Privacy notice

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

2. Data collected when you visit this website

Each time this website is accessed, the web server automatically records access data in so-called server log files. The following is collected:

• the IP address of the requesting device
• date and time of access
• browser type and version and the operating system
• the requested page or file

This data is not merged with other data sources and is not evaluated for marketing purposes. We do not create user profiles.

3. Purpose and legal basis of processing

The server log files are processed to ensure the technically error-free operation, stability and security of this website. The legal basis is our legitimate interest in secure and reliable operation under Art. 6 (1) (f) GDPR.

If you contact us to initiate a collaboration, we process the details you provide to answer your enquiry and to carry out pre-contractual measures under Art. 6 (1) (b) GDPR.

4. Hosting and third parties

4.1 Hosting in Germany

This website runs on our own server infrastructure. The servers are located in a data centre of Hetzner Online GmbH in Nuremberg, Germany; operation is handled through the deployment platform Coolify on this infrastructure. This is hosting within the European Union; the hosting does not transfer access data to a third country. A data processing agreement under Art. 28 GDPR is in place with the data centre operator. The legal basis is Art. 6 (1) (f) GDPR.

4.2 AI-assisted sample evaluation (the hub demo)

This website contains a free-text field in which you can ask a question about a fictional company. To generate a sample dashboard, the question you enter is transmitted via a programming interface (API) to Anthropic PBC, 548 Market St, PMB 90375, San Francisco, CA 94104, USA, and processed there by an AI language model.

• Data transmitted: only the text of the question you enter. No registration or user account is required; we transmit neither your name nor your email address.
• Purpose: generation of an exemplary, purely fictional evaluation to illustrate our services.
• Legal basis: legitimate interest in presenting our services, Art. 6 (1) (f) GDPR.
• Transfer to a third country: processing takes place in the USA. The transfer is based on standard contractual clauses of the EU Commission under Art. 44 et seq. GDPR (Art. 46 (2) (c) GDPR).

Please do not enter any personal data or confidential business information into this free-text field. Your question is stored neither in a database nor on a hard disk by us. It is, however, kept in normalised form (lower case, unified spaces) together with the generated sample evaluation for a maximum of one hour in the volatile memory of our own server in a cache, so that the same question does not have to be sent to the model repeatedly. The cache holds at most 200 entries; older entries are displaced, and its entire content is lost whenever the application restarts. The purpose of this short-term retention is abuse and cost control; the legal basis is Art. 6 (1) (f) GDPR. Further information on data processing by Anthropic can be found in their privacy policy: anthropic.com/legal/privacy.

The views opened by clicking the individual facets are stored statically and trigger no data transfer to third parties.

4.3 Fonts

The fonts used on this website are delivered locally from our own server and are bundled when the website is built. There is therefore no connection to Google Fonts servers or other external providers; your IP address is not transmitted to third parties.

4.4 Abuse and cost protection on the free-text field

So that the free-text field is not misused automatically and the costs of the AI queries remain limited, we limit the number of requests. For this we process when a question is submitted:

• Your IP address: it is kept exclusively in the volatile memory of our own server to limit the number of requests per IP address within a sliding window of one hour. After this window expires the entries are discarded; they are not written to a database or a hard disk and are lost whenever the application restarts.
• A pseudonymous session ID: a randomly generated string (UUID) with no reference to your person, which your browser sends with the request so that we can apply the limit per browser tab rather than only per IP address. Like the IP address it is kept only in memory and only for the current window of one hour.
• An entry in your browser's sessionStorage: only when you actually submit a question in the free-text field does your browser store the random session ID mentioned above in its own sessionStorage under the key cayo-session. If you do not use the free-text field, nothing is stored. This is not a cookie and serves no tracking purpose: the value is not evaluated, not merged with other data and not transmitted to third parties. It is a technically necessary local identifier and is deleted automatically by your browser as soon as you close the tab.

The sole purpose of this processing is protection against abuse and cost control. The legal basis is our legitimate interest in secure, functional and economically viable operation under Art. 6 (1) (f) GDPR.

5. Retention

Server log files are deleted as soon as they are no longer required to ensure operation and security, and at the latest after 30 days. Questions entered in the free-text field are not stored permanently: they remain for at most one hour in the volatile memory of our server (section 4.2). Likewise, the IP address and session ID used for abuse and cost control are kept in memory only for the current window of one hour (section 4.4). All of this data is also lost whenever the application restarts. Data you send us by email is stored for as long as is necessary to process your enquiry and beyond that within statutory retention periods.

6. Your rights

As a data subject you have the following rights against us:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)

To exercise your rights, an informal message to info@lukra-holding.de is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

7. Cookies and tracking

This website sets no cookies. We use no analytics or tracking services, no advertising networks and no social media plugins. There is no cross-device recognition and no profiling.

For completeness: as soon as you submit a question in the free-text field, your browser stores a single entry in sessionStorage for it (key cayo-session, see section 4.4). As long as you do not use the free-text field, this entry is not created either. This entry is not a cookie, is not evaluated for analytics or advertising purposes and is deleted automatically when the browser tab is closed. It is technically required for the function you requested (limiting requests per session); a consent banner is not required for it under Section 25 (2) no. 2 TDDDG. No other technologies requiring consent are used.

8. Contact

The contact form shown on this website is currently not active: the forwarding of enquiries has not yet been connected. Your entries are therefore not transmitted, do not leave your browser and are neither received nor stored by us.

You can reach us by email at info@lukra-holding.de. When you contact us by email, we process the details you provide solely to handle your enquiry (Art. 6 (1) (b) or (f) GDPR).