Privacy — Public
This privacy policy describes how leano processes personal data, for what purposes, and what rights you have. This version applies to the public use of the leano.net website without registration.
Version and Validity
Version 1.3 | As of: 23.09.2026
Applies to: leano.net – public website without user registration (including visitors in freemium mode without email registration)
Change from v1.1: Website host changed from webGo to Hetzner Online GmbH (move on 18.09.2026).
Controller and Contact Details
Controller within the meaning of the General Data Protection Regulation (GDPR/DSGVO):
daleap GmbH, Grützmacherweg 6, 13599 Berlin, Germany
Represented by: Karsten Leipnitz (Managing Director)
Email: mail@leano.net | Telephone: +49 30 555 27 30 2 | Website: www.leano.net
Contact for data protection matters: Robert Grolla | Email: privacy@leano.net
Note: daleap GmbH is not required to appoint a data protection officer pursuant to Art. 37 GDPR.
Data Security
We take appropriate technical and organisational measures to protect your data:
- Encryption of data transmissions (TLS/SSL)
- Access controls and authentication mechanisms
- Regular review of security precautions
- Staff awareness training
Use Without Registration
When using leano.net without registration, no personal data is permanently stored on our servers. All data created while using the web app (without logging in) remains locally on your device and is not linked to any person.
The locally stored data is automatically deleted as soon as:
- you leave the website or close the browser, or
- 12 hours of inactivity are exceeded.
No storage on our servers or attribution to any person takes place.
Cookies and Tracking Technologies
General
We use cookies to analyse the use of our website and to improve the user experience. The legal basis for accessing your device is § 25(1) TDDDG (consent) or § 25(2) TDDDG (technically necessary cookies).
Consequences of a refusal: If you refuse cookies, the website will continue to function fully. Only analytics functions will not be activated.
Tools and services used
| Tool/Service | Purpose | Legal basis | Retention period | Third-country transfer | Safeguards |
|---|---|---|---|---|---|
| Google Analytics | Analysis of user behaviour | Consent (Art. 6(1)(a) GDPR) | Up to 14 months | USA | SCCs + Data Privacy Framework; IP anonymisation active |
| AWS Web Hosting | Operation of the web app | Legitimate interest (Art. 6(1)(f) GDPR) | As long as necessary | No (DE) | TLS, access control |
| Hetzner Online GmbH | Web hosting of the website (since 18.09.2026; previously webGo) | Legitimate interest (Art. 6(1)(f) GDPR) | As long as necessary | No (DE, data centre Nuremberg) | TLS, access control; DPA under Art. 28 GDPR concluded |
Third-country transfers: Google Analytics transfers data to the USA on the basis of the EU-US Data Privacy Framework (Art. 45 GDPR) and EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Copy on request: privacy@leano.net.
Note on AWS (Cloud Act): The server location is Germany. As a US company, AWS is subject to the US CLOUD Act. A data processing agreement (DPA) with AWS is in place; technical safeguards are implemented.
Consent and Withdrawal
Cookies requiring consent are only set after your explicit approval. You can withdraw your consent at any time via your browser settings. The withdrawal does not affect the lawfulness of processing carried out up to that point.
Purposes, Legal Bases and Retention Periods
Website operation
- Purpose: Provision and operation of the website
- Legal basis: Legitimate interest (Art. 6(1)(f) GDPR)
- Retention period: Server logs 90 days
Analysis and improvement
- Purpose: Analysis of user behaviour, optimisation of the website
- Legal basis: Consent (Art. 6(1)(a) GDPR)
- Retention period: Up to 14 months or until withdrawal
Necessity of providing data
For mere use of the website without registration, no provision of personal data is required. Consent to analytics cookies is voluntary – a refusal has no disadvantages whatsoever.
Data Subject Rights
As a data subject, you have the following rights:
- Right of access (Art. 15 GDPR): You may request information at any time as to whether and which personal data we process about you – including details of the processing purposes, recipients, retention period and your rights. On request, we will provide you with a copy of the processed data.
- Right to rectification (Art. 16 GDPR): You may request the rectification of inaccurate personal data or the completion of incomplete personal data.
- Right to erasure (Art. 17 GDPR): You may request the erasure of your personal data, provided that no statutory retention obligations preclude this (e.g. tax or commercial law obligations).
- Right to restriction (Art. 18 GDPR): You may request that the processing of your data be restricted – for example while the accuracy of your data is being verified or if you have objected to the processing. The data will then only be stored but no longer used.
- Notification obligation (Art. 19 GDPR): We will notify all recipients to whom your personal data has been disclosed of any rectification, erasure or restriction of processing, unless this proves impossible or involves disproportionate effort. On request, we will inform you about these recipients.
- Right to object (Art. 21 GDPR): You may object to the processing of your data where this is based on legitimate interests (Art. 6(1)(f) GDPR) – e.g. when using Google Analytics. We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests.
- Right to data portability (Art. 20 GDPR): You may request that the data concerning you be provided in a structured, commonly used and machine-readable format and have it transmitted to another controller.
No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place.
To exercise your rights, please contact us at: privacy@leano.net. We will respond to your request within one month of receipt. In complex cases, the period may be extended by a further two months, of which we will inform you.
Complaint to a Supervisory Authority
Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit)
Friedrichstraße 219, 10969 Berlin | www.datenschutz-berlin.de
Changes to this Privacy Policy
We reserve the right to amend this policy. You will always find the current version on our website.
Privacy — Registered
This privacy policy describes how leano processes personal data, for what purposes, and what rights you have. This version applies to users with a free account (Freemium) after email registration.
Version and Validity
Version 1.5 | As of: 23.09.2026
Applies to: leano.net – users with a free account (freemium) following email registration. No paid membership, no payment processing.
Change from v1.1: Datadog added as a recipient (infrastructure monitoring/log analysis) under “Tools and services used”. Change v1.3: Cloudflare (WAF/CDN, app level) added as a recipient. Change v1.4: Website host changed from webGo to Hetzner Online GmbH (move on 18.09.2026).
Controller and Contact Details
Controller within the meaning of the General Data Protection Regulation (GDPR/DSGVO):
daleap GmbH, Grützmacherweg 6, 13599 Berlin, Germany
Represented by: Karsten Leipnitz (Managing Director)
Email: mail@leano.net | Telephone: +49 30 555 27 30 2 | Website: www.leano.net
Contact for data protection matters: Robert Grolla | Email: privacy@leano.net
Note: daleap GmbH is not required to appoint a data protection officer pursuant to Art. 37 GDPR.
Data Security
We take appropriate technical and organisational measures to protect your data:
- Encryption of data transmissions (TLS/SSL)
- Access controls and authentication mechanisms
- Regular review of security precautions
- Staff awareness training
Registration and Use of the Freemium Account
By registering a free account, you create a personal user account. Your email address and the content created in the web app are permanently linked to your account and stored on our servers.
Data processed:
- Email address (mandatory for account creation)
- Self-created content within the web app
- Technical usage data (logs, access data)
- Device information (browser, operating system)
No payment data: In the freemium model, no payment or billing data is collected whatsoever.
Retention period:
- Active accounts: As long as the account is active
- Inactive accounts: 1 year after deactivation (option of recovery pursuant to Art. 6(1)(f) GDPR)
- Immediate erasure on request possible at any time
Cookies and Tracking Technologies
General
We use cookies to analyse the use of our services and to improve the user experience. The legal basis is § 25(1) TDDDG (consent) or § 25(2) TDDDG (technically necessary cookies).
Consequences of a refusal: All core functions of the web app remain available. Only analytics functions are deactivated.
Tools and services used
| Tool/Service | Purpose | Legal basis | Retention period | Third-country transfer | Safeguards |
|---|---|---|---|---|---|
| Google Analytics | Analysis of user behaviour | Consent (Art. 6(1)(a) GDPR) | Up to 14 months | USA | SCCs + Data Privacy Framework; IP anonymisation active |
| KlickTipp – Transactional emails | Account confirmation, password reset, system emails | Performance of a contract (Art. 6(1)(b) GDPR) | As long as the account is active; erasure within 60 days after account deletion | No (DE) | Server location Germany |
| KlickTipp – Marketing | Newsletter, product information | Consent (Art. 6(1)(a) GDPR) | Until withdrawal (erasure within 30 days) | No (DE) | Server location Germany |
| AWS Web Hosting | Operation of the web app | Legitimate interest (Art. 6(1)(f) GDPR) | As long as necessary | No (DE) | TLS, access control |
| Hetzner Online GmbH | Web hosting of the website (since 18.09.2026; previously webGo) | Legitimate interest (Art. 6(1)(f) GDPR) | As long as necessary | No (DE, data centre Nuremberg) | TLS, access control; DPA under Art. 28 GDPR concluded |
| Datadog | Infrastructure monitoring and log analysis (error analysis, availability) | Legitimate interest (Art. 6(1)(f) GDPR) | 7 days | USA | EU-US Data Privacy Framework + EU Standard Contractual Clauses (Module 2, DPA § 10); IP truncation as a data minimisation measure |
| Cloudflare | Web application firewall (WAF), CDN and DDoS protection for the platform | Legitimate interest (Art. 6(1)(f) GDPR) | As long as necessary (security logs) | USA | EU-US Data Privacy Framework (Participant #5666) + EU Standard Contractual Clauses (DPA annex) |
Third-country transfers: Google Analytics and Datadog transfer data to the USA on the basis of the EU-US Data Privacy Framework (Art. 45 GDPR) and EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Copy on request: privacy@leano.net.
Note on Datadog (infrastructure monitoring and log analysis): To monitor the availability and performance of our platform and for error analysis we use services of Datadog, Inc., 620 8th Ave., 45th Floor, New York, NY 10018, USA. Log data from our web server is transmitted to Datadog. This contains a truncated IP address (the last octet, or for IPv6 everything from /48 onwards, is removed when the log is written), the browser identifier (user agent), the referrer, the address called up including any query parameters, and a technical session identifier (session cookie ID). No evaluation beyond this for analysis or marketing purposes takes place. A data processing agreement in accordance with Art. 28 GDPR is in place with Datadog. This applies only to freemium and Pro/Branch accounts (platform/web app) – the website leano.net is hosted separately by Hetzner (since 18.09.2026; previously webGo) and does not run on the monitored app infrastructure.
Note on Cloudflare (web application firewall and CDN): To protect our platform against attacks (e.g. DDoS, SQL injection, bot traffic) and to deliver content we use services of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Technical connection data is processed in the course of this, in particular the full IP address. A data processing agreement in accordance with Art. 28 GDPR is in place with Cloudflare. This applies only to freemium and Pro/Branch accounts (platform/web app) – the website leano.net is hosted separately by Hetzner (since 18.09.2026; previously webGo) and does not run on the app infrastructure protected by Cloudflare.
Note on AWS (Cloud Act): The server location is Germany. As a US company, AWS is subject to the US CLOUD Act. A data processing agreement (DPA) with AWS is in place.
Use of Artificial Intelligence
Should AI functions be implemented in the web app, we will inform you separately before their use in accordance with the EU AI Regulation (EU) 2024/1689.
Consent and Withdrawal
Variant for private individuals
Cookies requiring consent are only set after your explicit approval. Withdrawal at any time via your browser settings (cookies) or the unsubscribe link in emails (newsletter). The withdrawal does not affect the lawfulness of processing carried out up to that point.
Variant for companies
Consent is given by the authorised representative of the company. Withdrawal informally by email to privacy@leano.net or via the account settings by an authorised person (e.g. administrator).
Purposes, Legal Bases and Retention Periods
Registration and use of the web app
- Purpose: Provision of the web app, account management, authentication, personalisation
- Legal basis: Performance of a contract (Art. 6(1)(b) GDPR)
- Retention period: Active accounts permanently; inactive accounts 1 year; immediate erasure on request
Communication and support
- Purpose: Responding to support requests, onboarding emails, system notifications
- Legal basis: Performance of a contract (Art. 6(1)(b) GDPR), legitimate interest (Art. 6(1)(f) GDPR)
- Retention period: As long as necessary to process the request
Analysis and improvement of the services
- Purpose: Analysis of user behaviour, optimisation, error correction
- Legal basis: Consent (Art. 6(1)(a) GDPR) for Google Analytics; legitimate interest (Art. 6(1)(f) GDPR) for internal error analysis
- Retention period: Up to 14 months or until withdrawal
Marketing and newsletter
- Purpose: Sending newsletters and product information
- Legal basis: Consent (Art. 6(1)(a) GDPR)
- Retention period: Until withdrawal
Necessity of providing data
- Registration (6.1): The email address is required for the conclusion of the contract. Without this information, no account can be created.
- Analysis (6.3): Consent to cookies is voluntary – no effect on the use of the app.
- Marketing (6.4): Consent is voluntary – no negative consequences in the event of refusal.
Data Subject Rights
As a data subject, you have the following rights:
- Right of access (Art. 15 GDPR): You may request information at any time as to whether and which personal data we process about you – including details of the processing purposes, recipients, retention period and your rights. On request, we will provide you with a copy of the processed data.
- Right to rectification (Art. 16 GDPR): You may request the rectification of inaccurate personal data or the completion of incomplete personal data.
- Right to erasure (Art. 17 GDPR): You may request the erasure of your personal data, provided that no statutory retention obligations preclude this. This also includes all content created in the app. If you request immediate erasure, all personal data and user content will be irrevocably deleted.
- Right to restriction (Art. 18 GDPR): You may request that the processing of your data be restricted – for example while the accuracy of your data is being verified or if you have objected to the processing. The data will then only be stored but no longer used.
- Notification obligation (Art. 19 GDPR): We will notify all recipients to whom your personal data has been disclosed of any rectification, erasure or restriction of processing, unless this proves impossible or involves disproportionate effort. On request, we will inform you about these recipients.
- Right to object (Art. 21 GDPR): You may object to the processing of your data where this is based on legitimate interests (Art. 6(1)(f) GDPR). We will then no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests.
- Right to data portability (Art. 20 GDPR): You may request that the data concerning you be provided in a structured, commonly used and machine-readable format and have it transmitted to another controller.
Note on the right to object to direct marketing (Art. 21(2) and (4) GDPR): Where we process your personal data for direct marketing (e.g. newsletters via KlickTipp), you have the right to object to the processing at any time. After exercising the objection, your data will no longer be processed for direct marketing purposes. The objection may be made informally by email to privacy@leano.net or via the unsubscribe link in every email.
No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place.
To exercise your rights, please contact us at: privacy@leano.net. We will respond to your request within one month of receipt. In complex cases, the period may be extended by a further two months, of which we will inform you.
Complaint to a Supervisory Authority
Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit)
Friedrichstraße 219, 10969 Berlin | www.datenschutz-berlin.de
Changes to this Privacy Policy
We reserve the right to amend this policy. We will inform you of material changes by email or a notice on the website. You will always find the current version on our website.
Privacy — Subscriber
This privacy policy describes how leano processes personal data, for what purposes, and what rights you have. This version applies to paying customers with a Pro account (single access) or Branch account (a branch with multiple users).
Version and Validity
Version 1.7 | As of: 23.09.2026
Applies to: leano.net – paying customers with a Pro account (individual access) or Branch account (branch office with multiple users).
Change from v1.4: Datadog added as a recipient (infrastructure monitoring/log analysis) under “Tools and services used”. Change v1.5: Cloudflare (WAF/CDN, app level) added as a recipient. Change v1.6: Website host changed from webGo to Hetzner Online GmbH (move on 18.09.2026).
Controller and Contact Details
Controller within the meaning of the General Data Protection Regulation (GDPR/DSGVO):
daleap GmbH
Grützmacherweg 6
13599 Berlin
Germany
Represented by: Karsten Leipnitz (Managing Director)
Contact: Email: mail@leano.net Telephone: +49 30 555 27 30 2 Website: www.leano.net
Contact for data protection matters: Robert Grolla
Email: privacy@leano.net
Note: daleap GmbH is not required to appoint a data protection officer pursuant to Art. 37 GDPR. For all data protection enquiries, please contact the address stated above.
Data Security (Technical and Organisational Measures)
daleap GmbH takes appropriate technical and organisational measures to protect your personal data against loss, destruction, manipulation and unauthorised access. Our security measures are continuously improved in line with technological developments.
The measures include:
- Encryption of data transmissions (TLS/SSL)
- Access controls and authentication mechanisms
- Regular review and updating of security precautions
- Staff awareness training in handling personal data
Use of the Web App Without Registration (Freemium Model)
Users can use the web app without registration within the scope of the freemium model. In this case, no personal data is permanently stored on our servers. All data created or edited while using the app without logging in remains locally on the user's device and is not linked to any person.
The data is automatically and irrevocably deleted as soon as one of the following conditions occurs:
- The user leaves the website or closes the browser.
- 12 hours of inactivity (no interaction with the web app) are exceeded.
No storage on our servers or attribution to any person takes place. This also applies if a user already belongs to a company with a Branch account but has not yet been assigned to a user account themselves (e.g. employees before assignment by the administrator).
Registration and Use of the Pro/Branch Account
Upon concluding a paid subscription (Pro account or Branch account), you create a personal user account or – for a Branch account – several linked user accounts for your branch office. Your data, as well as the content created in the web app, is permanently linked to your account and stored on our servers.
Data processed:
- Email address and name (mandatory information for account creation and conclusion of the contract)
- Billing address and payment data (processed via Stripe, see the Cookies and Tracking Technologies section)
- For a Branch account additionally: company name as well as the names and email addresses of the assigned users
- Content created by you in the web app
- Technical usage data (logs, access data)
- Device information (browser, operating system)
Retention period:
- Active accounts: As long as the account is active or statutory retention obligations exist (e.g. 10 years pursuant to § 257 HGB for tax-relevant data)
- Cancelled/inactive accounts: 1 year after cancellation or deactivation (option of recovery pursuant to Art. 6(1)(f) GDPR), provided that no statutory retention obligations preclude this
- Immediate erasure available at any time on request, provided that no statutory retention obligations preclude this
Cookies and Tracking Technologies
General
We use cookies and similar tracking technologies to analyse the use of our website and services, to improve the user experience and to provide personalised content. Cookies are small text files stored on your device.
The legal basis for accessing your device (setting and reading cookies) is § 25(1) TDDDG (consent) or § 25(2) TDDDG (technically necessary cookies not requiring consent). The subsequent processing of the personal data collected in this way is governed by the legal bases of the GDPR set out in the table below.
Consequences of a refusal: If you refuse cookies, all core functions of the web app will continue to work fully. Only analytics functions (Google Analytics) and personalised marketing (KlickTipp) will not be activated. You will suffer no disadvantages in using leano.
Tools and services used
| Tool/Service | Purpose | Legal basis | Retention period | IP anonymisation | Third-country transfer | Safeguards |
|---|---|---|---|---|---|---|
| Google Analytics | Analysis of user behaviour | Consent (Art. 6(1)(a) GDPR) | Up to 14 months | Yes | USA | EU Standard Contractual Clauses (SCCs) and Data Privacy Framework. Consent management via the consent management tool implemented on the website. |
| Stripe | Processing of payments and sending of invoices | Performance of a contract (Art. 6(1)(b) GDPR) | In accordance with Stripe retention policies; tax-relevant data for 10 years (§ 257 HGB) | No | USA | EU Standard Contractual Clauses (SCCs) and Data Privacy Framework |
| KlickTipp – Transactional emails | Account confirmation, password reset, system emails | Performance of a contract (Art. 6(1)(b) GDPR) | As long as the account is active; erasure within 60 days after account deletion | No | No | None (server location Germany) |
| KlickTipp – Marketing | Email marketing, newsletter dispatch | Consent (Art. 6(1)(a) GDPR) | Until withdrawal; erasure within 60 days after withdrawal | No | No | None (server location Germany) |
| AWS Web Hosting | Provision and operation of the web app | Performance of a contract (Art. 6(1)(b) GDPR) | As long as necessary | No | No (server location Germany) | Server location Germany, therefore no third-country transfer. Technical safeguards: TLS encryption, access control |
| Hetzner Online GmbH | Web hosting (provision and operation of the website; since 18.09.2026, previously webGo) | Legitimate interest (Art. 6(1)(f) GDPR) | As long as necessary | No | No (server location Germany, data centre Nuremberg) | Server location Germany, therefore no third-country transfer. TLS encryption, access control; DPA under Art. 28 GDPR concluded |
| Datadog | Infrastructure monitoring and log analysis (error analysis, availability) | Legitimate interest (Art. 6(1)(f) GDPR) | 7 days | Partly (truncated IP – pseudonymisation, not full anonymisation) | USA | EU-US Data Privacy Framework + EU Standard Contractual Clauses (Module 2, DPA § 10) |
| Cloudflare | Web application firewall (WAF), CDN and DDoS protection for the platform | Legitimate interest (Art. 6(1)(f) GDPR) | As long as necessary (security logs) | No (full IP required for attack detection) | USA | EU-US Data Privacy Framework (Participant #5666) + EU Standard Contractual Clauses (DPA annex) |
Third-country transfers: Stripe and Google Analytics transfer data to the USA. The transfer takes place on the basis of the adequacy decision of the EU Commission pursuant to Art. 45 GDPR (EU-US Data Privacy Framework) and additionally on the basis of EU Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR. You have the right to obtain a copy of the Standard Contractual Clauses; to do so, please contact privacy@leano.net.
Note on Datadog (infrastructure monitoring and log analysis): To monitor the availability and performance of our platform and for error analysis we use services of Datadog, Inc., 620 8th Ave., 45th Floor, New York, NY 10018, USA. Log data from our web server is transmitted to Datadog. This contains a truncated IP address (the last octet, or for IPv6 everything from /48 onwards, is removed when the log is written), the browser identifier (user agent), the referrer, the address called up including any query parameters, and a technical session identifier (session cookie ID). No evaluation beyond this for analysis or marketing purposes takes place. A data processing agreement in accordance with Art. 28 GDPR is in place with Datadog; the IP truncation serves data minimisation but does not constitute anonymisation. This applies only to freemium and Pro/Branch accounts (platform/web app) – the website leano.net is hosted separately by Hetzner (since 18.09.2026; previously webGo) and does not run on the monitored app infrastructure.
Note on Cloudflare (web application firewall and CDN): To protect our platform against attacks (e.g. DDoS, SQL injection, bot traffic) and to deliver content we use services of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Technical connection data is processed in the course of this, in particular the full IP address. A data processing agreement in accordance with Art. 28 GDPR is in place with Cloudflare. This applies only to freemium and Pro/Branch accounts (platform/web app) – the website leano.net is hosted separately by Hetzner (since 18.09.2026; previously webGo) and does not run on the app infrastructure protected by Cloudflare.
Note on IP anonymisation (Google Analytics): Google Analytics is configured so that IP addresses are anonymised on the EU server before transmission to the USA (IP masking). A complete IP address is not transmitted to Google servers in the USA.
Note on AWS (Cloud Act): The server location for AWS is in Germany (EU). However, AWS is a US company and is subject to the US CLOUD Act. In exceptional cases, US authorities could demand access to data on the basis of this act. We have concluded a data processing agreement (DPA) with AWS and employ technical safeguards (TLS encryption, access control) to minimise the risk.
For processing on the basis of Art. 6(1)(f) GDPR (AWS web hosting, analysis), we have carried out a balancing of interests. Our legitimate interest lies in ensuring the stability, security and continuous improvement of our services. Your interests and fundamental rights are safeguarded by the technical and organisational measures mentioned above.
Use of Artificial Intelligence
Should Leano AI functions be implemented in the web app, we will inform you separately before their use. AI systems are used in compliance with Regulation (EU) 2024/1689 (AI Regulation) and the GDPR. You will be informed when you interact with an AI system or receive AI-generated content (Art. 50 AI Regulation). This section takes effect as soon as AI functions are activated in the Leano web app. The legal basis for the processing of personal data by AI systems will be stated separately at the time of implementation.
Consent and Withdrawal
Variant for private individuals
The use of cookies and tracking technologies requiring consent takes place only after your explicit approval. You can withdraw your consent at any time. For cookies, you can do this via your browser settings. For newsletters and marketing emails, please use the unsubscribe link contained in every email. The withdrawal does not affect the lawfulness of processing carried out up to that point.
Variant for companies
The use of cookies and tracking technologies requiring consent takes place only after the explicit approval of the authorised representative of your company. The withdrawal may be made by an informal notice to privacy@leano.net or via the settings stored in the user account. Please note that the withdrawal must be made by an authorised person (e.g. administrator) of the company. The withdrawal does not affect the lawfulness of processing carried out up to that point.
Affected groups of persons in the B2B area: employees, representatives or authorised users of companies that use our services.
Purposes, Legal Bases and Retention Periods of the Data Processing
Registration and use of the web app
- Purpose: Provision of the web app, management of user accounts, authentication, personalisation of the user experience
- Legal basis: Performance of a contract (Art. 6(1)(b) GDPR)
- Retention period:
- Active user accounts: As long as the user account is active or statutory retention obligations exist (e.g. 10 years pursuant to § 257 HGB for tax-relevant data).
- Inactive user accounts: User data created in the app is stored for one year after deactivation or deletion of the account. The one-year retention serves the option of recovery for returning users and is based on our legitimate interest pursuant to Art. 6(1)(f) GDPR.
- Immediate erasure: Users can request the immediate erasure of their data at any time. In this case, all personal data and user content will be irrevocably deleted, provided that no statutory retention obligations preclude this.
Payment processing
- Purpose: Processing of subscriptions and payments
- Legal basis: Performance of a contract (Art. 6(1)(b) GDPR)
- Retention period: As long as necessary for the performance of the contract and statutory retention obligations (e.g. 10 years pursuant to § 257 HGB).
Communication and support
- Purpose: Responding to support requests, sending system notifications
- Legal basis: Performance of a contract (Art. 6(1)(b) GDPR), legitimate interest (Art. 6(1)(f) GDPR)
- Retention period: As long as necessary to process the request
Analysis and improvement of the services
- Purpose: Analysis of user behaviour, optimisation of the web app, error correction
- Legal basis: For Google Analytics and external tracking tools: consent (Art. 6(1)(a) GDPR). For internal error analysis without personal data: legitimate interest (Art. 6(1)(f) GDPR)
- Retention period: Up to 14 months (Google Analytics) or until withdrawal
Marketing and newsletter
- Purpose: Sending newsletters, personalised advertising
- Legal basis: Consent (Art. 6(1)(a) GDPR)
- Retention period: Until withdrawal
Necessity of providing data
The provision of personal data is in part required by law or contract or necessary for the conclusion of the contract:
- Registration and use (§ 6.1): The provision of name and email address is required for the conclusion of the contract. Without this data, no user account can be created and the web app cannot be used to its full extent.
- Payment processing (§ 6.2): The provision of payment data is required by contract. Without this data, no paid subscription can be concluded.
- Analysis and improvement (§ 6.4): Consent to cookies and tracking is voluntary. A refusal to consent has no negative consequences for the use of the web app.
- Marketing and newsletter (§ 6.5): Consent is voluntary. A refusal to consent has no negative consequences.
Data Subject Rights
As a data subject, you have the following rights:
- Right of access (Art. 15 GDPR): You may request information at any time about whether and which personal data we process about you – including details of the purposes of processing, recipients, retention period and your rights. On request, we will provide you with a copy of the processed data.
- Right to rectification (Art. 16 GDPR): You may request the rectification of inaccurate or the completion of incomplete personal data.
- Right to erasure (Art. 17 GDPR): You may request the erasure of your personal data, provided that no statutory retention obligations preclude this (e.g. tax or commercial law obligations). This also includes all content created in the app. If you request immediate erasure, all personal data and user content will be irrevocably deleted.
- Right to restriction (Art. 18 GDPR): You may request that the processing of your data be restricted – for example while the accuracy of your data is being verified or if you have objected to the processing. The data will then only be stored, but not otherwise used.
- Notification obligation (Art. 19 GDPR): We will notify all recipients to whom your personal data has been disclosed of any rectification, erasure or restriction of processing, unless this proves impossible or involves disproportionate effort. On request, we will inform you of these recipients.
- Right to object (Art. 21 GDPR): You may object to the processing of your data where it is based on legitimate interests (Art. 6(1)(f) GDPR). We will then no longer process your data, unless we can demonstrate compelling legitimate grounds for the processing that override your interests.
- Right to data portability (Art. 20 GDPR): You may request the release of the data concerning you in a structured, commonly used and machine-readable format and have it transmitted to another controller.
Note on the right to object to direct marketing (Art. 21(2) and (4) GDPR): Where we process your personal data for direct marketing (e.g. newsletters via KlickTipp), you have the right to object to the processing at any time. After exercising the objection, your data will no longer be processed for direct marketing purposes. The objection may be made informally by email to privacy@leano.net or via the unsubscribe link in every email.
No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place.
To exercise your rights, please contact us at: privacy@leano.net. We will respond to your request within one month of receipt. In complex cases, the period may be extended by a further two months, of which we will inform you.
Complaint to a Supervisory Authority
You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR. The supervisory authority responsible for us is:
Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit)
Friedrichstraße 219
10969 Berlin
Germany
Website: www.datenschutz-berlin.de
Changes to this Privacy Policy
We reserve the right to amend this privacy policy in order to adapt it to changed legal provisions or our services. We will inform you of material changes by email or by a clear notice on our website. You will always find the current version on our website.