Privacy Policy
1. Controller
Kevin Luck – luckyCONCEPT
Odensehof 5
30457 Hanover, Germany
Email: hello@luckyconcept.de
2. Data Protection Officer
There is currently no legal obligation to appoint a Data Protection Officer.
3. No cookies, no third parties, no analytics
This website sets no cookies and stores nothing in your browser (no local or session storage). It embeds no third-party content: fonts, images, videos and scripts are served exclusively from our own server. There is no analytics and no tracking.
A cookie banner is therefore not required. No information is accessed on your device within the meaning of Section 25 TDDDG.
4. Hosting and technical operation
This website is hosted on a Hostinger VPS with server location in Germany. During operation, technical server logs are processed (for example IP address, timestamp, requested URL, user agent, referrer) to ensure stability and security.
Legal basis: Article 6(1)(f) GDPR (legitimate interest in secure and reliable website operation).
5. Contact form
When you use the contact form we process your name, email address, optionally your company, and your message. In addition, data strictly required for abuse prevention is processed: a simple arithmetic task as spam protection, a timestamp of when the form was opened, and a pseudonymised checksum (SHA-256) used to detect duplicate submissions.
The enquiry is delivered by email. If delivery does not succeed immediately, it is held in a queue on the same server until it does.
Legal basis: Article 6(1)(b) GDPR (initiating and handling enquiries) and Article 6(1)(f) GDPR (protection against abuse and operational stability).
6. Email delivery (SMTP)
Contact enquiries are sent using SMTP infrastructure on the Hostinger VPS. The communication data required for delivery is processed in the process.
Legal basis: Article 6(1)(b) GDPR and Article 6(1)(f) GDPR.
7. Operational metrics
When the contact form is submitted, a technical event is reported to the CostControl gateway, which runs on the same Hostinger VPS (server location Germany). Only structured operational data such as timestamp and event type is transmitted – no content of your message and no contact details.
Legal basis: Article 6(1)(f) GDPR (legitimate interest in operational monitoring and cost control).
8. Recipients / categories of recipients
Recipients are only those parties required for operation and communication, in particular hosting/infrastructure and mail delivery. All systems run on our own Hostinger VPS (Germany); access is limited to the controller.
9. Retention periods
- Contact enquiries: 12 months
- Mail queue / retry data: 30 days
- Server logs: 14 days
- Backups: 30 days (rolling)
Retention limits for contact enquiries and queue data are enforced technically by scheduled cleanup runs.
10. Third-country transfers
No personal data is transferred to third countries. All systems in use are self-hosted, with server location in Germany.
11. Your rights
You have the right of access (Article 15 GDPR), rectification (Article 16 GDPR), erasure (Article 17 GDPR), restriction of processing (Article 18 GDPR), data portability (Article 20 GDPR) and to object to processing based on Article 6(1)(f) GDPR (Article 21 GDPR).
Please direct requests to: hello@luckyconcept.de
You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the State Commissioner for Data Protection of Lower Saxony (Landesbeauftragte für den Datenschutz Niedersachsen).
12. Automated decision-making
No automated decision-making, including profiling, within the meaning of Article 22 GDPR takes place.
13. Imagery
The illustrations and moving images shown on this website are AI-generated. They do not depict real places or people. No data is transmitted to third parties when they are displayed – all files are served from our own server.
Last updated: August 2026