Privacy Policy

1. Controller

LocalStone
Owner: Jona Leander Menken · Sole proprietorship
Schenefelder Landstraße 277
22589 Hamburg · Germany
Email: hello@localstone.de
Phone: +49 178 8322477

Please use these contact details for privacy questions or to exercise your rights.

2. Scope

These notices cover LocalStone's marketing website, including the portfolio and design studies, direct communication with us and our existing business research. They do not cover websites we create for customers. Interactive design studies are demonstrations; their selections are not sent to us.

Customer accounts, an online contact form, guided project preparation and uploads are not publicly enabled. We will update this policy before activating them. The website uses no analytics or marketing tracking services and no optional third-party embeds.

3. Website delivery and security

The website is delivered through Render Services, Inc., USA. Render and participating infrastructure operators process network and request data for delivery, including IP address, time, requested address, browser/device information, a referrer where supplied, and error and security information. This enables delivery, troubleshooting and protection against abuse.

We use Cloudflare, Inc., USA, for our domain's name resolution. It processes DNS queries and the network information needed to answer them. Render also uses Cloudflare to protect its websites against denial-of-service attacks, involving the request data needed for delivery and protection.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are a reliably available, secure website and protection against technical attacks. Technical data is held for delivery and, where necessary, investigating faults and security incidents.

4. Contact by email and telephone

When you contact us, we process your contact details, the content of your enquiry and the conversation or correspondence notes needed to handle it. This enables us to respond, discuss your project and, where appropriate, prepare a working relationship.

Article 6(1)(b) GDPR applies when processing is necessary to take steps at your request towards a contract or to perform it. Otherwise, Article 6(1)(f) applies; our interest is handling business communication properly. Necessary statutory retention is based on Article 6(1)(c).

Our mailbox is provided by united-domains GmbH, Gautinger Straße 10, 82319 Starnberg, Germany. The communication providers you use also participate in transmission. Providing information is voluntary; without a suitable contact method and details of your request, we may be unable to handle it. An enquiry does not subscribe you to a newsletter.

5. Existing business research — information under Article 14 GDPR

We process previously collected public business information for market and sales research: assessing businesses and their existing websites and identifying potentially suitable business contacts. Information identifying sole traders or other natural persons is personal data.

This may include a person's name or trading name, professional activity, business address and location, published business email address and telephone number, website and social-media addresses, and source, freshness and verification records. Sources include public business profiles and directories through Overture Maps, individual public business websites and targeted Google Places lookups. Public availability does not mean unrestricted use. You can ask us which information we hold and where it came from.

The legal basis is Article 6(1)(f) GDPR. Our interest is assessing business opportunities using necessary professional information, while considering your rights and reasonable expectations. Research does not authorise marketing calls or emails. There is no automatic sending. You can object to research involving your personal data; section 10 explains this right.

6. Recipients and international transfers

Access to personal data is limited to LocalStone and the technical service providers used for the relevant purpose, in particular the hosting, DNS and email providers named above and their necessary subprocessors.

For targeted Google Places lookups, we use Google Maps Platform. Search information, such as a business name and location, as well as technical usage data may be transmitted to Google. For customers with a German or other EEA billing address, Google Cloud EMEA Limited, Ireland, is generally the contracting entity under the applicable Google Maps Platform terms. Google Ireland Limited acts as controller for certain European service data.

Historical versions of our private GitHub repository may still contain personal research information. GitHub, Inc., USA, is therefore involved as the technical provider of the repository service for these historical copies. This information is not part of the current public website build and is not published as customer-reference content. Once these historical records have been removed from the relevant repository history and associated copies, this processing will cease and this notice will be updated accordingly.

Render and Cloudflare may process personal data in the United States and through international infrastructure. Both participate in the EU-US Data Privacy Framework. Where its requirements are met, relevant transfers are based on the adequacy decision under Article 45 GDPR. Their published data protection terms provide for Standard Contractual Clauses under Article 46 GDPR for other covered third-country transfers.

Google and GitHub may also process personal data outside the European Economic Area. For relevant transfers, Google and GitHub describe applicable adequacy mechanisms and Standard Contractual Clauses. Further information about the applicable safeguards is available from us on request.

Authorities or professional advisers receive personal data only where necessary to comply with legal obligations or to establish, exercise or defend legal claims.

We do not sell personal data.

7. Cookies and access to your device

The marketing website sets no cookies of its own, uses no localStorage or sessionStorage for visitor profiles, and loads no optional tracking or embed services. Language and pages are selected through their URLs. Design-study selections remain in browser memory and are lost when the page reloads.

Loading the page you expressly request, its locally hosted fonts and images, and ordinary browser caching serve website delivery. To the extent device access is strictly necessary for this, Section 25(2), no. 2 of Germany's TDDDG applies. Optional access would require prior consent. As no such services are currently used, no cookie consent dialogue is provided.

8. Retention

We retain personal data only for as long as necessary for the relevant purpose or as required by statutory retention obligations.

Technical data is processed only for as long as necessary to deliver the website, troubleshoot faults, or prevent and investigate security incidents.

Information from enquiries is retained for handling the enquiry and, where a business relationship results, for carrying out and documenting that relationship. Statutory retention obligations remain unaffected.

Research information is reviewed regularly for accuracy and necessity. Personal data is deleted when it is no longer required for the relevant purpose or where legal or contractual requirements prevent further processing.

For Google Places lookups, we retain Place IDs on an ongoing basis where permitted under Google's applicable terms. Other content returned by Google Places is not retained in our current research process as a separate permanent dataset and is used only for time-limited verification.

Following an objection to direct marketing, a minimal suppression record may be retained where necessary to ensure that the objection continues to be respected. The legal basis is Article 6(1)(f) GDPR.

9. Your rights

Subject to the applicable legal conditions, you have rights of access, rectification, erasure and restriction of processing. Data portability applies where its conditions are met. You may withdraw consent you have given with effect for the future. Please email hello@localstone.de; where needed, we will verify your identity using the necessary information.

No solely automated decision with legal or similarly significant effects is made. Internal research priorities do not replace a personal decision about working together.

11. Complaints

You may complain to a data protection supervisory authority, particularly where you live or work or where you believe an infringement occurred. For our Hamburg establishment, this is the Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany. Information: datenschutz-hamburg.de · Beschwerde / Complaint