Privacy Policy

The controller responsible for processing personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

BLuEngineering Benjamin Lukas
König-Ludwig-Straße 13
85276 Pfaffenhofen, Germany

Phone: +49 (0) 163 4213775
Email: kontakt@blu-engineering.de

We have not appointed a data protection officer because the legal requirements for doing so (Section 38 of the German Federal Data Protection Act, BDSG) are not met. For any questions about data protection, please use the contact details above.

This website is designed to use as little data as possible:

• Advertising tracking only with your consent. The Meta Pixel (Facebook/Instagram) is only loaded once you click “Accept” in the cookie banner (Meta Pixel).
• Audience measurement without cookies. We count page views with Vercel Web Analytics, without cookies and without recognising you beyond a single day (Audience measurement).
• Forms for enquiries (and, where offered, for requesting our checklist) are provided by our CRM provider Salessuite (Forms).
• Fonts and images are delivered through our own hosting. There is no connection to Google Fonts or similar services.
• No other services: no social media plugins, no embedded videos or maps.

We only process personal data where the law allows it. The legal basis for each processing activity is stated in its section:

• Consent: Art. 6(1)(a) GDPR; where information is stored on or read from your device, also Section 25(1) of the German Telecommunications and Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, TDDDG). You can withdraw your consent at any time with effect for the future.
• Contract and pre-contractual steps: Art. 6(1)(b) GDPR, for example when you yourself are seeking a contract with us.
• Legal obligation: Art. 6(1)(c) GDPR, for example statutory retention duties under commercial and tax law.
• Legitimate interests: Art. 6(1)(f) GDPR, for example in operating this website securely. You have a right to object here (Your rights).
• Strictly necessary storage on or access to your device: Section 25(2) no. 2 TDDDG, for example to store your choice in the cookie banner.

This website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA (“Vercel”). The website’s server-side functions generally run in a data centre in Frankfurt am Main, Germany. Vercel delivers pages, images and scripts through a worldwide server network, usually from the location closest to you.

Each time a page is requested, Vercel automatically processes data that your browser sends for technical reasons (server log data):

• IP address
• date and time of access
• page requested (URL), status code and amount of data transferred
• previously visited page (referrer), if your browser sends it
• browser type and version, and operating system

Purpose: delivering the website, ensuring stability and security, fending off attacks and analysing errors.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the website.

Vercel processes this data on our behalf; a data processing agreement under Art. 28 GDPR is in place. For transfers to the USA, see Transfers to third countries.

Retention: Vercel keeps server log data only briefly – between one hour and no more than 30 days, depending on the plan – and then deletes it automatically.

To understand which content is read and to improve the website, we use Vercel Web Analytics. The service works without cookies and does not store any identifier on your device.

It records the page visited (address including certain parameters, for example the source of a link), the referring page, the approximate location (country, region, city), the device type, and the operating system and browser, each including its version. The script is loaded from our own domain.

To count visits, Vercel creates a pseudonymous one-way value (hash) from the data in your request (such as your IP address). It links your page views within a single day and is then reset automatically. According to Vercel, visits on different days or to other websites cannot be linked. Your IP address is not stored for the statistics.

We only receive aggregated statistics; we cannot identify individual visitors from them.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the statistical analysis of usage in order to improve our services. Vercel acts as our processor (Hosting).

Retention: The daily value expires after 24 hours. Vercel makes the aggregated statistics available to us for up to 24 months, depending on the plan.

On your first visit, a cookie banner asks whether you agree to the use of the Meta Pixel. We store your choice (“Accept” or “Decline”), together with a version number and the time, in your browser’s local storage (entry “blu-consent”) so that the banner does not reappear on every page. This information never leaves your device.

Legal basis: Section 25(2) no. 2 TDDDG, because storing it is strictly necessary to respect your choice, and Art. 6(1)(f) GDPR; our legitimate interest is to implement your decision.

Retention: until you clear your browser storage or we ask you again after a change to the services we use.

You can change your choice at any time via “Cookie settings” at the bottom of every page or with this button:

Open cookie settings

Only if you give your consent in the cookie banner do we use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”).

Purpose: We use it to measure how effective our ads on Facebook and Instagram are and to show ads there to people who have visited this website (retargeting). Meta can also optimise the delivery of our ads and build audiences similar to the visitors to our website.

Data processed: Your browser loads a script from Meta and, in doing so, sends in particular your IP address, information about your browser and device, the page visited, the previous page, and an identifier from the “_fbp” cookie and – if you arrive via a link from Facebook or Instagram, such as an ad – the “_fbc” cookie. The Meta Pixel also automatically records which buttons you click and page information such as its title; entries in form fields are not sent. In addition, Meta may set its own cookies and read cookies that are already stored in your browser, for example because you use Facebook or Instagram. If you are or have been logged in to Facebook or Instagram on this device, Meta can link the visit to your account. We only receive aggregated statistics and cannot identify you personally from them. We do not use “advanced matching”, which would send data such as email addresses to Meta.

Legal basis: your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR. Consent is voluntary. If you decline, the Meta Pixel is not loaded and you can still use the website without restriction. You can withdraw your consent at any time via the cookie settings; doing so deletes the Meta Pixel cookies in your browser.

Joint controllership: We and Meta are joint controllers for collecting the data on our website and transmitting it to Meta (Art. 26 GDPR). The details are set out in Meta’s Controller Addendum. Meta is the sole controller for any further processing on its side. Meta also uses the data for its own purposes, for example to personalise advertising on its platforms – including ads from other advertisers – and to improve its own services. You can exercise your rights regarding the data stored by Meta directly with Meta; you may also contact us.

Transfers to the USA: see Transfers to third countries.

Retention: The “_fbp” and “_fbc” cookies are valid for 90 days; they are deleted if you withdraw your consent. Meta itself decides how long it keeps the data it receives.

For more information, including on your rights towards Meta, see Meta’s privacy policy.

Our contact form is provided by the CRM provider SalesSuite CRM FlexCo, Alte Poststraße 156, 8020 Graz, Austria (“Salessuite”); the same applies to a form for requesting our checklist, where we offer one. To do this, your browser loads a script from Salessuite that inserts the form into our page as an embedded frame (iframe).

If you contact us by email or phone, we process your information (such as your name, contact details and the content of your message) to deal with your request. The legal bases and retention periods are the same as for the contact form.

We maintain our news articles in the Sanity content management system of Sanity AS, Trondheimsveien 2K, 0560 Oslo, Norway, and Sanity US Inc., 351 California Street, Suite 650, San Francisco, CA 94104, USA (“Sanity”). Sanity stores the content of the articles; the website retrieves it server-side and delivers it, including images, through our own hosting. While you read the website, your browser therefore does not connect to Sanity.

Sanity processes personal data of people who contribute to our content: editors who log in to the editing area (/studio) (such as name, email address and login data), and the author details we publish with our articles (name, role and, where applicable, short bio and photo). Anyone opening the editing area loads Sanity’s login page, which for technical reasons sends their IP address and browser information to Sanity.

Purpose: maintaining and publishing our articles and managing access to the content management system.

Legal basis: for editor accounts and for opening the editing area, Art. 6(1)(f) GDPR (our legitimate interest: managing the content management system securely). For naming authors with their name and role, Art. 6(1)(b) GDPR where this is part of their contractual duties, otherwise Art. 6(1)(f) GDPR (our legitimate interest: showing who wrote an article). We only publish a photo and short bio with consent (Art. 6(1)(a) GDPR), which can be withdrawn at any time with effect for the future.

Sanity processes this data on our behalf; a data processing agreement under Art. 28 GDPR is in place. Content is stored primarily in data centres in Belgium.

We only pass on personal data where this is necessary for the purposes described. Recipients are:

• Vercel – hosting and audience measurement (processor)
• Salessuite – contact form and, where offered, checklist form, CRM (processor)
• Sanity – content management system, only data of our editorial team and authors (processor)
• IT service provider that looks after and maintains this website on our behalf (processor)
• Email and telephone providers through which we receive your messages and calls (processors)
• Meta – Meta Pixel, only with your consent (joint controller)

Beyond this, we only pass on data where we are legally required to, for example to public authorities.

Some of the providers named above are based in the USA or may transfer data there. For the USA, the European Commission has decided that companies certified under the EU-U.S. Data Privacy Framework ensure an adequate level of data protection (adequacy decision, Art. 45 GDPR). Where this does not apply, the European Commission’s Standard Contractual Clauses safeguard the transfer (Art. 46(2)(c) GDPR). You can obtain a copy of the Standard Contractual Clauses from us on request.

• Vercel (USA): certified under the EU-U.S. Data Privacy Framework; the data processing agreement also includes Standard Contractual Clauses.
• Meta (USA): Meta Platforms, Inc. is certified under the EU-U.S. Data Privacy Framework.
• Sanity (Norway, USA): Norway is part of the European Economic Area, where the GDPR applies. For transfers to the USA, the data processing agreement includes Standard Contractual Clauses.
• Salessuite (Austria): based and operating its systems in the EU. Where Salessuite’s sub-processors transfer data to third countries, in particular the USA, this is based, according to Salessuite, on the Data Privacy Framework or other appropriate safeguards (Art. 46 GDPR).

We store personal data only for as long as necessary for the respective purpose or as required by statutory retention duties. After that, we delete it or restrict its processing. Overview:

• Server log data (Vercel): between one hour and no more than 30 days, depending on the plan
• Audience measurement (Vercel Web Analytics): daily value 24 hours; aggregated statistics up to 24 months
• Your choice in the cookie banner: until you clear your browser storage or we ask you again
• Meta Pixel cookies (“_fbp”, “_fbc”): 90 days; deleted immediately if you withdraw consent
• Enquiries that do not lead to a contract: no later than six months after our communication has ended
• Checklist requests: no later than six months after sending the checklist
• Documents relating to a contract: in line with the statutory retention periods (in particular Section 147 of the German Fiscal Code, AO; Section 14b of the German VAT Act, UStG; where applicable Section 257 of the German Commercial Code, HGB) – business letters six years, invoices and accounting vouchers eight years, books and records ten years, each from the end of the calendar year
• Our editorial team’s data in the content management system: for as long as the editor account exists
• Author details: for as long as articles by that author are published; photo and short bio until consent is withdrawn

You have the following rights against us regarding your personal data:

• Access to the data we process about you (Art. 15 GDPR)
• Rectification of inaccurate or completion of incomplete data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR, see below)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR); this does not affect the lawfulness of processing carried out before the withdrawal

To exercise your rights, an informal message to kontakt@blu-engineering.de or to our postal address is sufficient.

Encryption: This website uses SSL/TLS encryption throughout (recognisable by “https://” and the padlock in the address bar). Data you send to us is thus protected against being read by unauthorised parties while in transit.

No obligation to provide data: You are not legally or contractually required to provide us with personal data. However, without the information in the contact form we cannot deal with your enquiry. If you request the checklist using a form, we need your email address to send it to you.

No automated decision-making: We do not make decisions based solely on automated processing (Art. 22 GDPR).

This privacy policy was last updated on 25 October 2026. We will update it whenever there is a change in the services we use or in the legal situation. The version currently published on this page applies.

This is a translation of the German Datenschutzerklärung. In case of any discrepancy, the German version prevails.