Privacy Policy
1. Controller
Kevin Luck – luckyCONCEPT
Odensehof 5
30457 Hannover
Email: hello@luckyconcept.de
2. Data Protection Officer
There is currently no legal obligation to appoint a Data Protection Officer.
3. Hosting and technical operation
This website is hosted on a Hostinger VPS with server location in Germany. During operation, technical server logs are processed (for example IP address, timestamp, requested URL, user agent, referrer) to ensure stability and security.
Legal basis: Article 6(1)(f) GDPR (legitimate interest in secure and reliable website operation).
4. Contact form
When you use the contact form, we process your name, email address, company, message, and required technical metadata (pseudonymized IP fingerprint, optional shortened user agent, and referrer origin) to handle your request, prevent abuse, and ensure system stability.
Legal basis: Article 6(1)(b) GDPR (pre-contractual communication) and Article 6(1)(f) GDPR (abuse prevention and operational security).
5. Email delivery (SMTP)
SMTP infrastructure on the Hostinger VPS is used to deliver contact requests. Only communication data required for delivery is processed.
Legal basis: Article 6(1)(b) GDPR and Article 6(1)(f) GDPR.
6. Analytics with Umami (self-hosted)
This website uses a self-hosted Umami instance on the same Hostinger VPS (server location Germany). Umami runs without cookies and without personal user profiles. Pseudonymized usage data is processed (for example visited page, referrer, device type, browser, country).
Legal basis: Article 6(1)(f) GDPR (legitimate interest in traffic measurement and content optimization). Browser Do-Not-Track settings are respected.
7. CMS and integrations
Directus is operated on the same Hostinger VPS (Germany) for content and editorial processes. Integration and observability events are additionally processed via the CostControl gateway, also operated on the same Hostinger VPS (Germany).
Legal basis: Article 6(1)(f) GDPR (legitimate interest in structured operational and quality control of digital processes).
8. Telegram service bot (editorial workflow)
A Telegram bot is used for internal blog article workflows. Data is processed only when users actively interact with the bot via Telegram (for example chat ID, command content, draft data). This workflow is not required for purely informational use of the website.
Legal basis: Article 6(1)(f) GDPR (legitimate interest in efficient editorial process control), or Article 6(1)(b) GDPR for request-related communication.
9. Recipients / categories of recipients
Data is disclosed only where necessary for operation and communication, especially to hosting/infrastructure, mail delivery, CMS, and integration components. Systems are operated on the same Hostinger VPS in Germany; access is restricted to the controller.
10. Retention periods
- Contact inquiries: 12 months
- Mail queue/retry data: 30 days
- Server logs: 14 days
- Umami analytics: 12 months
- Backups: 30 days (rolling)
Retention periods for contact inquiries and mail queue data are enforced by scheduled technical retention jobs.
11. Third-country transfers
No transfer of personal data to third countries is intended when using the self-hosted systems described above. When external communication services are used (for example Telegram), processing outside the EU cannot be excluded.
12. Your rights
You have the right of access (Article 15 GDPR), rectification (Article 16 GDPR), erasure (Article 17 GDPR), restriction of processing (Article 18 GDPR), data portability (Article 20 GDPR), and the right to object to processing based on Article 6(1)(f) GDPR (Article 21 GDPR).
Requests can be sent to: hello@luckyconcept.de
You also have the right to lodge a complaint with a supervisory authority.
13. Automated decision-making
Automated decision-making, including profiling pursuant to Article 22 GDPR, does not take place.
Last updated: May 2026