sustaing Get in touch
legal

Privacy Policy

Last updated: 2 October 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

sustaing UG (haftungsbeschränkt)
Jülicher Straße 72a
52070 Aachen
Germany
Email: [email protected]

2. Overview

This website uses no cookies for analytics, tracking or marketing purposes, no analytics or tracking services and no embedded third-party content (such as videos, maps or social media plugins). Fonts are served locally from our own server; no connection is made to external font services such as Google Fonts.

Technically necessary cookies may be set by the security service Cloudflare (for example for bot detection); under § 25(2) TDDDG (German Telecommunications Digital Services Data Protection Act) these require no consent.

3. Hosting

Our website is hosted by:

IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany

When you access our website, IONOS automatically collects information in server log files that your browser transmits. These are:

  • IP address of the requesting device
  • date and time of access
  • page or file requested
  • volume of data transferred and access status
  • referrer URL (previously visited page)
  • browser type and version, operating system

This data is not combined with other data sources. It is processed to ensure trouble-free operation, system security and optimisation of the website.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and error-free provision of the website).

Storage period: Log files are deleted as soon as they are no longer required for the purposes set out above, unless retention is necessary to investigate a security incident.

A data processing agreement pursuant to Art. 28 GDPR is in place with IONOS.

4. Content Delivery Network and Security (Cloudflare)

We use the following provider to secure and accelerate our website:

Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA

Cloudflare operates the Domain Name System for our domain, provides the encryption of the connection, and protects the website against attacks and abusive access. In doing so, Cloudflare processes technically necessary connection data, in particular your IP address, the address requested, the time of access and browser and device information.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, fast and available website).

Storage period: The storage period is determined by Cloudflare; the data is deleted once it is no longer required for the security purposes stated. Details can be found in Cloudflare's privacy policy.

Transfer to a third country: Cloudflare may also process data outside the EU and the European Economic Area. Insofar as data is transferred to the United States, Cloudflare, Inc. is certified under the EU-US Data Privacy Framework; to that extent an adequacy decision of the European Commission pursuant to Art. 45 GDPR applies. For transfers to other third countries, and in the event that the certification ceases to apply, the transfer is based on the Standard Contractual Clauses of the European Commission (Implementing Decision (EU) 2021/914 of 4 June 2021) pursuant to Art. 46(2)(c) GDPR, which form part of the data processing agreement concluded with Cloudflare.

You can view a copy of these clauses at cloudflare.com/cloudflare-customer-dpa or request one from us at [email protected].

Further information: cloudflare.com/privacypolicy

5. Contact Form and Email

If you send us an enquiry using the contact form on our website, we process the data you enter:

  • Name
  • Email address
  • Company (optional)
  • Your message

together with the time of submission. This data is used exclusively to handle your enquiry and any follow-up questions. It is not passed on to third parties, with the exception of the service providers named below.

The same applies if you contact us directly by email: your details, including the contact data you provide, are stored and processed for the purpose of handling your enquiry and any follow-up questions.

Legal basis: Your consent, which you give by ticking the checkbox before sending (Art. 6(1)(a) GDPR). You may withdraw this consent at any time with effect for the future, for example by email to [email protected]; the lawfulness of processing carried out up to the point of withdrawal remains unaffected. Where your enquiry relates to the initiation or performance of a contract, processing is additionally based on Art. 6(1)(b) GDPR.

Provision of the data: Providing this data is neither required by law nor by contract. Without it, however, we cannot process your enquiry or reply to you.

Storage period: Your data remains with us until you ask us to delete it, the purpose for storing it no longer applies, or your enquiry has been conclusively dealt with. Mandatory statutory retention periods, for example for business correspondence, remain unaffected.

5.1 Form Transmission (Web3Forms)

For the technical transmission of the contact form we use the service Web3Forms, operated by Web3Creative, Kerala, India.

Web3Forms receives the form data and forwards it by email to our mailbox. Processing takes place on the infrastructure of the provider's sub-processors, partly within the EU and partly in third countries, in particular the United States. For spam detection, the sender's IP address and email address are transmitted to service providers in the United States.

Storage period: According to the provider, form submissions are automatically deleted after three years at the latest.

Transfer to a third country: When you use the contact form, your data is transferred to third countries (India, United States). The transfer is based on the Standard Contractual Clauses of the European Commission (Art. 46(2)(c) GDPR), which form part of the data processing agreement concluded with the provider. You can request a copy from us at [email protected].

If you would prefer your data not to be transmitted to this provider, you can contact us by email at [email protected] at any time instead.

Further information: web3forms.com/privacy

5.2 Email Mailbox

Messages received through the contact form or directly by email are processed in our email mailbox, which is hosted by:

united-domains GmbH, Gautinger Straße 10, 82319 Starnberg, Germany

A data processing agreement pursuant to Art. 28 GDPR is in place with united-domains. Processing takes place exclusively in the European Union.

6. Your Rights

You have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)
  • Right to withdraw consent with effect for the future (Art. 7(3) GDPR)

An informal message to [email protected] is sufficient to exercise your rights.

Right to Object

Where we process data on the basis of Art. 6(1)(f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to that processing. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
(State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia)
Kavalleriestraße 2–4
40213 Düsseldorf
www.ldi.nrw.de