laOlaWeb GmbH, Grassistraße 20, 04107 Leipzig
0. preliminary remark
In our view, the fundamental rights to informational self-determination and to the protection of personal data are the cornerstones of a free society, to which we are firmly committed. The protection of your personal data is therefore a matter of great importance to us, and we are making every effort to ensure this, not least through this privacy policy. It should be noted that the rights to the protection of personal data must be balanced against other fundamental rights, whilst upholding the principle of proportionality. In this respect, we have taken the liberty of incorporating applications and plug-ins, such as Google Analytics, into our websites, which go beyond what is strictly necessary in terms of the scope of data processing. However, we firmly believe that none of the data processing activities on our website disproportionately restrict your rights. Should you not share this view, we would welcome your constructive feedback at:
As the operator of these websites, it is our legal obligation to provide you with comprehensive information about what data is collected when you visit our websites, how we or our service providers process your data, the legal basis on which this is done, and what legal rights you have. This legal requirement stems from Art. 13 of the General Data Protection Regulation (GDPR) We would like to comply with this request in the following. We have taken great care to find a comprehensible and transparent form of presentation (Art. 12 DSGVO). However, if you have any difficulties in understanding the following data protection information, please do not hesitate to contact us at any time.
I. Conceptuality
The following text uses, amongst other things, legal terms such as „controller“, „data processing“ and „processor“. These legal terms are defined in Article 4(1) to (26) of the GDPR. In our view, these statutory definitions are generally understandable upon careful reading. We will therefore rely on the statutory terminology in the following. Below you will find the most important statutory definitions in accordance with Article 4 of the GDPR (extract from the text of the Act):
Personal data: any information relating to an identified or identifiable natural person (hereinafter referred to as the „data subject“); a natural person is considered identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more specific characteristics that reflect the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
Processing: any operation or set of operations which is carried out on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or any other form of disclosure, the matching or linking, the restriction, erasure or destruction;
Data controller: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union law or the law of the Member States, the controller or the specific criteria for its designation may be laid down by Union law or the law of the Member States;
Recipient: a natural or legal person, public authority, agency or other body to whom personal data are disclosed, regardless of whether or not they are a third party. However, public authorities which may receive personal data in the course of a specific investigation mandate under Union law or the law of the Member States shall not be regarded as recipients; the processing of such data by those authorities shall be carried out in accordance with the applicable data protection rules and in line with the purposes of the processing;
Consent of the data subject: any freely given, specific, informed and unambiguous indication of the data subject’s wishes, by a statement or other clear affirmative action, by which the data subject indicates that they consent to the processing of personal data relating to them;
II. responsibility for data processing
The data controller (Article 4(7) of the GDPR) is:
laOlaWeb GmbH
Managing Director: Tobias Ebert
Grassistraße 20, 04107 Leipzig
Phone: 0341 / 52 98 34 74
E-mail: info@laolaweb.com, tobias.ebert@laolaweb.com
We have not appointed a data protection officer within our organisation, as the legal requirements set out in Article 37 of the GDPR, § Section 38 Federal Data Protection Act (BDSG) are not fulfilled. If you have any questions in connection with the processing of your personal data, please contact us using the contact details provided.
III. Overview of the data processing procedures on our websites
| Processing procedure | Purpose | Legal basis |
|---|---|---|
| 1. web presence | Self-description | Article 6(1)(f) of the GDPR |
| 2. Google WebFonts | Self-description | Article 6(1)(f) of the GDPR |
| 3. google maps | Self-description | Article 6(1)(f) of the GDPR |
| 4. e-mail | Getting in touch | Article 6(1)(a) of the GDPR |
| 5. contact form | Getting in touch | Article 6(1)(a) of the GDPR |
| 6. reCAPTCHA | Safety | Article 6(1)(f) of the GDPR |
| 7. google analytics | Marketing | Article 6(1)(f) of the GDPR |
| 8. YouTube/Vimeo | Marketing | Article 6(1)(f) of the GDPR |
IV. The data processing procedures in detail
Below you will find a detailed description of the data processing operations summarised in section III.
1. web presence
We operate our website at the URL https://laolaweb.com/ for the purpose of presenting our organisation. In doing so, we process your personal data as follows:
Every time you visit our website, the browser installed on your device sends a so-called HTTP request to our web server, Host Europe, Host Europe GmbH, Hansestrasse 111, 51149 Cologne. Our web server then automatically transmits certain data to the browser on your device. This data processing is necessary in order to display a web page at all. The data processed as standard when displaying web pages includes, in addition to your IP address, the name of the web page accessed, the file, the date and time of the request, the volume of data transferred, a notification of a successful request, the browser type and version, your operating system, the referrer URL (the page visited previously), and the requesting provider.
The legal basis for the data processing procedure described is Article 6(1)(f) of the GDPR. Our legitimate interest in processing the data is to ensure the integrity, confidentiality and availability of the data processed via this website. You have the right to object at any time to the processing of your personal data on grounds relating to your particular situation in connection with the aforementioned processing (Article 21 of the GDPR).
2. Google WebFonts
We use Google WebFonts on our websites to improve the display of content. The provider is Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter: Google). Web fonts enable the content of this website to be displayed optimally across different types of browsers (particularly in terms of fonts). When the web fonts are accessed, the IP addresses of website visitors are transmitted to Google, together with the information that these IP addresses are on our website.
The legal basis for the data processing procedure described is Article 6(1)(f) of the GDPR. Our legitimate interest in using Google WebFonts is to ensure a consistent and attractive presentation of our online services. You have the right to object at any time to the processing of your personal data on grounds relating to your particular situation in connection with the aforementioned processing operation (Article 21 of the GDPR).
For further information, please visit:
https://developers.google.com/fonts/faq
https://www.google.de/intl/de/policies/privacy/
3. google maps
We use Google Maps on our websites to display our location. When Google Maps is used, map content is retrieved from Google’s servers in the USA. It is possible that Google may log this server request and process it further. It is therefore possible that your IP address may be stored by Google. The same applies, incidentally, to JavaScript elements, which may be loaded from Google’s servers for the purposes of browser compatibility.
The legal basis for the data processing procedure described is Article 6(1)(f) of the GDPR. Our legitimate interest in processing the data is to provide information about our premises so that they can be found more easily. You have the right to object at any time to the processing of your personal data on grounds relating to your particular situation in connection with the aforementioned processing operation (Article 21 of the GDPR).
For further information, please visit:
https://www.google.de/intl/de/policies/privacy/
4. e-mail
When you send us an email, we store your email address and the text of the email. We ensure that the data is protected against unauthorised access by third parties using state-of-the-art security measures. Please note, however, that unencrypted emails sent via the internet are not adequately protected against unauthorised access by third parties.
The legal basis for data processing is your consent given by sending an email, or the unambiguous expression of intent associated with sending the email, by which you indicate to us that you consent to the processing of your personal data, Article 6(1)(a) of the GDPR. You may withdraw your consent at any time with effect for the future. To do so, please send an email to:
This does not affect the lawfulness of the data processing up until you withdraw your consent.
5. contact form
Our website offers the option of contacting us electronically via a contact form. If you contact us via this form, your name, email address and the details of your enquiry will be transmitted to us and stored.
The legal basis for data processing is your consent in connection with your use of the contact form, or the unambiguous expression of intent associated with such use, by which you indicate to us that you consent to the processing of your personal data, Article 6(1)(a) of the GDPR. You may withdraw your consent, which is given through your use of the contact form, at any time with effect for the future. To do so, please send an email to:
This does not affect the lawfulness of the data processing up until you withdraw your consent.
6. reCAPTCHA
To protect enquiries submitted via the contact form, we use Google’s reCAPTCHA service. This application enables us to distinguish whether an entry has been made by a human or, in the case of misuse, by automated processing. When the query is made, your IP address and, where applicable, other data are transmitted to Google and processed further. However, Google will first truncate your IP address within the Member States of the European Union or in other States party to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there.
The legal basis for the data processing is Article 6(1)(f) of the GDPR. Our legitimate interest in implementing reCAPTCHA is to maintain the functionality of the website by preventing unauthorised access. You have the right to object at any time to the processing of your personal data on grounds relating to your particular situation (Article 21 of the GDPR).
Further information can be found at:
https://developers.google.com/recaptcha/
https://policies.google.com/privacy?hl=de
7. google analytics
This website uses Google Analytics, a web analytics service provided by Google. Google Analytics uses so-called „cookies“, which are text files stored on your computer and which enable an analysis of your use of the website. The information generated by the cookie regarding your use of this website is usually transmitted to a Google server in the USA and stored there. Your data is analysed anonymously. The Google tracking code on our website has been modified so that Google truncates the last few digits of your IP address before the analysis takes place. It is therefore no longer possible, in principle, to trace the data back to you personally or to combine this data with information Google already holds about you.
Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there. On behalf of the operator of this website, Google will use this information to analyse your use of the website, to compile reports on website activity and to provide other services relating to website and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with other data held by Google. You can prevent the storage of cookies by adjusting your browser settings accordingly; however, we would like to point out that, in this case, you may not be able to make full use of all the functions of this website. You can also prevent Google from collecting the data generated by the cookie and relating to your use of the website (including your IP address), as well as preventing Google from processing this data, by downloading and installing the browser plug-in available via the following link:
https://tools.google.com/dlpage/gaoptout?hl=de
The legal basis for the data processing is Article 6(1)(f) of the GDPR. Our legitimate interest in using Google Analytics is to continuously improve the website by analysing user behaviour. You have the right to object at any time to the processing of your personal data on grounds relating to your particular situation (Article 21 of the GDPR).
For further information, please visit:
https://www.google.de/intl/de/policies/privacy/
8. YouTube/Vimeo
We use videos from YouTube and Vimeo on our websites to present our agency and our services in a clear and engaging way. The providers are YouTube LLC, 901 Cherry Ave, San Bruno, CA 94066, USA – a subsidiary of Google – and Vimeo, Inc., 555 West 18th Street, New York 10011, USA.
Every time you visit a page on our website that contains an embedded video, your browser is automatically prompted to download the relevant component from YouTube or Vimeo. If you are logged in to YouTube or Vimeo at the same time, YouTube or Vimeo will recognise which specific subpage of our website you are visiting when you access a subpage containing a video. This occurs regardless of whether you click on a video or not. If you do not wish for this information to be transmitted to YouTube or Vimeo, you can prevent this by logging out of your YouTube or Vimeo account before accessing our website.
The legal basis for this data processing is Article 6(1)(f) of the GDPR. Our legitimate interest in using YouTube or Vimeo is to present our services and our company to visitors to our websites. You have the right to object at any time to the processing of your personal data on grounds relating to your particular situation (Article 21 of the GDPR).
For further information, please visit:
https://www.youtube.com/yt/about/de/
https://www.google.de/intl/de/policies/privacy/
https://vimeo.com/privacy
V. Cookies
We use cookies on our websites. Cookies are small text files that are stored in the browser on your device and identify it from then on. The browser can therefore be uniquely identified when the cookie is subsequently „read“.
We currently use the following cookies:
- Name: _ga; Purpose: Website analytics; Retention period: 2 years
- Name: _gat; Purpose: Website analytics; Retention period: 1 minute
- Name: _gid; Purpose: Website analytics; Retention period: 24 hours
- Name: viewed_cookie_policy; Purpose: Cookie notice; Retention period: 1 year
VI. Categories of recipients
Your IP address is transmitted to the web service provider (IV., 1.). Due to the integration of analysis tools, applications and plugins (IV., 2. - 3., 6. - 8.), your IP address is transmitted to the respective providers. The exact description of the analysis and marketing tools, applications and plugins can be found under IV. There you can also see who the providers are in detail and where you can find further information.
VII. third country reference
As a general rule, your personal data will not be transferred to countries outside the European Union. An exception to this are IP addresses, which are transferred to providers in the USA in connection with the analytics and marketing tools, applications and plug-ins (IV., 2. – 3., 6. – 8.).
In this case, too, data protection is formally guaranteed. All the providers we use (Google, YouTube/Google, Vimeo), which are headquartered in the USA, are listed under the „Privacy Shield“. The Privacy Shield is an agreement between the USA and the EU designed to ensure compliance with European data protection standards. You can find the relevant entries here.
VIII. storage period
Your IP address and the so-called log files, which are stored when you access the web server, are subject to log rotation, i.e. they are retained for a period of 4 days (IV., 1.).
The retention period for IP addresses resulting from our use of analytics and marketing tools, applications and plug-ins (IV., 2–3, 6–8) can be found in the privacy policies of the respective providers.
We store any data entered in the contact form or sent by email (IV., 4. – 5.) for as long as is necessary to respond to the enquiry or to fulfil the relevant contractual relationship.
In addition, the statutory retention periods set out in the German Commercial Code and the German Fiscal Code apply. Once the aforementioned retention periods have expired, the data will be deleted in accordance with the law.
IX. Data subject rights
Under the GDPR, you have various rights, which we would like to explain to you below:
You have the right to request, free of charge, information at any time about the data we process about you (Article 15 of the GDPR).
You have the right to request the rectification of any inaccurate personal data concerning you (Article 16 of the GDPR).
You have the right to have your personal data erased (Article 17 of the GDPR). This right is not unconditional. One of the following grounds must apply (extract from the text of the law):
- The personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
- the data subject withdraws their consent on which the processing was based pursuant to Article 6(1)(a) (…) and there is no other legal basis for the processing;
- the data subject objects to the processing in accordance with Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing in accordance with Article 21(2);
- the personal data was processed unlawfully;
- the erasure of personal data is necessary for compliance with a legal obligation under Union law or the law of the Member States to which the controller is subject;
- The personal data was collected in connection with information society services provided, in accordance with Article 8(1).
You have the right to request that processing be restricted in accordance with Article 18 of the GDPR.
You have the right to data portability under Article 20 of the GDPR.
X. Right of appeal
You have the right to lodge a complaint with a supervisory authority (Article 77 of the GDPR), for example with the supervisory authority responsible for the controller. This is:
The Saxon Data Protection Commissioner
(currently Mr Andreas Schurig)
1 Devrientstr.
01067 Dresden
XI. Profiling
No profiling within the meaning of Article 22 of the GDPR takes place. The Google Analytics processing procedure described in section IV, 7 does not result in a legally binding decision in respect of the data subjects, as required by Article 22 of the GDPR.
As at 18 December 2018
Privacy policy drawn up by Data guardian.de