Last updated: 9 June 2026
Preamble
This privacy policy explains which categories of personal data we process, for which purposes and to what extent. It applies to all processing of personal data carried out by us, both in the provision of our services and in particular on our websites, in mobile applications and within external online presences such as our social media profiles.
Controller
Lankau GmbH
Dreischeibenhaus 1
40211 Düsseldorf, Germany
Authorised representative: Torsten Lankau (CEO)
Email: info@lankau.net
Phone: +49 211 913 29 540
Data protection officer
Tom Werres
datenschutz@lankau.net
Overview of processing
Categories of data processed
- Master data
- Employee data
- Contact data
- Content data
- Usage data
- Meta, communication and procedural data
- Log data
Categories of data subjects: employees, communication partners, users, third parties, whistleblowers.
Purposes of processing: communication, security measures, organisational and administrative procedures, feedback, provision of our online offering, information technology infrastructure, whistleblower protection, public relations.
Legal bases
- Consent (Art. 6(1)(a) GDPR) — the data subject has given consent for a specific purpose.
- Contract performance and pre-contractual enquiries (Art. 6(1)(b) GDPR) — processing is necessary to perform a contract or to take pre-contractual steps.
- Legal obligation (Art. 6(1)(c) GDPR) — processing is necessary to comply with a legal obligation.
- Legitimate interests (Art. 6(1)(f) GDPR) — processing is necessary to protect the legitimate interests of the controller.
National provisions apply in addition, in particular the German Federal Data Protection Act (BDSG).
Security measures
We take appropriate technical and organisational measures in accordance with statutory requirements to ensure a level of protection appropriate to the risk, covering the confidentiality, integrity and availability of data.
Online connections are secured by TLS/SSL encryption (HTTPS). All data transmitted through our online services is encrypted using TLS 1.2/1.3. A secure connection is indicated by "https://" in the address bar and the padlock symbol in your browser.
Storage and erasure
We erase personal data in accordance with statutory provisions as soon as the underlying consent is withdrawn or no further legal basis for processing exists. Statutory retention periods:
- 10 years — books, records, annual financial statements (sec. 147 AO, sec. 257 HGB)
- 8 years — accounting vouchers, invoices (sec. 147 AO, sec. 257 HGB)
- 6 years — other business records, commercial letters (sec. 147 AO, sec. 257 HGB)
- 3 years — contractual claims (secs. 195, 199 BGB)
Rights of data subjects
- Right to object: you have the right to object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(e) or (f) GDPR.
- Right to withdraw consent: you may withdraw consent given at any time.
- Right of access: you have the right to obtain information about the data concerning you and a copy of that data.
- Right to rectification: you have the right to request completion or correction of inaccurate data.
- Right to erasure and restriction: you have the right to request erasure or restriction of processing.
- Right to data portability: you have the right to receive your data in a machine-readable format.
- Right to lodge a complaint: you have the right to complain to a supervisory authority, in particular in the country of your habitual residence or of the alleged infringement.
Web fonts (self-hosted)
This website uses typefaces provided by Google Fonts. The fonts are not loaded from Google servers; they are stored locally on our own web server and delivered from there (self-hosting).
No connection to Google servers is therefore established when our website is accessed. No data is transmitted to Google and Google receives no information about your visit.
The typefaces used (Outfit and Playfair Display) are licensed under the SIL Open Font License (OFL) and are served exclusively from the Lankau GmbH server (hosted by Hetzner Online GmbH, Germany).
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a consistent and technically sound presentation of our online offering).
Web hosting
Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany
A data processing agreement pursuant to Art. 28 GDPR has been concluded.
Legal basis: Art. 6(1)(f) GDPR. Server log files are retained for a maximum of 30 days.
Cookies
We use cookies in accordance with statutory requirements. Cookies are functions that store and read information on users' devices.
- Temporary cookies (session cookies): deleted after the user leaves the online offering and closes the device.
- Permanent cookies: remain stored after the device is closed, for up to two years unless stated otherwise.
Users may withdraw consent at any time and object through their browser privacy settings. Legal bases: legitimate interests (Art. 6(1)(f) GDPR), consent (Art. 6(1)(a) GDPR).
Contact and enquiry management
When you contact us (for example by email or phone), we process the information provided to the extent necessary to respond to the enquiry.
Data processed: name, email address, phone (optional), company (optional), message content, date and time of the enquiry.
Purpose: handling the enquiry and communication. The data is used solely for this purpose and is not passed to third parties.
Retention: erased once the purpose no longer applies; statutory periods remain unaffected.
Legal bases: contract performance and pre-contractual enquiries (Art. 6(1)(b) GDPR), legitimate interests (Art. 6(1)(f) GDPR).
Social media presences
We maintain online presences within social networks. User data may be processed outside the EU.
LinkedIn: together with LinkedIn Ireland Unlimited Company we are joint controllers for the collection of visitor data used to produce "page insights". A joint controller addendum has been concluded.
Provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Dublin 2, Ireland
Basis for third-country transfers: Data Privacy Framework (DPF), standard contractual clauses.
Legal basis: legitimate interests (Art. 6(1)(f) GDPR).
Whistleblower protection
Under our whistleblowing procedure pursuant to the German Whistleblower Protection Act (HinSchG) we process data of reporting persons as well as of affected and involved parties. Reports may be made anonymously. The identity of reporting persons is treated in strict confidence. Data is disclosed to third parties only with express consent or where a legal obligation applies.
Legal bases: Art. 6(1)(c) GDPR in conjunction with sec. 10 HinSchG, Art. 6(1)(f) GDPR.
Amendments
We adapt this privacy policy whenever changes to our processing activities make it necessary. Please review its content regularly.
Created with Datenschutz-Generator.de by Dr. Thomas Schwenke · Last updated 9 June 2026