Data Protection Policy

1 · Controller

The controller responsible for data processing on this website is:

Lucera GmbH
Kurfürstenanlage 21
69115 Heidelberg
Germany

Email: info[at]lucera.eu

2 · Data protection officer

Dataprivacy c/o legitimis GmbH
Ball 1
51429 Bergisch Gladbach
Germany

Email: dataprivacy-helpdesk[at]legitimis.com

3 · What we process, and why

Server log files

When you visit this website, our hosting provider may automatically process technical information transmitted by your browser. This may include:

• IP address
• date and time of access
• requested page or file
• referrer URL
• browser type and version
• operating system
• device information
• access status and HTTP status code

This information is processed to deliver the website, ensure the security and stability of our systems, detect technical problems and prevent misuse.

The legal basis is Art. 6 (1)(f) GDPR. Our legitimate interest is the secure, reliable and technically functional operation of this website.

Contact by email or contact form

If you contact us by email or through a contact form, we process the information you provide to us. Depending on the nature of your enquiry, this may include your name, email address, organisation, telephone number and the contents of your message.

We process this information in order to respond to your enquiry and communicate with you.

Where your enquiry relates to a contract or steps prior to entering into a contract, the legal basis is Art. 6 (1)(b) GDPR.

For other enquiries, the legal basis is Art. 6 (1)(f) GDPR. Our legitimate interest is the appropriate handling of communications addressed to our company.

4 · Hosting and service providers

We use external service providers for the hosting, technical operation and maintenance of this website and, where applicable, for email and communication services.

To the extent that these service providers process personal data on our behalf, they act as processors within the meaning of Art. 28 GDPR and are bound by appropriate data processing agreements.

Personal data may also be disclosed to other service providers where this is necessary for the operation and security of our IT infrastructure or for responding to your enquiry.

5 · Cookies and similar technologies

This website does not use tracking or advertising cookies and does not use third-party analytics.

Where technically necessary cookies or comparable technologies are used, they are used only insofar as necessary to provide the website and its functions.

To the extent that information is stored on, or accessed from, your device and this is strictly necessary to provide a service expressly requested by you, no consent is required pursuant to § 25 (2) TDDDG.

Any subsequent processing of personal data is based on Art. 6 (1)(f) GDPR, insofar as necessary for the secure and technically reliable operation of the website.

If analytics, advertising technologies, embedded third-party services or other non-essential cookies are introduced in the future, this privacy policy and, where required, the website’s consent mechanism will be updated accordingly.

6 · Recipients and international transfers

We do not sell personal data.

Personal data is disclosed only where this is necessary for the purposes described in this privacy policy, including to hosting, IT, communication and other service providers acting on our behalf, or where disclosure is required by law.

Where personal data is transferred to a recipient outside the European Union or the European Economic Area, we ensure that an appropriate legal basis for the transfer exists.

Depending on the recipient and country concerned, this may include an adequacy decision by the European Commission or appropriate safeguards such as the European Commission’s Standard Contractual Clauses pursuant to Art. 46 GDPR.

7 · Retention

We retain personal data only for as long as necessary for the purpose for which it was collected or for as long as statutory retention obligations apply.

Technical server log data is retained only for the period necessary to ensure the security and operation of the website and is subsequently deleted or anonymised, unless longer retention is necessary to investigate a specific security incident or comply with a legal obligation.

Correspondence relating to enquiries is deleted when it is no longer necessary for handling the enquiry and no statutory or contractual retention obligation requires continued storage.

8 · Your rights

Subject to the applicable legal requirements, you have the following rights under the GDPR:

• the right of access to your personal data under Art. 15 GDPR;
• the right to rectification of inaccurate personal data under Art. 16 GDPR;
• the right to erasure under Art. 17 GDPR;
• the right to restriction of processing under Art. 18 GDPR;
• the right to data portability under Art. 20 GDPR;
• the right to object to processing based on Art. 6 (1)(e) or (f) GDPR under Art. 21 GDPR; and
• where processing is based on consent, the right to withdraw your consent at any time with effect for the future.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

To exercise your rights, please contact: info[at]lucera.eu

9 · Right to complain

You also have the right to lodge a complaint with a competent data protection supervisory authority.

The supervisory authority responsible for private companies based in Baden-Württemberg is:

The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg
(Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg — LfDI BW)

Heilbronner Straße 35
70191 Stuttgart
Germany

Postal address:
Postfach 10 29 32
70025 Stuttgart
Germany

Email: poststelle[at]lfdi.bwl.de

You may also contact another competent supervisory authority, in particular in the EU Member State of your habitual residence, place of work or place of the alleged infringement.

10 · Changes to this policy

We may update this privacy policy where necessary to reflect changes to this website, our processing activities or applicable legal requirements.

The version published on this website at the relevant time applies.

11 · Last updated

8 September 2026