Legal NoticeData ProtectionAccessibility

Privacy Policy

The purpose of this Privacy Policy is to inform you about how we process personal data. Protecting your privacy is of the utmost importance to us, which is why compliance with data protection laws is a matter of course for us.

Name and contact details of the controller

Leading Lights GmbH (hereinafter: Leading Lights),
Alsterdorfer Strasse 2a,
D-22299 Hamburg, Germany
Email: info@leadinglights.de

‍Phone: +49 40 4677 - 5450
Fax: +49 40 4677 – 5703

Data Protection Officer

If you have any questions about our data protection measures, the processing of your data or the exercise of your data subject rights, you can reach us and our Data Protection Officer as follows:

External Data Protection Officer

ePrivacy GmbH, represented by Prof. Dr. Christoph Bauer and Stefanie Bauer, Bei den Mühren 5, 20457 Hamburg, Germany

Phone: +49 40 – 6094518 -25/-16
E-Mail: datenschutz@leadinglights.de

If you wish to communicate directly with our Data Protection Officer (for example, because your concern is particularly sensitive), please contact them by post, as communication by email can always involve security gaps. When making your request, please state that your concern relates to Leading Lights GmbH.

Personal Data

Personal data is any information relating to an identified or identifiable person. This includes the following categories of personal data that we process:

  • Your personal contact details (such as first name, last name, address, email address, telephone number),
  • Your correspondence with us,
  • Log files containing information about your visit to our website,
  • The browser used and, where applicable, your computer's operating system and the name of your access provider,
  • Payment data (such as account number, credit card number, financial institution),
  • Online identifiers (such as cookie IDs, IP addresses, advertising IDs),
  • Customer data (such as invoice data, user profiles, address, order history, payment data),
  • Application data (such as CV, references and certificates)

Use of Cookies

General information on cookies

A cookie is a text file containing an identification number that is transmitted to the user's computer together with the other data actually requested when the website is used, and is stored there. The file is kept there for later access and serves to authenticate the user. Since cookies are merely simple files and not executable programs, they pose no danger to the computer.

Depending on the settings the user has chosen for their web browser, the browser may accept cookies automatically. However, this setting can be changed and the storage of cookies can be deactivated, or set so that the user is notified as soon as a cookie is set. If the use of cookies is deactivated, some functions of the website may not be available or may only be available to a limited extent. You can prevent our website from setting cookies at any time by adjusting the settings of the web browser you use, thereby permanently objecting to the setting of cookies.

You can delete cookies that have already been stored via your browser settings. In addition, you can change or withdraw your consent to analytics and marketing technologies at any time via the cookie settings on our website.

Session cookies

Session cookies are used for the duration of a session and are then automatically deleted when the browser in use is closed. For example, they ensure that video and audio files can be played and that your user input is temporarily stored while you are entering it, thereby improving user-friendliness.

Persistent cookies

Persistent cookies remain on your device after the browser has been closed. These cookies can, for example, store your user preferences, such as language settings, and analyse user behaviour on our website. The storage period of persistent cookies corresponds to the lifetime of the respective cookie. After that, they are automatically deleted.

Consent and cookie settings

We use cookies and comparable technologies, for example to store your cookie choices, to analyse the use of our website and to measure the success of advertising campaigns. Where consent is required for this, their use is governed by Section 25 (1) TDDDG (German Telecommunications Digital Services Data Protection Act); the processing of personal data based on this takes place on the basis of Art. 6 (1) (a) GDPR. Processes that are strictly technically necessary may be permissible without consent under the conditions of Section 25 (2) TDDDG.

Via our cookie banner, you can distinguish between necessary technologies and the categories Analytics/Statistics and Marketing, grant or refuse your consent, and later change your choice via the cookie settings on our website. You can withdraw any consent you have given at any time with effect for the future. Cookies that have already been set at the time of withdrawal can additionally be deleted via your browser settings.

The Analytics/Statistics category includes Google Analytics and Contentsquare; Google Ads Conversion Tracking is assigned to the Marketing category. We use Google Consent Mode v2 to pass your choices on to Google services. With this technical implementation, Google tags are already loaded when the page is accessed. Even if consent is refused, cookieless technical signals (so-called pings) may be transmitted to Google; further details can be found under Google Analytics and Google Ads.

Purposes of processing

We process your data for the following purposes:

  • for correspondence with you,
  • for the performance of contracts with you,
  • for quality assurance and statistics,
  • for the provision of our service,
  • for the consideration of your application,
  • for the improvement of our service,

Legal basis

We rely on the following legal bases for the processing of your data:

  • your consent, if you have given it to us (Art. 6 (1) (a) GDPR),
  • the initiation or performance of a contract with you (Art. 6 (1) (b) GDPR),
  • compliance with legal obligations (Art. 6 (1) (c) GDPR),
  • the pursuit of our legitimate interests (Art. 6 (1) (f) GDPR)

Legitimate interests

The processing of your data serves to safeguard the following legitimate interests:

  • the improvement of our offering,
  • the protection of our systems against misuse,
  • the compilation of statistics,
  • the retention of our correspondence with you,

Requirements or obligation to provide data

Unless expressly stated otherwise, the provision of your data is neither required nor mandatory.

Storage period

We store your data:

  • if you have consented to the processing, at most until you withdraw your consent;
  • if we need the data to perform a contract, at most for as long as the contractual relationship with you exists;
  • if we use the data on the basis of a legitimate interest, at most for as long as your interest in erasure or anonymisation does not prevail;
  • where statutory retention obligations exist, until the end of the retention periods.

Insofar as we use the analytics and marketing services described below, additional service-specific and settings-dependent storage periods apply to the cookies they set and the data they process. Information on Google Analytics and the terms of the respective services can be found in the relevant sections.

We operate a LinkedIn Page ("company page") on LinkedIn, a service of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (hereinafter "LinkedIn").
   
Wir nutzen unsere Unternehmensseite, um mit LinkedIn-Mitgliedern und -Besuchern in Kontakt zu treten und mit ihnen zu kommunizieren und um Informationen über unser Unternehmen und seine Produkte und Dienstleistungen bereitzustellen. Wenn Sie uns kontaktieren, können wir die Informationen einsehen, die Sie als LinkedIn-Mitglied auf LinkedIn gepostet haben. Wenn Sie unsere Inhalte teilen, liken oder kommentieren oder wenn Sie unser Unternehmensprofil auf LinkedIn erwähnen, können wir ebenfalls auf diese Informationen zugreifen.

When processing your data, we work with the following service providers who have access to your data:

Data recipients

LinkedIn Page

When a member visits, follows or engages with the page, LinkedIn processes personal data in order to provide us with information about this ("Page Insights"). This enables us to improve our marketing activities. LinkedIn processes data that the member has made available to LinkedIn, such as job function, country, industry, seniority, company size and employment status data from the member's profile. In addition, LinkedIn will process information about how a member has interacted with our company page.

We have concluded an agreement with LinkedIn, the Page Insights Joint Controller Addendum (the "Addendum"). This agreement forms part of the LinkedIn Pages Terms and sets out the responsibilities of LinkedIn and us with regard to the processing of Page Insights. The Page Insights Joint Controller Addendum is available here:

Further information about Page Insights and how you can exercise your rights as a data subject can be found in the "Page Insights Information". More detailed information on how LinkedIn processes which personal data and how you can exercise your rights as a data subject vis-à-vis LinkedIn can be found in LinkedIn's privacy policy, published here:  https://www.linkedin.com/legal/privacy-policy.

https://www.linkedin.com/legal/l/page-joint-controller-addendum.

Google Tag Manager

We use Google Tag Manager from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter "Google"). Tag Manager is used for the central management and delivery of website tags. In particular, we use it to integrate Google Analytics, Google Ads Conversion Tracking and Contentsquare. Tag Manager is not itself an independent analytics or advertising profiling tool; however, the services integrated through it may process personal data and use cookies or similar technologies.

When the Tag Manager script is retrieved, a connection is established to Google servers. In particular, your IP address and technical connection data may be transmitted in the process. The respective downstream data processing operations and their legal bases are described in the following sections. Further information: https://policies.google.com/privacy and https://marketingplatform.google.com/about/tag-manager/.

Google Analytics 4

We use Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for the statistical analysis of the use of our website. In particular, information about pages accessed, interactions, approximate location, device, browser, source of the visit and times of use, as well as online identifiers, may be collected and processed. The analysis helps us to understand and improve the reach, use and technical performance of our website.

Your consent under Section 25 (1) TDDDG and Art. 6 (1) (a) GDPR is decisive for the use of analytics cookies and the analysis based on them. Within the framework of the Google Consent Mode v2 that we use, Google tags are already loaded when the page is accessed; without analytics consent, instead of the regular cookie-based measurement, cookieless pings with technical information, including details of the page view and consent status, may be transmitted to Google. Google may also use such signals for model-based statistical analysis.

With appropriate consent, Google Analytics uses, for example, cookies of the _ga family to recognise browsers. The retention period of individual cookies depends on their technical configuration; the retention of user and event data in Google Analytics 4 depends on the settings of our Analytics property and the periods offered by Google. Further information: https://support.google.com/analytics/answer/7667196 and https://policies.google.com/privacy.

Google Ads Conversion Tracking

We use Google Ads Conversion Tracking from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This allows us to measure whether visits following a click on a Google ad lead to certain actions on our website, such as making contact. The measurement helps us to assess and optimise our ads. According to your information, we do not use Google Ads for remarketing on our website.

Where cookies or comparable identifiers are used for this purpose, this is done on the basis of your consent pursuant to Section 25 (1) TDDDG and Art. 6 (1) (a) GDPR. Depending on your consent, identifiers for ad attribution, information about ad clicks, the pages visited and the measured conversion in particular may be transmitted to Google. In the absence of consent, cookieless conversion and consent signals may be sent to Google instead of cookie-based data under the Google Consent Mode v2 we use. Further information: https://policies.google.com/privacy and https://support.google.com/google-ads/answer/13802165.

Contentsquare (session recordings and heatmaps)

To analyse the usability of our website, we use the Contentsquare platform (Content Square SAS, 7 rue de Madrid, 75008 Paris, France). Heatmaps and session recordings are used. These analyse, for example, which areas are accessed or clicked, how visitors move through pages and where they have difficulties using the site. For this purpose, Contentsquare processes in particular pseudonymous online identifiers, usage and interaction data, and technical information about the browser, device and pages accessed. Cookies or comparable storage technologies may be used.

"Full Masking" is enabled for session recordings in our Contentsquare project. As a result, according to Contentsquare's technical masking rules, visible text, numbers and media content, among other things, are concealed in the recordings. This setting reduces the risk of content disclosing personal information; it does not prevent every collection of technical or personal usage data.

Contentsquare is assigned to the Analytics/Statistics category. Consent under Section 25 (1) TDDDG and Art. 6 (1) (a) GDPR is generally required for the storage and reading of non-essential analytics identifiers and the associated behavioural analysis. However, according to the current technical state of our website, Contentsquare is also loaded and sets analytics cookies when no consent for Analytics/Statistics has been given in the cookie banner. This integration therefore does not yet comply with the intended consent management and must be technically adjusted. Further information: https://contentsquare.com/privacy-center/ and https://support.contentsquare.com/.

Google reCAPTCHA v2

On our website, we use the checkbox version of Google reCAPTCHA v2 integrated in Webflow, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. reCAPTCHA serves to detect and prevent automated input and abusive form submissions. For this purpose, IP address, browser and device information, interactions with the CAPTCHA, time and other technical signals, among other things, may be transmitted to Google. Google points out that the cookie _GRECAPTCHA is set for security purposes when reCAPTCHA is executed.

According to the current technical state, the reCAPTCHA component is already loaded when the page is accessed and is not linked to the selection made in the cookie banner. The purpose of the data processing is to protect our contact forms and technical systems against spam and misuse (Art. 6 (1) (f) GDPR). Whether the specific integration and any access to device data fall under the exception of Section 25 (2) TDDDG or require separate consent must be assessed on the basis of the cookies actually set and the data actually transmitted. Further information: https://policies.google.com/privacy and https://developers.google.com/recaptcha/docs/faq.

Google Fonts (Open Sans)

To display the "Open Sans" font consistently, we integrate Google Fonts from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, directly from Google servers. When a page is accessed, your browser establishes a connection to the Google Fonts domains in order to retrieve font files and, where applicable, associated stylesheets. For technical reasons, your IP address in particular, as well as request and browser information, is transmitted to Google in the process.

The integration serves to ensure that our website is displayed legibly and consistently. A balancing of our legitimate interest in the presentation of the website against your interests and fundamental rights pursuant to Art. 6 (1) (f) GDPR may be considered as the legal basis for the data transfer under data protection law; the permissibility of the current external integration should be reviewed separately. Alternatively, the font files could be provided locally. Further information: https://developers.google.com/fonts/faq/privacy and https://policies.google.com/privacy.

Font delivery via the Webflow CDN (Tiempos Headline)

The "Tiempos Headline" font is not provided via Google Fonts, but via the content delivery network (CDN) of the website platform we use, Webflow (Webflow, Inc.). To retrieve the font files, your browser establishes a connection to the relevant CDN servers; this generates technically necessary connection information, in particular the IP address and details of the requested resource. The purpose of the processing is the provision and correct display of the website. Where the conditions are met in the individual case, the legal basis is Art. 6 (1) (f) GDPR (legitimate interest in a functioning and attractively presented website). Further information: https://webflow.com/legal/privacy.

Transfers to third countries

In connection with the external services mentioned, personal data may be processed outside the European Economic Area (EEA), in particular in the USA, or accessed from there. This may also be relevant if the primary storage takes place in the EU.

For transfers to third countries, we rely, where applicable, on adequacy decisions of the European Commission pursuant to Art. 45 GDPR, in particular the EU-US Data Privacy Framework for appropriately certified recipients. Where no such decision applies, appropriate safeguards may be used, in particular standard contractual clauses approved by the EU Commission pursuant to Art. 46 GDPR, together with additional safeguards where necessary. Details depend on the respective service, recipient and underlying contractual arrangements.

Your rights

As a data subject, you have the right to:

  • request information about the processing of your data and receive a copy of your personal data. Among other things, you can request information about the purposes of the processing, the categories of personal data being processed, the recipients of the data (if data is disclosed), the storage period or the criteria for determining the storage period;
  • receive the personal data concerning you in a structured, commonly used and machine-readable format or have it transmitted to another controller;
  • rectify your data. If your personal data is incomplete, you have the right, taking into account the purposes of the processing, to have the data completed;
  • have your data erased or blocked;
  • have the processing restricted;
  • object to the processing of your data;
  • withdraw your consent to the processing of your data with effect for the future; and
  • lodge a complaint with the competent supervisory authority about unlawful data processing.

Status of the privacy policy

We update this information whenever our processes change.

This privacy policy was last updated on: 28.10.2026