Legal
Privacy policy
Last updated: March 2026
1. Controller
The controller responsible for processing personal data on this website within the meaning of Article 4(7) GDPR is:
Ruzmir Mehmedinovic
Petzetstraße 28
81245 Munich
Germany
Email: privacy@neusteg.com
No Data Protection Officer has been appointed.
2. General principles and encryption
We process personal data only where necessary to provide this website, respond to inquiries, protect our systems, or comply with legal obligations. Data is transmitted using TLS encryption (HTTPS).
3. Website delivery and server logs
When you visit this website, our hosting provider processes technical access data. This may include your IP address, date and time of access, requested page or file, HTTP method, referrer URL, browser and operating-system information, HTTP status code, and transferred data volume.
This processing is necessary to provide, maintain, and secure the website and to prevent misuse and attacks. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is secure and reliable website operation.
STRATO retains access logs for no more than the preceding six weeks. Error logs are displayed by STRATO for five days. Longer retention occurs only where necessary to investigate a specific security incident or establish, exercise, or defend legal claims.
4. Hosting, database, and email
We use STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, as a processor under Article 28 GDPR for hosting, database operation, and email delivery. A data processing agreement is in place. Under the current configuration, processing takes place in Germany or the European Union. The current website configuration does not intend to transfer personal data to a third country.
5. Cookies and similar technologies
This website does not use analytics, marketing, or tracking cookies, or comparable technologies for those purposes. It does not load external fonts, advertising services, or embedded third-party content.
| Name | Purpose | Duration |
|---|---|---|
neusteg_session | Technically necessary session management, including CSRF protection, temporary form messages, and administration login. | Browser session |
This technically necessary cookie is used without consent under section 25(2) no. 2 TDDDG. Associated personal-data processing is based on Article 6(1)(f) GDPR for security and functionality and, where necessary to handle a requested contact inquiry, Article 6(1)(b) GDPR.
6. Contact form and inquiries
When you contact us through the contact form or otherwise, we process the details you provide, in particular your name, email address, message, language, and, if supplied voluntarily, company and subject. Name, email address, and message are required. Without them, we cannot process the inquiry through the form.
Processing serves to handle your inquiry and communicate with you. The legal basis is Article 6(1)(b) GDPR where your inquiry concerns a contract or pre-contractual measures. For other inquiries, processing is based on Article 6(1)(f) GDPR; our legitimate interest is responding appropriately to incoming inquiries.
Your message is stored in our database and sent as a notification through STRATO's email service to the responsible recipient. Only authorized persons have access. Contact inquiries are normally deleted after 180 days. Longer retention may be necessary where an inquiry results in a contractual relationship, statutory retention duties apply, or data is required to establish, exercise, or defend legal claims.
7. Misuse prevention and unauthorized-access protection
To protect the contact form and administration area against spam, brute-force attacks, and other misuse, we temporarily process an HMAC-pseudonymized identifier derived from the IP address and, for administration login, potentially also from the email address, together with the number and time of attempts and any blocking period. The legal basis is Article 6(1)(f) GDPR. This data is deleted once no longer necessary for the security and blocking logic.
8. Application logs
In the event of technical errors, application logs may contain a timestamp, randomly generated request ID, technical error information, and error-source details. Logging serves troubleshooting and operational security. The legal basis is Article 6(1)(f) GDPR. Regular application logs are deleted after 30 days unless a specific security incident or legal claim requires longer retention.
9. Recipients
Recipients of personal data include the controller and authorized persons, STRATO GmbH as processor, and, where necessary in an individual case, professional advisers bound by confidentiality, public authorities, courts, or other parties for legal obligations or the establishment, exercise, or defence of legal claims.
10. Your rights
Subject to the statutory requirements, you have rights of access (Article 15 GDPR), rectification (Article 16 GDPR), erasure (Article 17 GDPR), restriction (Article 18 GDPR), data portability (Article 20 GDPR), and objection (Article 21 GDPR). Where processing is based on consent, you may withdraw it at any time with future effect (Article 7(3) GDPR).
To exercise your rights, contact us at privacy@neusteg.com.
11. Right to lodge a complaint
You may lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement. Our competent authority is:
Bavarian Data Protection Authority for the Private Sector (BayLDA)
Promenade 18
91522 Ansbach
Germany
Postal address: Postfach 1349, 91504 Ansbach
www.lda.bayern.de
12. No automated decision-making
We do not use automated decision-making, including profiling, within the meaning of Article 22 GDPR.
13. Changes to this privacy policy
We update this privacy policy when processing operations on this website or legal requirements change.