Privacy notice
1. Name and contact details of the controller
Crowlight Partners GmbH & Co. KG
Berliner Ring 31, 53175 Bonn, Germany
Phone: +49 228 707 8670
Email: contact@crowlightpartners.com
We have not appointed a data protection officer, as the legal requirements under Art. 37 GDPR are not met. For data protection matters, please contact datenschutz@crowlightpartners.com.
2. Purposes and legal bases of processing
a) Provision of the website, Art. 6(1)(f) GDPR (legitimate interest in a functioning website)
b) Contact by email or form, Art. 6(1)(b) GDPR (contract or pre-contractual measures)
c) We do not analyze user behavior and do not use any analytics or tracking tools. For the anonymous usage count in the PCB Resilience Check, see section 3a.
d) Compliance with statutory retention obligations, Art. 6(1)(c) GDPR (legal obligation)
e) Booking appointments via Microsoft Bookings, Art. 6(1)(b) GDPR (pre-contractual measures)
3. Categories of data collected
When you visit this website, the following data is collected automatically (server log files):
- IP address (truncated)
- browser type and version
- operating system
- referrer URL
- pages visited
When you contact us, we process:
- name
- email address
- content of your message
When you book an appointment via Microsoft Bookings, we process the information you enter in the booking form: name, email address, selected time slot and, if you provide them, phone number and the subject of your request. The booking page is operated by Microsoft; we use Microsoft Teams for the conversation itself.
3a. Online tools and fonts
The PCB Resilience Check on this website runs entirely in your browser. Your answers are neither stored nor transmitted to us or to third parties; the PDF of your result is also created in your browser. The information on Microsoft Bookings applies only if you book an appointment via the button in the check.
To see how the check is used, we count, without cookies, how often it is opened, started and completed, and how often the PDF is saved or the booking button is clicked. We store only the event, the selected language and the date, combined into a daily total. For this purpose we do not store IP addresses, answers or any other information that could identify you. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in designing our services to meet demand).
The fonts used on this website are loaded from our own server. No connection is made to servers of Google or other providers.
4. Recipients of personal data
We transfer personal data only in the following cases:
- to hosting providers (e.g. for server provision)
- to IT service providers in the course of maintenance
- to Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, as processor for Microsoft 365 (in particular Bookings, Teams and email)
- to tax advisors or authorities where required by law.
We do not pass on data to third parties for advertising purposes.
5. Transfers to third countries
Personal data is transferred to third countries (outside the EU/EEA) only if:
- you have given your explicit consent (Art. 49(1)(a) GDPR), or
- the European Commission has adopted an adequacy decision (Art. 45 GDPR), for example for companies certified under the EU-U.S. Data Privacy Framework, or
- appropriate safeguards under Art. 46 GDPR are in place (e.g. EU standard contractual clauses).
Microsoft may also process data in the United States as part of Microsoft 365. Microsoft is certified under the EU-U.S. Data Privacy Framework and has also agreed EU standard contractual clauses with us.
6. Retention period
- server log files: no longer than 14 days
- contact requests and appointment bookings: 6 months after the communication has ended
- contract data: 6 or 10 years in accordance with the German Commercial Code (HGB) and Fiscal Code (AO)
- consents: until withdrawn or until the purpose no longer applies
7. Your rights as a data subject
Under Art. 15 et seq. GDPR, you have the right to:
- access the data stored about you
- rectification of inaccurate data
- erasure (unless retention obligations apply)
- restriction of processing
- object to processing (Art. 21 GDPR)
- data portability (Art. 20 GDPR)
- lodge a complaint with a supervisory authority (see below)
8. Withdrawal of consent
You may withdraw any consent you have given at any time with effect for the future. Processing carried out before the withdrawal remains lawful.
9. Obligation to provide data
There is no legal obligation to provide your data. However, some functions (e.g. contacting us) are not possible without certain information.
10. Automated decision-making
We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.
11. Use of cookies
Our website sets only cookies that are strictly necessary for its operation. This includes a cookie that stores your selected language (German or English) (“pll_language”, retained for one year). We do not set analytics or advertising cookies.
12. Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia)
Postfach 200444, 40102 Düsseldorf, Germany
Phone +49 211 38424-0, email poststelle@ldi.nrw.de
13. Changes to this privacy notice
We reserve the right to amend this privacy notice at any time. The version currently published on this website applies.