Privacy Policy for the Website and Web Application myelectricplan.com
§ 1 Controller and Contact
The controller responsible for data processing on this website and within the web application ‘myelectricplan.com’ is: Lumiotechsolutions UG (haftungsbeschränkt), Hangstraße 20, 74743 Seckach, Germany, e-mail: contact@lumiotechsolutions.com. For any questions regarding data protection, please contact us via this e-mail address.
§ 2 Rights of Data Subjects
You have the following rights regarding your personal data: right of access (Art. 15 GDPR), right to rectification (Art. 16 GDPR), right to erasure (Art. 17 GDPR), right to restriction of processing (Art. 18 GDPR), right to data portability (Art. 20 GDPR), right to object (Art. 21 GDPR) and the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). To exercise your rights, you can contact us at any time at contact@lumiotechsolutions.com.
§ 3 Visit of the Website (Server Log Files, Hosting)
When you visit our website, the following data are automatically processed by our hosting provider Netcup GmbH: IP address, date and time of access, browser type and version, operating system, referrer URL, accessed page/file, HTTP status code, amount of data transferred. This data is processed to ensure stability and security, to fix technical issues and to protect against cyberattacks. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in IT security and technical optimisation). Server log files are stored for a maximum of 7 days and then automatically deleted. The servers are located exclusively in Germany, and a data processing agreement pursuant to Art. 28 GDPR has been concluded with Netcup GmbH.
§ 4 Registration and Use of the Web App
To use our web application, registration is required. The following data are processed: first name, last name, e-mail address, password (stored in encrypted form), IP address at registration, and timestamps of registration and last login. In addition, the application stores uploaded PDF floor plans, planning data, project-specific information as well as configuration and user settings. The data is processed for creating and managing the user account, providing the contractually agreed services, authenticating logins, personalising the application and communicating with users about technical issues or changes. The legal basis is Art. 6(1)(b) GDPR (performance of a contract). Registration data are stored as long as the user account is active; after a request to delete the account, the account is deactivated and can be restored for 30 days; all data, including uploaded files, is then permanently deleted, and copies in backups at the latest 30 days later. Project data and PDF uploads are stored until actively deleted by the user or until the account is deleted. Passwords are stored using modern hashing algorithms (e.g. bcrypt), and all data transfers are encrypted via HTTPS/TLS.
§ 5 Payment Processing via Stripe
Payments are processed by Stripe Payments Europe Ltd., Beech House, Greenside, Dublin D04 AE57, Ireland. The following data are transmitted to Stripe: full name, billing address, e-mail address, payment information (e.g. credit card or bank details, depending on the payment method), order details (subscription type, billing period), transaction ID and amount. The data is processed for payment processing, invoice generation and fraud prevention. The legal basis is Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(c) GDPR (legal retention obligations). Stripe may transfer data to the USA and other countries and is certified under the EU–US Data Privacy Framework. Payment and invoicing data are stored for 10 years in accordance with tax and commercial law and then deleted. Further information: https://stripe.com/de/privacy
§ 6 Support and Contact via E-mail
If you contact us by e-mail, we process your name (if provided), your e-mail address, the content of your message, the time of contact and the communication history. The data is used to process your request, provide support, document enquiries and improve our services. The legal basis is Art. 6(1)(b) GDPR (fulfilment of contractual obligations and customer support) or Art. 6(1)(f) GDPR (legitimate interest in efficient communication). Support enquiries are stored until they have been fully processed, but for no longer than 90 days after receipt, and are then deleted unless legal retention obligations require a longer storage period. For sending our e-mails we use Resend (Plus Five Five, Inc., San Francisco, California, USA) as a processor. Your e-mail address as well as the subject and content of the message are transmitted. The legal basis is Art. 6(1)(b) GDPR; the transfer to the USA is based on the standard contractual clauses.
§ 6a Newsletter and e-mail series with Brevo
For our newsletter and automated e-mail series, such as getting-started tips after registration, we use Brevo, provided by Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany. Once you have confirmed your e-mail address, we transmit the following data to Brevo for this purpose: e-mail address, first and last name, language, the status of your subscription, your setting for receiving marketing e-mails and the date of registration. If this data changes in your account, we update it at Brevo. Brevo processes the data on our behalf; we have concluded a data processing agreement with Brevo pursuant to Art. 28 GDPR. You can unsubscribe from marketing e-mails at any time in your account settings or via the unsubscribe link in every e-mail; you will then be removed from all mailing lists. If you delete your account, we also delete your contact at Brevo.
§ 7 Conversion tracking with Google Ads and the Meta pixel
To measure the success of our advertising we use Google Ads conversion tracking provided by Google Ireland Ltd., Gordon House, 4 Barrow Street, Dublin D04 E5W5, Ireland. The Google tag loads on every page view and is initially set to denied via Google Consent Mode. Cookies are only set and conversion tracking only takes place if you have given your consent via our cookie banner (Art. 6(1)(a) GDPR). It measures whether certain actions (e.g. registration or purchase) take place after a click on one of our ads; for this purpose Google sets cookies (including _gcl_ cookies) and processes your IP address, browser information and interaction data. Without consent, the Google tag only sends cookieless signals via Google Consent Mode, such as the time, the page visited and browser information. In the process, Google technically receives your IP address. According to Google, these signals are only used in aggregated form to estimate conversions. The legal basis is our legitimate interest in measuring the success of our advertising (Art. 6(1)(f) GDPR). Google may transfer data to the USA and other countries and is certified under the EU-US Data Privacy Framework. More information: https://policies.google.com/privacy. You can withdraw your consent at any time via the cookie banner. When you register or make a purchase, we additionally send Google a hashed version of your email address (so-called enhanced conversions) so that the conversion can be attributed to your ad click; this, too, only happens with your consent. In addition we use the Meta pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, to measure the success of our advertising on Facebook and Instagram. Unlike the Google tag, the Meta pixel is only loaded once you have given your consent via our cookie banner (Art. 6(1)(a) GDPR); without consent no data is transmitted to Meta. With consent, Meta sets the cookies _fbp and _fbc (valid for approx. 90 days) and processes your IP address, browser information, the pages you visit and events such as registration or purchase. For the collection and transmission of this data we and Meta are joint controllers within the meaning of Art. 26 GDPR; the agreement is available at https://www.facebook.com/legal/controller_addendum. Any subsequent processing is carried out under Meta's sole responsibility. Meta may transfer data to the USA and is certified under the EU-US Data Privacy Framework. Further information: https://www.facebook.com/privacy/policy/; your ad settings: https://www.facebook.com/settings?tab=ads. You can withdraw your consent at any time via the cookie banner.
§ 8 Contact Form
When you submit the contact form, we process your name (if provided), e-mail address, subject (optional), message content, IP address and the time of submission. The data is used to process your request, to communicate with you directly and to prevent misuse. The legal basis is Art. 6(1)(b) GDPR (provision of a service requested by the user) or Art. 6(1)(f) GDPR (legitimate interest in efficient communication and spam prevention). Data are stored until your request has been processed and answered, but for no longer than 90 days after submission, and then deleted unless another legal basis applies.
§ 8a Cancellation form
If you cancel a subscription using our cancellation form (cancellation button), we process the following information: the type of cancellation (ordinary or extraordinary), the reason you give for an extraordinary cancellation, your name, your e-mail address, your customer or invoice number (optional), the contract to be cancelled, the requested end date (next possible date or a specific date), an optional message, the website language and the date and time of receipt. Internally, we also record the processing status. We process this data to execute and document your cancellation. The legal basis is Art. 6(1)(c) GDPR in conjunction with Section 312k of the German Civil Code (BGB) (legal obligation to accept cancellations electronically and to confirm their receipt) and Art. 6(1)(b) GDPR (performance and termination of the contract). After you submit the form, you receive a confirmation with the content of your cancellation and the date and time of receipt at the e-mail address you provided; at the same time, we receive a notification with the same information. We send both e-mails via our processor Resend (see § 6). We then execute the cancellation manually in our payment system Stripe (see § 5). We store the data from the cancellation form for 3 years from receipt of the cancellation and then delete it automatically.
§ 9 Cookies and Tracking Technologies
We use technically necessary cookies (e.g. for session management, logins, security tokens and your language selection), which do not require consent and are used in accordance with § 25 TDDDG; the legal basis is Art. 6(1)(f) GDPR (legitimate interest in IT security and functionality). Marketing cookies for Google Ads conversion tracking and the Meta pixel (including _gcl_, _fbp and _fbc cookies, valid for approx. 90 days) are only set with your express consent under Art. 6(1)(a) GDPR. On your first visit you can choose between “necessary cookies only” and marketing cookies via our cookie banner. Your choice is stored in a cookie for up to 12 months and can be changed or withdrawn at any time. You can also manage or delete cookies in your browser settings at any time, although this may limit the functionality of the website. Independently of this, we measure the reach of our website with the web analytics service Betterlytics (betterlytics.io). For this purpose, every page view loads a script from betterlytics.io that transmits, among other things, the page visited, the referrer, campaign parameters from the address bar, device type, browser, operating system, screen size and language to Betterlytics servers in the EU. Betterlytics does not set cookies and does not store any information on your device. Your IP address is transmitted for technical reasons, anonymised on receipt and not stored. Betterlytics processes the data as a processor on our behalf (Art. 28 GDPR). The legal basis is Art. 6(1)(f) GDPR (legitimate interest in analysing and improving our offering). Further information: https://betterlytics.io/privacy.
§ 10 Links to Social Networks
We link to our profiles on Instagram and Facebook (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland), X (Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland) and YouTube (Google Ireland Ltd., Gordon House, 4 Barrow Street, Dublin D04 E5W5, Ireland). These are plain links, not embedded content and not plugins. Your data is only transmitted to these providers once you click such a link and open their page. The providers' own privacy policies then apply: Instagram/Facebook: https://privacycenter.instagram.com/ and https://www.facebook.com/privacy/policy/; X: https://x.com/privacy; YouTube/Google: https://policies.google.com/privacy.
§ 11 Supervisory Authority and Right to Lodge a Complaint
The competent supervisory authority for data protection matters and complaints is: Landesbeauftragter für Datenschutz und Informationsfreiheit Baden-Württemberg, Königstraße 10a, 70173 Stuttgart, Germany, e-mail: poststelle@lfd.bwl.de, phone: +49 (0)711 615541-0, website: https://www.baden-wuerttemberg.datenschutz.de/. You have the right to lodge a complaint with this or any other competent data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR.
§ 12 Storage Periods and Deletion
We store personal data only for as long as is necessary for the respective purpose or as long as statutory retention obligations exist. User account and contract data: We store the data of your user account (name, e-mail address, password) for the duration of the contractual relationship. After a deletion request, the account is deactivated and can be restored for 30 days; it is then permanently deleted. We retain invoice and accounting data, including at Stripe, for up to ten years in accordance with § 147 AO and § 257 HGB. Project data: Insofar as you record or upload data of third parties in projects, we process it on your behalf under the data processing agreement. You decide yourself when projects are deleted. Deleted project data is removed immediately, associated files by the following day at the latest. When the account is deleted, all project data is deleted after the 30-day grace period has expired. Backups: We keep daily backups for 30 days. Deleted data is also removed from the backups at the latest 30 days after deletion. Server log files: We delete server log data (see § 3) after 7 days. Support and contact requests: We store them until they have been fully processed, at most 90 days after receipt. Cancellation form: We store data from the cancellation form for 3 years from receipt of the cancellation and then delete it automatically (see § 8a). Marketing e-mails: If you unsubscribe from marketing e-mails, we remove you from all mailing lists without delay. If you delete your account, we also delete your contact at Brevo (see § 6a). Cookies: Cookies of Google Ads conversion tracking and the Meta Pixel (including _gcl_, _fbp and _fbc cookies) are valid for a maximum of approx. 90 days and then expire automatically. Deletion takes place in accordance with Art. 17 GDPR (“right to be forgotten”) and Art. 18 GDPR (restriction of processing), unless other legal obligations prevent this.
§ 13 Data Security and Technical Measures
We implement appropriate technical and organisational measures to protect your personal data. Technical measures include encrypted data transmission via HTTPS/TLS, encrypted password storage (e.g. using bcrypt), firewalls and access restrictions to servers and databases, regular security updates and system hardening as well as regular security and malware scans where appropriate. Organisational measures include limited access rights for authorised personnel only, confidentiality agreements, regular data protection training, documentation of data processing activities and established procedures for dealing with data protection incidents (incident management).
§ 14 Exercising Your Rights as a Data Subject
To exercise your rights described in § 2, you can contact us at any time at contact@lumiotechsolutions.com. Please provide your full name, your e-mail address (or the address associated with your account), the right you wish to exercise and, where applicable, additional information to help us identify you and process your request. We usually respond within 30 days; for particularly complex requests, this period may be extended by up to two further months, in which case we will inform you in time. You can object to the use of your data for marketing purposes (e.g. newsletters) at any time, for example by sending an e-mail to contact@lumiotechsolutions.com or by using an unsubscribe link in such e-mails, where available.
§ 15 Changes to this Privacy Policy
We reserve the right to amend this privacy policy if our data processing activities change, if new legal requirements make this necessary or if technical developments require adjustments. We will indicate significant changes on our website and – where appropriate – inform you by e-mail. This version of the privacy policy has been valid since 10 October 2026 and replaces all previous versions.
Last updated: 14 October 2026