Privacy Policy

Condura Energy GmbH, Langenfelder Straße 112, 22769 Hamburg, Germany. Email: info@condura-energy.com. We are not required to appoint a Data Protection Officer under § 38 BDSG or Art. 37 GDPR.

This website is hosted on the platform of Lovable Labs Incorporated, which uses subprocessors for hosting and delivery, including Cloudflare, Inc. for edge routing. On each visit the following is processed: browser type and version, operating system, referrer URL, host name of the accessing device, date and time of the request, and IP address. This serves operation, security and stability only and is not merged with other sources. Legal basis: Art. 6(1)(f) GDPR. We do not receive or store these logs ourselves. No fixed retention period has been specified to us for these logs, so the criteria for the storage period are the purposes named above. Data may be processed in the United States; the transfer is safeguarded by the EU Standard Contractual Clauses (Art. 46 GDPR).

We measure the use of this website with Cloudflare Web Analytics, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. A script loaded from Cloudflare records the page viewed, the referring page, load-time performance, and the device type, browser, operating system and country derived from the request; your IP address is transmitted to Cloudflare in the process. No cookies or other storage on your device are used, and no visitor profiles are created. We see aggregated statistics only. Legal basis: Art. 6(1)(f) GDPR, based on our legitimate interest in understanding how the website is used. Data may be processed in the United States; the transfer is safeguarded by Cloudflare's certification under the EU-U.S. Data Privacy Framework and the EU Standard Contractual Clauses (Art. 46 GDPR).

We use no cookies for tracking, analytics or advertising. Strictly necessary only: "__dpl" (set by the hosting platform for deployment routing), the session storage entry "tsr-scroll-restoration-v1_3" (set by the website's router to restore your scroll position when you navigate back), and "ca_sess" and browser local storage (set in the Client Area to maintain the login session). On the booking page, the embedded Cal.com calendar stores a cookie and local storage entries on your device that it needs to hold your selected time slot and complete the booking (see section 5). These are required for functions you have requested; storage and access are permitted under § 25(2) TDDDG without consent. Legal basis: Art. 6(1)(b) and (f) GDPR.

If you contact us by email, we process your email address, name and message content solely to handle your enquiry. Legal basis: Art. 6(1)(b) and (f) GDPR. Providing this data is neither required by law nor by contract; without it we cannot answer your enquiry. Deletion once the enquiry is resolved, subject to statutory retention periods. Our mailboxes run on Microsoft 365 (Microsoft Ireland Operations Ltd. / Microsoft Corporation), which processes the content and metadata of the correspondence on our behalf and may process data in third countries, safeguarded by the EU-U.S. Data Privacy Framework and the Standard Contractual Clauses.

The booking page embeds the scheduling service Cal.com, operated by Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA. When the page loads, a connection to Cal's servers is established and your IP address is transmitted; if you book, your name, email address, the selected time and any notes are processed to arrange the meeting. This data is processed in the United States. The transfer is safeguarded by the EU Standard Contractual Clauses (Art. 46 GDPR). Bookings are deleted once the appointment has taken place and no further correspondence is required. The call itself takes place via Microsoft Teams, which processes connection and participation data and may process data in third countries, safeguarded as described in section 4. We record a call only with the prior consent of all participants; recordings and any transcript are stored in our Microsoft environment and expire after 120 days by default. Legal basis: Art. 6(1)(b) and (f) GDPR, and Art. 6(1)(a) GDPR for any recording. Providing this data is not required by law; without it no appointment can be arranged.

Access is by invitation only; credentials are issued by us. The Client Area runs on Lovable Cloud, the backend platform of Lovable Labs Incorporated, which provides the database, authentication and storage and uses Supabase as its subprocessor for that infrastructure. The database is hosted in Sweden. We process the username and email of the invited person, contact details provided, the documents made available to that account, and, for security and audit purposes, access events including IP address, user agent and document-access timestamps. Documents are stored in a private bucket and released only to the invited account through short-lived signed links after a server-side access check. Legal basis: Art. 6(1)(b) and (f) GDPR. Retention for the duration of the business relationship, then deletion, subject to statutory retention periods. The database is located in the EU. Personal data is nonetheless transferred to third countries, because the provider and its subprocessor are established outside the EEA and process log and operational data in the United States. These transfers are safeguarded by the EU Standard Contractual Clauses (Art. 46 GDPR).

Personal data is processed on our behalf by Lovable (hosting of this website, the Client Area platform, and the development and maintenance of this website, including read access to stored data where required for debugging), Cloudflare (website analytics), Cal.com (appointment booking) and Microsoft (email and video calls). Lovable uses subprocessors, including Cloudflare for edge routing and Supabase for database, authentication and storage. Beyond these processors we do not share data with third parties unless legally required. Where processing involves third-country transfers, these are safeguarded by adequacy decisions, the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses under Art. 46 GDPR; a copy of the safeguards can be requested from us.

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18) and data portability (Art. 20), and to withdraw any consent at any time with future effect. To exercise a right, contact info@condura-energy.com. You may also lodge a complaint with a supervisory authority (Art. 77), for example Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Str. 22, 20459 Hamburg, mailbox@datenschutz.hamburg.de.

Where we process personal data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time, on grounds relating to your particular situation, to that processing (Art. 21 GDPR). If you object, we will no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms. An objection is free of form and can be sent to info@condura-energy.com.