02 OPTEMUS / LEGAL
Transparency and privacy are priorities at OPTEMUS. Here we explain which personal data we process when you visit our website, contact us or do business with us, and how we protect it.
ON THIS PAGE
01
Controller
The controller responsible for processing personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:
OPTEMUS
Owner: Timm Lehmann
Osterland 6a
31832 Springe
Germany
Email: info@optemus.de
02
General information on data processing
We treat personal data confidentially and in accordance with applicable data protection legislation and this privacy policy.
Personal data means any information relating to an identified or identifiable natural person. This includes, in particular, names, email addresses, company details, IP addresses and technical usage data.
This privacy policy explains which personal data is processed when you visit our website, contact us by email or contact form, make enquiries, receive quotations, work with us on projects or use external services.
03
Hosting and website delivery
We use services provided by Alfahosting (Alfahosting GmbH, Halle (Saale), Germany) to deliver our website.
When you access our website, we process technically necessary information that your browser sends automatically. This includes, in particular:
- IP address
- Date and time of access
- Page or file requested
- Referrer URL
- Browser type and version
- Operating system used
- Device information
- Volume of data transferred
- HTTP status code
This processing is necessary to deliver the website and ensure its stability and security.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure, stable and error-free provision of our online services.
Where service providers process personal data on our behalf, this is governed by a data processing agreement under Article 28 GDPR. International service providers may process data outside the European Union or the European Economic Area. Where required, such transfers comply with Articles 44 et seq. GDPR.
04
Contact form
You can send us an enquiry using the contact form on our website. The following data is processed:
- Name
- Email address
- Company (optional)
- Content of your message
- Time of submission
- Technical information required to provide and secure the form
The contact form runs on our webspace at Alfahosting. The information you enter is forwarded to us by email and stored in our mailbox. To prevent abuse, the technically necessary optemus_contact session cookie is set when you first interact with the form. It contains a random session identifier and is configured as a session cookie without a fixed expiry time. Hashed IP addresses and timestamps are also used to limit the number of requests.
If your enquiry concerns entering into or performing a contract, processing is based on Article 6(1)(b) GDPR. Other enquiries are processed under Article 6(1)(f) GDPR. Our legitimate interest is to handle and respond to your enquiry appropriately.
The data is deleted once it is no longer needed to handle the enquiry, provided no statutory retention obligation or other legal reason prevents deletion.
05
Contact by email
When you contact us by email, we process the personal data you send us, in particular your email address, name, message content and time of contact, to handle your enquiry.
The legal basis is Article 6(1)(b) GDPR where your enquiry concerns entering into or performing a contract. In other cases, it is Article 6(1)(f) GDPR, based on our legitimate interest in responding to your enquiry.
06
Customers, prospective customers and business partners
When initiating, concluding and performing contracts for software design, development, integration and support, we process personal data relating to customers, prospective customers, business partners and their contact persons.
This includes, in particular:
- Names, roles and contact details of contact persons
- Company details
- Contract, quotation and billing data
- Project and communication data
The legal bases are Article 6(1)(b) GDPR (performance of a contract and pre-contractual steps), Article 6(1)(c) GDPR (statutory retention obligations) and Article 6(1)(f) GDPR (legitimate interests in efficient business administration and customer relations).
Where we process personal data on behalf of our customers, for example as part of development, integration or support services, this is governed by a data processing agreement under Article 28 GDPR.
07
Google Analytics
If you have expressly consented, our website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
We use Google Analytics to analyse website usage statistically and improve our services. The following information may be processed, in particular:
- Pages visited
- Time and duration of page views
- Approximate geographical location
- Device and browser information
- Operating system
- Interactions with our website
- Source of the website visit
Google Analytics may use cookies and similar technologies for this purpose. The _ga and _ga_<identifier> cookies have a default lifetime of two years, which may be renewed on subsequent use. Browsers may limit this lifetime. Cookie lifetime is separate from the retention of analytics data stored by Google. In our Google Analytics property, event data is retained for two months and user data for 14 months. The user-data retention period resets when new user activity occurs. These settings do not apply to most standard reports based on aggregated data. Google Analytics 4 does not permanently store IP addresses.
Processing is based on your consent under Article 6(1)(a) GDPR. Where information is stored on or accessed from your device, this is additionally based on your consent under section 25(1) TDDDG.
You can withdraw your consent at any time with future effect through the privacy settings on our website.
When using Google services, data may be processed by other Google group companies, particularly in the USA. Google is certified under the EU-US Data Privacy Framework; where required, transfers comply with Articles 44 et seq. GDPR.
Further information: https://policies.google.com/privacy?hl=en
08
Consent and cookie management
Our consent banner lets you choose whether to consent to services and technologies that are not technically necessary. Analytics, tracking and external media services are used only in accordance with your choice.
You can withdraw or change your consent at any time with future effect. Your choice is stored under optemus-consent-v1 in your browser’s localStorage and honoured for 180 days. After that, we ask for your choice again on your next visit. You can change your choice through the cookie settings or delete the entry through your browser settings. Your language choice is not stored persistently. Technically necessary processing may take place without consent where there is a statutory legal basis.
09
External links and social media
Our website contains links to external websites, particularly reference projects such as blursafe.com, parabel.de and conetic.de, and to our profiles on Instagram.
For ordinary links, a connection to the provider is established only when you click the link. You then leave our website. The respective operator, for example Meta Platforms Ireland Limited for Instagram, may process personal data there. We have no influence over the nature, extent or purposes of this processing. For appointment bookings, we also link to cal.com/optemus. A connection to Cal.com is established only when you open this link; contact and appointment details entered there are processed by that provider. The respective provider's privacy policy applies.
10
SSL or TLS encryption
Our website uses SSL or TLS encryption for security and to protect the transmission of confidential content. You can recognise an encrypted connection by the padlock symbol in your browser's address bar and an address beginning with ‘https’ rather than ‘http’. When encryption is enabled, third parties cannot read the data you send to us in transit.
11
Retention periods
Personal data is retained only for as long as necessary for its processing purpose or as required by statutory retention obligations.
In particular:
- Enquiries submitted by contact form or email are deleted once they have been fully handled and no business relationship results.
- Customer, contract and billing data is retained for the duration of the business relationship and subsequently for the periods required by commercial and tax law, generally six or ten years.
- The hosting provider retains Apache and nginx access and error logs for seven days. IP addresses are stored for 24 hours. According to the hosting provider, no retention beyond these periods is planned in the event of security incidents or abuse.
Once the purpose no longer applies and the relevant retention periods have expired, personal data is deleted or anonymised.
12
Recipients of personal data
In the processing described here, personal data may be shared with service providers we use to operate and deliver our services. These may include:
- Hosting and infrastructure providers
- Form and email service providers
- Analytics providers, where you have consented
- IT and security service providers
- Tax advisers and, where necessary, legal advisers
Data is shared only where there is a legal basis or you have consented. Where providers act as processors on our behalf, they are engaged in accordance with Article 28 GDPR.
13
Transfers to third countries
Using international service providers may involve processing personal data outside the European Union or the European Economic Area. For transfers to third countries, we comply with Articles 44 et seq. GDPR. Depending on the provider, transfers rely on a European Commission adequacy decision, such as the EU-US Data Privacy Framework, or appropriate safeguards such as standard contractual clauses.
14
Legal bases for processing
Depending on the nature and purpose of processing, we rely on the following legal bases:
- Article 6(1)(a) GDPR — consent, where you have given us consent for a specific purpose.
- Article 6(1)(b) GDPR — contract and pre-contractual steps, where processing is necessary to perform a contract or take pre-contractual steps.
- Article 6(1)(c) GDPR — legal obligation, where processing is necessary to comply with a legal obligation.
- Article 6(1)(f) GDPR — legitimate interests, where processing is necessary for our legitimate interests or those of a third party and these are not overridden by the interests of the person concerned.
15
Your rights
Subject to the applicable statutory requirements, you have the following rights:
- Right of access under Article 15 GDPR
- Right to rectification under Article 16 GDPR
- Right to erasure under Article 17 GDPR
- Right to restriction of processing under Article 18 GDPR
- Right to data portability under Article 20 GDPR
- Right to object under Article 21 GDPR
- Right to withdraw consent under Article 7(3) GDPR
You may withdraw consent at any time with future effect. This does not affect the lawfulness of processing carried out before withdrawal.
To exercise your rights, please contact: info@optemus.de
Right to object
Where we process personal data under Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. If personal data is processed for direct marketing, you may object to processing for that purpose at any time.
16
Right to complain to a supervisory authority
Under Article 77 GDPR, you have the right to complain to a data protection supervisory authority about the processing of your personal data. The authority responsible for our location is:
The State Commissioner for Data Protection of Lower Saxony
Prinzenstraße 5
30159 Hannover
Germany
https://lfd.niedersachsen.de
Your right to contact another competent supervisory authority remains unaffected.
17
Automated decision-making
We do not carry out decision-making based solely on automated processing, including profiling, within the meaning of Article 22 GDPR.
18
Changes to this privacy policy
We reserve the right to update this privacy policy where necessary due to technical changes to our website, changes to service providers or legal requirements. The current version published on our website applies.
Last updated: 14 October 2026