The purpose is to handle and answer your request. The legal basis is Art. 6(1)(b) GDPR where your request relates to entering into or performing a contract, and otherwise your consent under Art. 6(1)(a) GDPR, which you give by ticking the box. You can withdraw your consent at any time with effect for the future, for example by email to info@limebyte.de; this does not affect the lawfulness of processing carried out before the withdrawal.

How it works

The form is transmitted in encrypted form to our own server. As soon as you start filling it in, your browser additionally loads the spam check by Cloudflare (see “Protection against misuse”). Our server forwards your details as an email to our mailbox. For the technical sending of this email we use the Brevo service of Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany; it is received and stored in our email mailbox at Google Workspace (see section 13). Both providers act as our processors under Art. 28 GDPR. We do not store the form data on the web server itself.

Protection against misuse

To fend off automated spam, the form contains a field that is invisible to people and only filled in by programs, and we limit the number of submissions that can arrive from the same IP address within a short time. For this purpose, the IP address is only held temporarily in working memory and is not stored permanently. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting our form and systems against misuse.

In addition, we use Cloudflare Turnstile to check whether a submission comes from a person. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. The check does not ask you to solve a puzzle: Cloudflare evaluates technical details of your browser – including your IP address, browser and operating system details and your input in the form – and issues a short-lived token that our server has confirmed by Cloudflare. Without that token we do not accept a submission. The check only loads once you start filling in the form; if you merely read the page, no connection to Cloudflare is made. According to Cloudflare, the data processed is used solely to detect automated access, not for advertising and not for profiling; the service sets no cookies for advertising or analytics. Cloudflare acts as our processor under Art. 28 GDPR; this may involve a transfer to the USA. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework, for which the European Commission established an adequate level of data protection on 10 July 2023. Details of the processing by Cloudflare are set out in its privacy policy: cloudflare.com/privacypolicy. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting our form and systems against misuse.

Retention

We delete your request once it has been dealt with conclusively, unless statutory retention obligations prevent this. If your request leads to a contract or constitutes commercial correspondence, we keep the documents for the statutory period – generally six years (Section 257 German Commercial Code, HGB), and ten years for documents relevant for tax purposes (Section 147 German Fiscal Code, AO). The legal basis for this is Art. 6(1)(c) GDPR.

11. Requesting an IT security check

If you request a check via the form on the “Security check” page, in addition to the information listed in section 10 we process which systems are to be tested (for example domains, applications or servers) and your confirmation that you are authorised to have these systems tested.

We need this information to agree on the scope of the check and to ensure that we only test systems for which authorisation exists. The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps at your request) and Art. 6(1)(f) GDPR; our legitimate interest lies in being able to demonstrate the lawfulness of a check at any time. The performance of a security check is agreed with you separately; the provisions agreed there apply to the data processed in that context.

We keep the confirmation of your authorisation for as long as it is needed as evidence, at most until the statutory limitation periods expire. Otherwise, section 10 applies accordingly.

12. Contact by email or phone

If you contact us by email or phone – including to report a security vulnerability (see security.txt) –, we process your contact details (such as name, email address, phone number) and the content of your message in order to deal with your request. The legal basis is Art. 6(1)(b) GDPR where a contract or its preparation is concerned, and otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in dealing with your request. Section 10 applies accordingly to the retention period.

13. Email mailbox (Google Workspace)

We run our email mailboxes on Google Workspace. The provider is Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland. Emails you send us – including messages from the contact form – are stored and processed there. Google acts as our processor; we have concluded a data processing agreement with Google in accordance with Art. 28 GDPR.

It cannot be ruled out that data is transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework; the transfer is therefore based on the European Commission's adequacy decision (Art. 45 GDPR), supplemented by the standard contractual clauses offered by Google (Art. 46(2)(c) GDPR). The legal basis for the processing is Art. 6(1)(f) GDPR; our legitimate interest lies in reliable and secure email communication.

14. Google reviews on this website

In the footer of our pages we show reviews that customers have published in our Google Business Profile: the overall rating, the number of reviews and up to three individual reviews with the reviewer's name as displayed by Google, the star rating, the text, the month of publication and – where available – a link to the reviewer's public Google profile. We do not use profile pictures; we show the first letter of the name instead.

We retrieve this information via the “Places API” programming interface of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland – when the website is built, not when a page is visited. The reviews are therefore part of our pages as ordinary text: when you visit, your browser does not connect to Google and no data about you is transmitted to Google.

The legal basis for displaying them is Art. 6(1)(f) GDPR. Our legitimate interest is to show visitors authentic feedback from our customers; the authors made their reviews public themselves. We update the reviews shown regularly, replacing earlier versions. Anyone who does not want their review to be shown here can object at any time at info@limebyte.de; we will then remove it from our website. The review itself is managed by Google; Google's privacy policy applies there.

If you click “All reviews on Google”, “Write a review” or a profile link, you leave our website; section 16 then applies.

15. Location map

The map of our location on the “About us” page is a graphic we created ourselves from map data of the OpenStreetMap project (© OpenStreetMap contributors, Open Database License). It is loaded from our own server; no connection to OpenStreetMap, Google Maps or any other map service is made. The link to open the route in Google Maps is an ordinary link; Google Maps only opens when you click it (see section 16).

Our pages contain links to websites of other providers, for example to our customers' projects, to our social media profiles, to Google Maps and Google reviews, or to our cooperation partner. As long as you do not click a link, no data is transferred to the linked provider. If you click it, you leave our website; from then on, the provider concerned processes data under its own responsibility. At most, your browser tells the destination that you are coming from limebyte.de – not from which page. We are not responsible for data processing on third-party websites; the privacy policies of the respective providers apply.

17. Our social media presences

We maintain company pages on LinkedIn and Facebook. On this website they are only linked (see section 16); no plugins or content of the networks are loaded.

When you visit our pages on these networks, the operators process your data under their own responsibility – among other things for advertising and market research purposes, and in some cases even if you are not logged in. For the statistical analyses the operators provide to us about our pages (page insights), we are joint controllers with the respective operator (Art. 26 GDPR). The operators have concluded agreements with us on this and, in particular, assume the obligations towards data subjects:

The operators also transfer data to the USA; their group companies there rely on the EU-US Data Privacy Framework and on standard contractual clauses. The legal basis for our involvement is Art. 6(1)(f) GDPR; our legitimate interest lies in presenting our company and communicating with prospects and customers. You can exercise your rights most effectively directly with the operator concerned, as only the operator has access to the data; you may, however, also contact us.

18. Recipients and transfers to third countries

Within our company, only those people who need your data to handle your request have access to it. External recipients are exclusively the service providers named in this policy, who act on our instructions as processors (Hetzner, Brevo, Google Workspace, Cloudflare), and – where we are legally obliged to do so – public bodies such as authorities or courts.

When you visit this website, we do not transfer any data to countries outside the European Union or the European Economic Area. A transfer to the USA is only possible in connection with our email mailbox (section 13) and when you visit our social media presences (section 17). Where a processor uses sub-processors outside the EU, this only happens on the basis of an adequacy decision or appropriate safeguards under Art. 44 et seq. GDPR, in particular standard contractual clauses.

19. Retention

We store personal data only for as long as necessary for the respective purpose or as required by statutory retention periods. The specific periods are given for each processing operation. Once the purpose no longer applies and no retention period needs to be observed, we delete the data; while a retention period is running, we restrict its processing.

20. Obligation to provide data, no automated decisions

You are under no statutory or contractual obligation to provide us with personal data. Without the information marked as required in the contact form, however, we cannot handle your request. No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.

21. Your rights

Subject to the statutory requirements, you have the following rights regarding the personal data concerning you:

  • right of access (Art. 15 GDPR);
  • right to rectification (Art. 16 GDPR);
  • right to erasure (Art. 17 GDPR);
  • right to restriction of processing (Art. 18 GDPR);
  • right to data portability (Art. 20 GDPR);
  • right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

To exercise your rights, an informal message to info@limebyte.de or to our postal address above is sufficient.

Right to object under Art. 21 GDPR

Where we process your data on the basis of Art. 6(1)(f) GDPR (legitimate interests), you have the right to object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Where we process your data for direct marketing purposes, you may object at any time without giving reasons.

22. Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your data infringes the GDPR (Art. 77 GDPR) – in particular in the member state of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia)
Kavalleriestraße 2–4
40213 Düsseldorf, Germany
Phone: +49 211 38424-0
Email: poststelle@ldi.nrw.de
Website: www.ldi.nrw.de

23. Changes to this privacy policy

We update this privacy policy when our website, our processing operations or the legal situation change. The version published here applies. Last updated: September 2026.