Privacy Policy

1. Introduction

This Privacy Policy explains how JoBe Lighting GmbH collects, uses and protects personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable national data protection law. It describes the processing on this website as it actually takes place technically.

2. Data Controller

JoBe Lighting GmbH

Hanauer Landstr. 328-330
60314 Frankfurt am Main, Germany

Email: info@jobe-lighting.com

We have not appointed a data protection officer because there is no legal obligation to do so (Section 38 of the German Federal Data Protection Act, BDSG).

3. Categories of Personal Data

• Contact data: name, email address and, if you provide them, telephone number and company
• Technical data: IP address, browser type and version, operating system, requested address, time
• Usage data: page views and interactions on this website, only with your consent (see sections 10 and 11)
• Communication data: messages submitted via the contact form or by email, details entered when booking an appointment online

4. Purposes of Processing

• Providing and securely operating the website
• Protecting the website and the contact form against misuse
• Audience measurement, only with your consent
• Processing contact and project inquiries, preparing offers
• Arranging and holding appointments at your request

5. Legal Bases

Processing is based on the following legal grounds under the GDPR: Art. 6(1)(a): consent; Art. 6(1)(b): contract performance and pre-contractual steps at your request; Art. 6(1)(c): legal obligation; Art. 6(1)(f): legitimate interests. For storing and reading information on your device, Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) applies in addition. For each processing operation we state the basis below and, for legitimate interests, the interest.

6. Hosting and Server Log Files

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA (“Vercel”). The program functions of the website, for example the contact form and our own audience measurement, run in a Vercel data center in Frankfurt am Main, Germany. When you open a page, Vercel processes the technical data needed to deliver the page and to keep it secure: IP address, date and time, the requested address, the amount of data transferred, the response status, and the browser type, operating system and, where available, the referrer URL. These runtime logs are kept at Vercel for up to 24 hours (Pro plan) and then deleted. They are not combined with other data.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure, stable and fast delivery of the website. We have a data processing agreement with Vercel under Art. 28 GDPR. Vercel is based in the United States; for transfers to the United States see section 19.

7. Database and Media Storage

The content of the website is stored in a Postgres database provided by Neon, Inc., USA (“Neon”), in a data center in Frankfurt am Main, Germany (Amazon Web Services, region eu-central-1). The database also holds the data described under “Our own audience measurement” and “Contact form and inquiries”.

Images, videos, single frames of the animations and downloadable documents are stored in the “Vercel Blob” media storage of Vercel in Frankfurt am Main, Germany (region fra1). Your browser loads these files from the media storage (address a7sgsjpumratukc2.public.blob.vercel-storage.com) or, for images, through the image optimization of Vercel on our own domain as soon as you open a page and before you make a choice in the privacy notice. Vercel receives your IP address in doing so. This is technically necessary to display the page.

The legal basis is Art. 6(1)(f) GDPR (reliable operation and display of the website). We have data processing agreements with Neon and Vercel under Art. 28 GDPR.

8. Fonts

The fonts used on this website are delivered from our own server. Opening a page does not connect your browser to servers of Google or any other font provider.

9. Privacy Notice and Storing Your Choice

Without your consent this website sets no cookies for analytics or advertising. After you consent, Google Analytics sets cookies on this website (“_ga” and “_ga_” followed by an identifier; details in our Cookie Policy). A security cookie of our hosting provider may be required (see Cookie Policy). On your first visit it shows a privacy notice at the bottom of the page with two equally weighted buttons: “Essential only” and “Allow analytics”. As long as you have not made a choice, no analytics script is loaded, no analytics cookie is set and no measurement event is sent.

When you make a choice, your browser stores it in local storage (entry “jobe-consent-v1”) so that the notice does not appear on every page. The entry contains only your choice, no identifier. It is strictly necessary (Section 25(2) no. 2 TDDDG) and stays until you delete it in your browser or change your choice. You can change or withdraw your choice at any time with “Manage consent” at the end of every page. Withdrawal takes effect for the future; the lawfulness of the processing carried out until then is not affected.

Which entries and cookies this website stores, with provider, purpose and duration, is described in our Cookie Policy.

10. Our Own Audience Measurement

If you choose “Allow analytics”, we measure the use of this website with our own system, without third-party analytics services; the data is kept in our database (section 7). Your browser then sends events such as page views, reaching page sections, scroll depth, button clicks, downloads and steps in the contact form. For each event we store the event name, details of the event (such as the label and target of a clicked button, the file name of a download, the scroll depth or, for search, only the length of the search term and the number of results), the path visited without query parameters, language and market, the time and a random session identifier. On the first page of a session we also store the campaign parameters contained in the address (utm_source, utm_medium, utm_campaign, utm_content, utm_term). Your IP address and details of your browser are not stored for this. Free text entries, for example from the contact form, are never transmitted.

The session identifier is a random number in your browser's session storage (entry “jobe-measurement-session-v1”). It applies to the open tab only and is deleted when the tab is closed; it does not link visits to each other or to other websites. Events are deleted after 90 days.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Without your consent nothing is sent. You can withdraw it at any time with effect for the future via “Manage consent”; your browser then stops sending events.

11. Google Analytics 4

If you choose “Allow analytics”, we use Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Only with your consent is Google's analytics script loaded and cookies (“_ga” and “_ga_” followed by an identifier) set. Google uses them to evaluate how the website is used, for example pages viewed, origin via campaign links, downloads, clicks on email and telephone links (without the address or number) and contact inquiries sent, and prepares reports for us. We do not pass names, email addresses or message content in the events.

We have switched off the advertising functions: data is not used for advertising or personalized advertising, and Google Signals is disabled. Measurement runs only on our own domain. Your IP address is transmitted to Google when the script is loaded and when measurement data is sent.

According to Google, the cookies are kept for up to two years. The event data in Google Analytics is kept for up to 14 months (setting in our account) and then deleted. Google may transfer data to Google LLC in the United States; see section 19. We have a data processing agreement with Google.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time with effect for the future via “Manage consent”. The Google Analytics cookies on your device are then deleted and no further data is sent to Google.

12. Contact Form and Inquiries

When you write to us through the contact form we process your name, email address, message and the type of inquiry and, if you provide them, your telephone number, company, a product reference or a configuration number. We also store the address of the page you sent the form from and the time of the inquiry. Name, email address, type of inquiry and message are required; without them we cannot handle your inquiry.

We use this data to answer your inquiry and, where applicable, to prepare an offer. The inquiry is temporarily stored encrypted on our server and handed over through a signed, encrypted connection to our internal system “Otto”, in which we handle customer inquiries. Otto is operated by JoBe on a server of Hetzner Online GmbH in a data center in Germany. If our email delivery is set up, we additionally receive a copy of the inquiry by email if the handover is disrupted (see section 14); otherwise the inquiry stays encrypted on our server and is delivered later. We do not pass the data on to third parties for their own purposes.

The legal basis is Art. 6(1)(b) GDPR where your inquiry aims at an offer or contract, and otherwise Art. 6(1)(f) GDPR (our interest in handling business inquiries). For the retention period see section 20.

13. Protection Against Misuse of the Form

To protect the form against automated misuse we limit how often inquiries can be sent from the same IP address and with the same email address (at most three inquiries per email address and ten per IP address per hour). For this we do not store the IP address or email address itself, only a check value formed with a secret key and a counter. Both are deleted at the next clean-up after the one-hour time window ends, at the latest after one day. The form also contains a field invisible to humans that is used to detect automated input. The legal basis is Art. 6(1)(f) GDPR (protecting the form and our systems against misuse).

14. Delivery by Email via Microsoft 365

If our email delivery is set up, we additionally receive a copy of the inquiry by email in a JoBe mailbox if the handover to our internal system is disrupted, so that no inquiry is lost; otherwise the inquiry stays encrypted on our server and is delivered later. For this we use Microsoft 365 of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (“Microsoft”), with which we have a data processing agreement. Sending runs from a dedicated mailbox of our own Microsoft 365 account, which Microsoft operates in data centers in the European Union. The email contains the content of your inquiry. Its reply address is the email address you gave in the form, so that we can answer you directly.

The email that is sent stays in the Sent Items folder of the sending mailbox and in the receiving mailbox and is deleted there within the periods given in section 20. The legal basis is the same as for the contact form (section 12). For transfers to third countries see section 19.

15. Visit History Attached to an Inquiry (Optional)

If you have chosen “Allow analytics” and this function is enabled, the contact form offers an additional checkbox: “Include the history of this visit (optional)”. The box is not ticked by default. If you tick it, we add to your inquiry the pages and datasheets you viewed in the current session (address without query parameters, the file name for downloads, at most the last 50 entries, with the campaign parameters of the first page view). This shows us what you were interested in and lets us answer more precisely. Your IP address and details of your device are not included.

The legal basis is your separate consent (Art. 6(1)(a) GDPR). It is voluntary; without it we handle your inquiry in the same way. We delete the visit history twelve months after the inquiry is received. You can withdraw the consent at any time with effect for the future by writing to info@jobe-lighting.com.

16. Online Appointment Booking via Microsoft Bookings

On the contact page we link our online appointment booking through Microsoft Bookings, a service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. The link opens the Microsoft booking page in a new tab. As long as you do not click the link, our website loads nothing from Microsoft and sends nothing to Microsoft. If you book an appointment, Microsoft processes the details you enter there (for example name, email address and requested time) on our behalf. We receive the booking in our Microsoft 365 account (mailbox and calendar, data centers in the European Union) and use it to hold the appointment with you. On the booking page Microsoft sets its own strictly necessary cookies; Microsoft's notices apply to them.

The legal basis is Art. 6(1)(b) GDPR (arranging an appointment at your request), otherwise Art. 6(1)(f) GDPR. We have a data processing agreement with Microsoft. For transfers to the United States see section 19.

17. Name Resolution of the Domain (Cloudflare)

The address jobe-lighting.com is resolved by the DNS service of Cloudflare, Inc., San Francisco, USA (“Cloudflare”). Your page requests do not pass through Cloudflare but go directly to Vercel. Cloudflare only processes the name queries that arise when the address is resolved; in doing so Cloudflare receives the IP address of the querying DNS server, usually that of your internet provider. The legal basis is Art. 6(1)(f) GDPR (reachability of the domain). Cloudflare is based in the United States; for transfers to the United States see section 19.

18. Recipients and Data Sharing

We share personal data only where necessary for the purposes described above and only with processors bound by agreements under Art. 28 GDPR: Vercel (hosting, media storage), Neon (database), Microsoft (email delivery, appointment booking), Hetzner (server of our internal system), Cloudflare (name resolution of the domain) and, only with your consent, Google (Google Analytics 4). We do not pass data on to third parties for their own purposes, for example advertising.

19. Transfers to the United States

Some of the service providers named are based in the United States or may process data there: Vercel Inc. (hosting and media storage), Neon, Inc. (database), Google LLC in connection with Google Analytics 4, Microsoft Corporation as the parent company of the Microsoft 365 service, and Cloudflare, Inc. (name resolution of the domain). Where the provider is certified under the EU-US Data Privacy Framework, the transfer is based on the adequacy decision of the European Commission of 10 July 2023 (Art. 45 GDPR). Otherwise we have concluded the Standard Contractual Clauses of the European Commission under Art. 46(2)(c) GDPR with the provider. You can obtain a copy on request from info@jobe-lighting.com.

20. Retention Periods

• Customer inquiries (contact form, Otto): five years after the last interaction with you, because tenders and construction projects in our business are often taken up again only years later
• Email copy of the inquiry in the mailbox: deleted once the inquiry is in Otto, at the latest five years after the last interaction, like the inquiry itself
• Visit history attached to an inquiry (only with your consent): twelve months after the inquiry is received
• Encrypted temporary copy of the inquiry on our server: 30 days
• Events of our own audience measurement: 90 days
• Check values for protection against misuse: until the end of the one hour time window, deleted at the latest after one day
• Choice in the privacy notice (browser): until you delete or change it
• Google Analytics cookies: according to Google up to two years; deleted immediately on withdrawal
• Event data in Google Analytics: up to 14 months (setting in our account)
• Runtime logs at Vercel: up to 24 hours (Pro plan)
• Name resolution logs at Cloudflare: according to Cloudflare kept only briefly; we have no access to them
• Appointment bookings (mailbox and calendar of our Microsoft 365 account): up to twelve months after the appointment, then deleted unless an inquiry resulted from it (then as for customer inquiries)

When a period has ended we delete the data unless a legal obligation requires us to keep it longer.

21. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access: Art. 15 GDPR
• Right to rectification: Art. 16 GDPR
• Right to erasure: Art. 17 GDPR
• Right to restriction of processing: Art. 18 GDPR
• Right to data portability: Art. 20 GDPR
• Right to object: Art. 21 GDPR
• Right to withdraw consent: Art. 7(3) GDPR (withdrawal does not affect the lawfulness of prior processing)

Right to object (Art. 21 GDPR)

Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds. We do not use your data for direct marketing.

Withdrawing your consent

You can withdraw a consent at any time with effect for the future: for analytics via “Manage consent” at the end of every page, for the visit history by writing to info@jobe-lighting.com. Withdrawing is as easy as giving consent.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (Hessian Commissioner for Data Protection and Freedom of Information), Postfach 3163, 65021 Wiesbaden, Germany.

To exercise your rights, contact info@jobe-lighting.com.

22. Obligation to Provide Data and Automated Decisions

You can use the website without providing personal data. For the contact form, name, email address, type of inquiry and message are required; without them we cannot handle the inquiry. There is no legal or contractual obligation to provide data. There is no automated decision-making including profiling within the meaning of Art. 22 GDPR.

23. Security

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, loss, destruction or alteration, in accordance with Art. 32 GDPR. Inquiries from the contact form are stored encrypted on our server and transmitted encrypted.

24. Children

Our website is not directed at children under the age of 16. We do not knowingly collect personal data from minors. If you become aware that a child has provided us with personal data without parental consent, please contact us so we can take appropriate action.

25. What We Do Not Use

This website does not use embedded videos or maps from third parties, messenger services, a newsletter or advertising or remarketing services. The videos on this website are stored in our own media storage. The online appointment booking is a link to a Microsoft page, not a service embedded in the website (section 16).

26. Changes to This Policy

We may update this Privacy Policy if legal requirements or our data processing practices change. The current version is always available on our website. We recommend checking this page periodically for updates.