Data Privacy
Table of contents
1 Controller
2 Provision of the website
3 Cookies and local storage
4 Contact options
5 Use of third-party services
6 Social networks
7 Your rights
8 Audience measurement
9 Timeliness and changes to this privacy policy
1 Controller
The controller within the meaning of the GDPR is:
gubo.io UG (haftungsbeschränkt)
Händelstraße 28
93128 Regenstauf, Germany
represented by Tobias Gubo
email: hello@gubo.io
https://www.gubo.io/en/imprint
2 Provision of the website
2.1 General information
When you use our website for information purposes only, i.e. if you do not otherwise provide us with information, we only process the data that your browser technically has to transmit to our server in order to retrieve the page. This includes
- IP address
- date and time of the request
- requested address
- referring website (referrer)
- browser type, browser version and operating system (user agent)
We do not keep access logs (server log files) in which this data is stored. Your IP address is only processed briefly in memory: to limit the number of requests per IP address and thereby prevent abuse, and to determine the country of access for audience measurement (see section 8). For troubleshooting, our application logs the requested interface paths, status codes and times, but without IP addresses. Only if a technical error occurs while delivering a page may the web server log this error together with the IP address.
2.2 Hosting
Our website is hosted by an external service provider (hereinafter referred to as the ‘host’). Personal data collected via this website is processed and stored on the host’s servers. This may include IP addresses, contact requests, metadata, communication data, contact details and names.
The host is used for the purpose of fulfilling contracts with our potential and existing customers (Art. 6 para. 1 lit. b GDPR) and in the interest of a secure, fast and efficient provision of our online offer by a professional provider (Art. 6 para. 1 lit. f GDPR).
Our host will only process your data to the extent necessary to fulfil its performance obligations and will follow our instructions with regard to this data.
We use the following host:
netcup GmbH
Emmy-Noether-Straße 10
76131 Karlsruhe, Germany
The server is located in a data centre in Nuremberg, Germany; hosting does not involve any transfer to third countries. In order to ensure data protection-compliant processing, we have concluded a data processing agreement with our host.
We deliver all content of the website, including fonts, images and videos, from this server. We do not use a content delivery network (CDN).
2.3 Purpose of processing
When using this general data and information, we do not draw any conclusions about you personally. The purposes we pursue include in particular:
- ensuring a smooth connection to the website,
- ensuring convenient use of our website,
- preventing abuse or fraud,
- evaluating system security and stability, and
- other administrative purposes.
2.4 Legal basis
The legal basis for data processing is our legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR. We have a legitimate interest in being able to offer our website in a technically flawless and secure manner.
2.5 Storage period
IP addresses used to limit requests are only held in memory and are discarded no later than 20 minutes after your last request. The logs of the application and the web server are continuously overwritten once they reach a fixed size and are only viewed for troubleshooting.
3 Cookies and local storage
3.1 General information
Cookies are text files that your browser stores on your device when you visit a website. Storing information on your device and accessing it is only permitted if you have consented (Section 25 (1) TDDDG, the German Telecommunications Digital Services Data Protection Act) or if this is strictly necessary to provide the service you have requested (Section 25 (2) no. 2 TDDDG).
3.2 Technically necessary cookies
We use technically necessary cookies for the following purposes:
- to store your decision in the cookie banner (cookie “CookieScriptConsent”, see section 5.1) so that we do not ask you again on every visit,
- to keep the login to the non-public administration area; this cookie is only set for the operator after logging in.
In addition, our audience measurement checks whether your browser’s local storage contains a note that excludes the browser from measurement. Only the operator sets this note for their own devices; nothing is stored on visitors’ devices in the process.
The legal basis is Section 25 (2) no. 2 TDDDG in conjunction with our legitimate interest under Art. 6 para. 1 lit. f GDPR in providing our website in a technically flawless manner. The cookie storing your decision is kept for the period stated in the cookie banner under “Show details”, the login cookie for a maximum of seven days.
3.3 Marketing cookies
With your consent, we also use marketing cookies that are not technically necessary. We use them to understand which audiences our website reaches and to improve our offer. At present, this only concerns the LinkedIn Insight Tag (see section 5.2).
The legal basis is your consent pursuant to Section 25 (1) TDDDG and Art. 6 para. 1 lit. a GDPR. The cookies are only set and the associated script is only loaded after you have given your consent via our cookie banner. Without consent, no connection to LinkedIn is established.
3.4 Changing or withdrawing consent
You can change or withdraw your consent at any time with effect for the future. To do so, click “Cookie settings” in the footer; the cookie banner will then open again. You can also delete or block cookies in your browser settings.
4 Contact options
4.1 General information
You can contact us by email at the address given in the imprint or via our contact form. When you contact us and when we answer your request, we process the following personal data:
- name
- email address
- company
- content of your message
- date and time of the request
- when using the contact form, additionally your IP address and browser identification (user agent)
- other personal data that you provide to us when contacting us.
Requests submitted via the contact form are stored in a database on our host’s server (see section 2.2) and also forwarded by email to our mailbox (see section 4.5).
4.2 Purpose of processing
We process your data to answer your request and any further matters resulting from it. We store the IP address and browser identification in order to detect and prevent misuse of the contact form, for example automated spam requests.
4.3 Legal basis
If your request is made in the context of pre-contractual measures or an existing contract with us, the legal basis is the performance of the contract and the implementation of pre-contractual measures pursuant to Art. 6 para. 1 lit. b GDPR.
Otherwise, the legal basis is our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in answering the requests addressed to us and, with regard to the IP address and browser identification, in preventing misuse.
4.4 Storage period
We delete your personal data as soon as it is no longer required to achieve the purpose for which it was collected. In the case of contact requests, this is generally the case when the circumstances indicate that the matter in question has been conclusively dealt with. Statutory retention obligations, for example for business correspondence under commercial and tax law, remain unaffected.
4.5 Email mailbox
Our email mailboxes are operated by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (Microsoft 365). Emails sent to us and messages forwarded from the contact form are stored there. Microsoft processes the data as a processor on the basis of the Microsoft Products and Services Data Protection Addendum. A transfer to the USA cannot be ruled out (see section 5.4). The legal basis is Art. 6 para. 1 lit. b and lit. f GDPR; our legitimate interest lies in reliable and secure email communication.
5 Use of third-party services
We use the following third-party services on our website:
5.1 Consent management
Service: CookieScript
Provider: Objectis Ltd., Laisvės g. 60, LT-05120 Vilnius, Lithuania
Purpose: Obtaining, storing and documenting your consent to cookies. The cookie banner is loaded from a server of the provider when you visit the website; in the process, your IP address is transmitted to the provider. Your decision is stored in the cookie “CookieScriptConsent” on your device. To document your consent, the provider may log your decision together with a truncated IP address, the time, the page visited and the browser identification. According to the provider, the data is stored in the EU.
Legal basis: Art. 6 para. 1 lit. c GDPR in conjunction with Art. 7 para. 1 GDPR (proof of consent) and our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR in legally compliant consent management; for the cookie, Section 25 (2) no. 2 TDDDG.
Storage period: The cookie is kept for the period stated in the cookie banner under “Show details”. Logs documenting consent are deleted as soon as they are no longer required for this purpose.
5.2 Marketing
Service: LinkedIn Insight Tag
Provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland
Purpose: Evaluating which audiences our website reaches (aggregated reports, for example on the industry, job title and company size of visiting LinkedIn members), measuring the impact of our posts and ads on LinkedIn and, where applicable, addressing visitors on LinkedIn. In doing so, LinkedIn processes in particular your IP address, information about your device and browser, the page visited, the referring website, the time and LinkedIn cookies. We do not receive any information that identifies you personally.
Legal basis: Your consent pursuant to Section 25 (1) TDDDG and Art. 6 para. 1 lit. a GDPR. The Insight Tag is only loaded after you have given your consent.
Storage period: According to LinkedIn, direct identifiers are pseudonymised within seven days and the remaining data is deleted within 180 days. Further information can be found in LinkedIn’s privacy policy and cookie policy.
5.3 Fonts
The fonts League Spartan and Montserrat are hosted locally on our server. No connections to third-party servers, such as those of Google, are established for this purpose when you visit the website.
5.4 Transfer of personal data to third countries
Insofar as we transfer personal data to a third country for processing, we ensure compliance with Art. 44 et seq. GDPR. This means that before any transfer of personal data to third parties in a country outside the European Union (“EU”) or the European Economic Area (“EEA”), we check whether an adequate level of protection is guaranteed.
Service: LinkedIn
Third country: USA
Appropriate safeguard pursuant to Art. 44 et seq. GDPR: adequacy decision of the EU Commission for the EU-US Data Privacy Framework, in which LinkedIn participates, and standard contractual clauses
Service: Microsoft 365
Third country: USA
Appropriate safeguard pursuant to Art. 44 et seq. GDPR: adequacy decision of the EU Commission for the EU-US Data Privacy Framework, in which Microsoft participates, and standard contractual clauses
6 Social networks
6.1 General information
We maintain a presence on social networks in order to communicate with you and inform you about our services. We do not embed any social network plugins on our website; the LinkedIn and Instagram icons are simple links. You are only forwarded to the respective network when you click on such a link.
If you visit one of the pages we maintain there, we may be jointly responsible with the provider of the respective platform for the processing operations relating to personal data within the meaning of Art. 26 GDPR.
The following data, among others, is processed as part of the processing operations:
- Inventory data (e.g. first and last name, address, age, gender)
- Content data (e.g. texts, photographs, videos)
- Usage data (e.g. websites visited, interests)
- Metadata (e.g. device information, IP address)
This usage data is often processed by the providers of social and professional networks for advertising purposes or to analyse user behaviour, without us being able to influence this. In addition, the providers often create user profiles on the basis of which user-related advertising can be placed inside and outside the network. Cookies are often used for this purpose, or the usage behaviour is assigned directly to your own member profile in the network (if you are logged in there). We also use user data to communicate with you via the respective network and to provide you with information. If you interact with our profile in the respective network (e.g. visit our profile, comment on something or “like” it), it is possible that your user profile and your personal data will become public as a result.
6.2 Purpose of processing
We process your personal data for the following purposes:
- public relations and marketing, i.e. we inform you about our services and offers and communicate with you
- initiating projects and assignments
6.3 Legal basis
The legal basis for the processing of personal data is our overriding legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR. The overriding legitimate interest corresponds to the purposes mentioned above.
6.4 Storage period
In principle, your data is stored with the respective network provider and not directly with us. We store your activities and personal data published on our page until the purpose of the processing no longer applies or you have withdrawn your consent, provided that there are no conflicting retention obligations.
6.5 Recipients of personal data
Social network: LinkedIn
Provider: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland
Third country: USA
Appropriate safeguards: adequacy decision for the EU-US Data Privacy Framework and standard contractual clauses
Further information: LinkedIn’s privacy policy, opt-out and advertising settings, and joint controller agreement
Social network: Instagram
Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland
Third country: USA
Appropriate safeguards: adequacy decision for the EU-US Data Privacy Framework and standard contractual clauses
Further information: Instagram’s privacy policy
7 Your rights
7.1 Right to confirmation
You have the right to request confirmation from us as to whether personal data concerning you is being processed.
7.2 Information (Art. 15 GDPR)
You have the right to obtain information from us free of charge at any time about the personal data stored about you and a copy of this data in accordance with the statutory provisions.
7.3 Rectification (Art. 16 GDPR)
You have the right to request the rectification of inaccurate personal data concerning you. Furthermore, taking into account the purposes of the processing, you have the right to request the completion of incomplete personal data.
7.4 Erasure (Art. 17 GDPR)
You have the right to request that we erase personal data concerning you without undue delay, provided that one of the legally stipulated reasons applies and insofar as the processing or storage is not required.
7.5 Restriction of processing (Art. 18 GDPR)
You have the right to request that we restrict processing if one of the legal requirements is met.
7.6 Data portability (Art. 20 GDPR)
You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from us, provided that the processing is based on consent pursuant to Art. 6 para. 1 lit. a GDPR or Art. 9 para. 2 lit. a GDPR or on a contract pursuant to Art. 6 para. 1 lit. b GDPR and the processing is carried out by automated means, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.
Furthermore, when exercising your right to data portability pursuant to Art. 20 para. 1 GDPR, you have the right to have the personal data transmitted directly from one controller to another controller, insofar as this is technically feasible and provided that this does not adversely affect the rights and freedoms of other persons.
7.7 Objection (Art. 21 GDPR)
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on data processing in the public interest pursuant to Art. 6 para. 1 lit. e GDPR or on the basis of our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR.
This also applies to profiling based on these provisions within the meaning of Art. 4 no. 4 GDPR.
If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
In individual cases, we process personal data for direct marketing purposes. You can object to the processing of personal data for the purpose of such advertising at any time. This also applies to profiling insofar as it is associated with such direct marketing. If you object to processing for direct marketing purposes, we will no longer process the personal data for these purposes.
In addition, you have the right to object, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out by us for scientific or historical research purposes or for statistical purposes pursuant to Art. 89 para. 1 GDPR, unless such processing is necessary for the performance of a task carried out in the public interest.
7.8 Withdrawal of consent under data protection law
You have the right to withdraw your consent to the processing of personal data at any time with effect for the future. You can withdraw your consent to cookies via the “Cookie settings” link in the footer.
7.9 Complaint to a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority about our processing of personal data. The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.
8 Audience measurement
We measure the use of our website with a self-hosted method without cookies. The page visited, the domain of the referring website, campaign parameters, the device type, browser and operating system in general terms, the language of the page and the country of access are stored as daily counters. We also count individual events: submitting the contact form, switching the language, clicks on external links (only the domain of the destination) and requests for pages that do not exist. Your IP address is only processed briefly in memory to determine the country using a database stored locally on our server, and is not stored. No user profiles are created, no visitors are recognised and no data is passed on to third parties. The daily counters do not contain any personal data.
The legal basis is our legitimate interest in audience measurement pursuant to Art. 6 para. 1 lit. f GDPR. For the note in your browser’s local storage that excludes the operator’s devices from measurement, see section 3.2.
9 Timeliness and changes to this privacy policy
This privacy policy is currently valid and was last updated in September 2026.
It may become necessary to change this privacy policy as a result of the further development of our website and offers or due to changes in legal or regulatory requirements. You can access the current privacy policy here at any time.