Privacy

1. Controller

The controller responsible for the processing of personal data on this website is:

onEco GmbH
Friedrichstrasse 171
10117 Berlin
Germany
Email: [email protected]

onEco GmbH operates under the brand name Prelumen.

Data protection officer: we have not appointed a data protection officer, as the statutory requirements of Section 38 BDSG are not currently met. For any data protection matter, please contact us using the details above.

2. General information

We process personal data only to the extent necessary to operate this website and our services, or where you have given your consent. This policy explains what data that is, why we process it, on what legal basis, and how long we keep it.

Where we refer to legal bases, we mean:

• Art. 6 (1) (a) GDPR — you have given consent.
• Art. 6 (1) (b) GDPR — processing is necessary to perform a contract with you or to take pre-contractual steps.
• Art. 6 (1) (c) GDPR — we are legally obliged to process the data.
• Art. 6 (1) (f) GDPR — processing is necessary for our legitimate interests and your interests do not override them.

3. Visiting this website (server log files)

When you access prelumen.com, your browser transmits technically necessary data to our server, which is stored in log files:

• IP address of the requesting device
• date and time of access
• name and URL of the file retrieved
• volume of data transferred and confirmation of successful retrieval
• referrer URL, where transmitted
• browser used, its version and the operating system

Purpose: delivering the website, ensuring stability and security, defending against and investigating attacks.
Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest lies in the secure and uninterrupted operation of the website.
Retention period: We do not operate a persistent log archive. Log data is held only in the volatile buffer of our hosting provider, from which older entries are continuously displaced.
Recipients: our hosting provider (see section 9).

This data is not merged with other data sources and is not analysed for marketing purposes.

4. Cookies and storage on your device

We use strictly necessary cookies only. A consent banner is therefore not required.

• Session cookie (ci_session) — associates your requests within a single visit. Retention: until the end of the session.
• CSRF token cookie — protects forms against cross-site request forgery. Retention: until the end of the session.

Legal basis for storing and accessing information on your device: Section 25 (2) no. 2 TDDDG — access is strictly necessary to provide the service you have requested. Legal basis for the subsequent processing: Art. 6 (1) (f) GDPR.

We do not use cookies for advertising, tracking or profiling purposes, and we do not integrate advertising networks.

5. Web analytics

There is currently no web analytics and no website tracking on prelumen.com. We do not embed Google Analytics or any comparable product, not even our own.

Should we deploy Prelumen Analytics on this website in future, we will inform you here in advance and add the purpose, legal basis and retention period.

6. External fonts (Adobe Fonts)

To display fonts consistently, we embed typefaces from Adobe Fonts (Typekit). The provider for users in the European Economic Area is Adobe Systems Software Ireland Limited, 4-6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland; the parent company is Adobe Inc., USA.

When you open a page, your browser loads the fonts directly from an Adobe server (use.typekit.net). Your IP address is transmitted to Adobe in the process; for technical reasons, Adobe also receives information about the page requested, your browser and your operating system.

Purpose: consistent and accessible presentation of our content.
Legal basis: Art. 6 (1) (f) GDPR — legitimate interest in a consistent, performant website.
Transfer to third countries: processing in the USA cannot be ruled out. Adobe Inc. is certified under the EU-US Data Privacy Framework; in addition, Adobe relies on standard contractual clauses pursuant to Art. 46 (2) (c) GDPR and has published a transfer impact assessment.
Further information: Adobe privacy policy, Adobe information on data transfers from the EU

We are not able to serve these fonts from our own servers: the Adobe Fonts terms of use expressly prohibit hosting the font files locally and require them to be embedded via the Adobe content delivery network. A milder, equally effective means is therefore not available to us for the use of these typefaces.

7. Contacting us through our contact form

You can reach us through our contact form and through the product-specific forms. We process:

• name (required)
• email address (required)
• your message (required on the general contact form)
• organisation and phone number (optional on the general contact form, required on the product-specific forms)
• the language version you used and the subject of your enquiry

Your IP address is neither evaluated nor forwarded to our team when you submit the form.

Purpose: handling your enquiry and initiating a contractual relationship.
Legal basis: Art. 6 (1) (b) GDPR.
Recipients: the information is delivered as a notification to our internal communication service Slack (Slack Technologies Limited, Ireland; parent company Salesforce, Inc., USA) so that our team can respond promptly. Further correspondence takes place by email via Google Workspace.
Retention period: we delete your enquiry once it has been dealt with conclusively and no statutory retention obligations apply, at the latest 24 months after the last contact. Commercial and tax retention obligations remain unaffected.

8. Use of the Prelumen platform

Registration and use of our services do not take place on prelumen.com but at hub.prelumen.com, analytics.prelumen.com, reports.prelumen.com and profiles.prelumen.com.

Account data: to set up an account we process name, business email address, company details and credentials. Legal basis: Art. 6 (1) (b) GDPR.
Billing data: for paid services we process invoicing and payment data. Legal bases: Art. 6 (1) (b) and (c) GDPR in conjunction with commercial and tax retention obligations. Payments are processed via Stripe; we do not receive complete payment instrument data.
Platform usage data: beyond the volatile buffer of our hosting provider we do not keep our own logs of platform usage.

Roles: where our customers use Prelumen Analytics, Reports or Profiles to process data about visitors to their own websites, we act as a processor within the meaning of Art. 28 GDPR. The controller in that case is the respective customer, on the basis of the data processing agreement concluded with them. Affected website visitors should address their requests to the operator of the website in question. This privacy policy does not apply to them.

9. Recipients and processors

We use carefully selected service providers with whom we have concluded data processing agreements pursuant to Art. 28 GDPR where required.

• Heroku (Salesforce, Inc.) — hosting and operation of the website. Processing takes place in the EU region (Ireland). Access by the US parent company cannot be entirely ruled out. Basis: standard contractual clauses.
• Cloudflare, Inc. — content delivery, DNS and attack protection. Delivered via EU data centres, group access from the USA possible. Basis: standard contractual clauses.
• Adobe (Typekit) — delivery of fonts. Ireland and USA. Basis: EU-US Data Privacy Framework, standard contractual clauses.
• Slack Technologies Limited — internal notification of contact enquiries. Ireland and USA. Basis: standard contractual clauses.
• Google Ireland Limited — email and office communication via Google Workspace. Ireland and USA. Basis: EU-US Data Privacy Framework.
• JAWS DB, LLC — operation of the database as a Heroku add-on on Amazon Web Services infrastructure. Registered office of the provider: USA. Basis: standard contractual clauses.
• Stripe Payments Europe, Limited, Ireland — payment processing. Stripe processes payment data partly as a controller in its own right, in particular for fraud prevention and to meet its own regulatory obligations.
• Brevo GmbH, Koepenicker Strasse 126, 10179 Berlin, Germany — delivery of transactional emails. According to the provider, transfers to third countries, in particular the USA and India, cannot be ruled out. Basis: standard contractual clauses.

We disclose data to other third parties only where you have consented, where we are legally obliged to do so, or where disclosure is necessary to enforce our rights.

10. Transfers to third countries

Some of the service providers listed above process data outside the European Economic Area, in particular in the USA. We base such transfers on an adequacy decision of the European Commission pursuant to Art. 45 GDPR, in particular the EU-US Data Privacy Framework where the recipient is certified, or on standard contractual clauses pursuant to Art. 46 (2) (c) GDPR together with supplementary safeguards.

Please note that a level of data protection equivalent to European standards cannot be guaranteed in third countries and that access by state authorities cannot be ruled out in every case. You may request a copy of the relevant safeguards at [email protected].

11. Retention

We store personal data only for as long as necessary for the respective purpose. After that we delete it, unless statutory retention obligations apply, in particular under Section 257 of the German Commercial Code and Section 147 of the German Fiscal Code. Depending on the type of record, these periods are six years for commercial and business correspondence, eight years for accounting vouchers and invoices and ten years for commercial books, inventories and annual financial statements. For that period the data is restricted and no longer processed for other purposes.

12. Your rights

You have the following rights in relation to us:

• access to the data stored about you (Art. 15 GDPR)
• rectification of inaccurate data and completion of incomplete data (Art. 16 GDPR)
• erasure of your data, unless retention obligations apply (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability in a structured, commonly used and machine-readable format (Art. 20 GDPR)
• withdrawal of consent with effect for the future (Art. 7 (3) GDPR)

Right to object under Art. 21 GDPR

Where we process your data on the basis of legitimate interests pursuant to Art. 6 (1) (f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to such processing. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

Where your data is processed for direct marketing purposes, you may object at any time without giving reasons; we will then no longer process the data for that purpose.

An informal message to [email protected] is sufficient to exercise your rights.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data (Art. 77 GDPR). The authority responsible for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61
10555 Berlin, Germany
datenschutz-berlin.de

13. No obligation to provide data, no automated decision-making

You are not obliged to provide us with personal data. However, without the data marked as mandatory we cannot process an enquiry or conclude a contract.

Automated decision-making including profiling pursuant to Art. 22 GDPR does not take place.

14. Changes to this privacy policy

We update this policy when our processing activities or the legal framework change. The version published on this page applies.

Version: 20 August 2026