Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
LETO SPACE GmbH
- Address: Stremayrgasse 16, 8010 Graz, Austria
- Email: office@leto.space
- Phone: +43 676 4554355
Further company details are given in the imprint.
Principles
When you use the pages of LETO SPACE, personal data may be collected or processed. This data is never sold, and it is passed on to third parties for their own purposes only with your explicit consent. We do, however, use a small number of service providers who process data solely on our behalf and on our instructions under a data processing agreement pursuant to Art. 28 GDPR. They are listed in the sections below.
Hosting and server logs
This website runs on a server that we operate ourselves. The server is rented from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, and is located in a Hetzner data centre in Germany. Hetzner provides the server under a data processing agreement pursuant to Art. 28 GDPR.
When you open a page, your browser transmits technical data that the web server needs to deliver the page: your IP address, the date and time of the request, the requested address, the referring address, the HTTP status code and your browser's user agent. The web server records this data in log files. We use the log files only to operate the website securely and to find and correct faults. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in the secure and error-free operation of this website. The log files are deleted after 14 days.
The fonts used on this website are delivered from our own server. No request is sent to a font provider.
Cookies and local storage
This website does not set cookies.
If you choose a light or dark colour scheme, your browser stores this choice in its local storage under the name leto-theme, so that the page keeps your choice on your next visit. On the home page, your browser also stores a note in its session storage (leto-hero-seen) so that the opening animation plays only once per browser session; this note is deleted when you close the browser tab. Neither entry is transmitted to us. You can delete both at any time in your browser settings.
Website statistics with Umami
To understand how this website is used, we measure visits with Umami, an open-source analytics software that we operate on our own server in Germany (see Hosting). Umami does not use cookies and does not store your IP address.
For each page view, Umami records the address of the page, the referring address, the page title, your browser, operating system, device type, screen size and browser language, and the country, region and city derived from your IP address. The IP address is used only for this lookup and is not stored. Visits are grouped by an anonymous session identifier, not by a cookie, so we cannot recognise you across devices or browsers. We also count a few actions on the site: clicks on a booking button (with the page, the position of the button and the audience the page addresses), clicks on links to other websites (with the target domain), downloads of files offered on the site (with the file name), and the successful sending of the contact form (with the page and the type of organisation you selected, but not the contents of your message).
This data is not passed to any third party. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in understanding and improving the use of this website. Umami data is deleted after 24 months.
Error reports with Sentry
To detect and correct technical faults, this website transmits technical error reports to Sentry, operated by Functional Software, Inc. d/b/a Sentry, 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA. Our organisation uses Sentry's European data region, where error events are stored in Frankfurt, Germany; account and organisation metadata is held in the United States. Sentry processes this data on our behalf under a data processing agreement pursuant to Art. 28 GDPR. A report may contain your IP address, the URL of the page, your browser and operating system version, and the technical context of the fault. Your IP address is transmitted to Sentry only when a report is sent. No session recordings are made and no form contents are transmitted.
Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in the secure and error-free operation of this website. Transfers to the United States are based on the EU-US Data Privacy Framework, with Standard Contractual Clauses as a fallback. Error events are deleted after 90 days. Further information: sentry.io/privacy (opens sentry.io)
Contact form and email
If you send us a message with the contact form, we process the details you enter: your name, your organisation, your email address, the type of organisation you select, your message and your consent. With the message we also receive the address and language of the page from which you sent it. The form is protected against spam by a hidden field, a time check and a limit on the number of messages per IP address. For this limit, your IP address is held in the server's working memory for at most 24 hours and is not written to disk. No third-party service is involved. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in protecting the form against misuse.
Your details are not stored on the web server. The server hands them to Azure Communication Services, an email service of Microsoft with its data location in Germany, which delivers them as an email to our mailbox at Microsoft 365, where we handle them. Both services are provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, which processes this data on our behalf under a data processing agreement pursuant to Art. 28 GDPR. Microsoft stores and processes customer data of both services for customers in the European Union within its EU Data Boundary, with limited exceptions documented by Microsoft. Where data is transferred to Microsoft Corporation in the United States, the transfer is based on the EU-US Data Privacy Framework. The same applies when you write to us by email.
We use your details only to answer your request. Legal basis: your consent pursuant to Art. 6(1)(a) GDPR, which you give in the form and may withdraw at any time with effect for the future, for example by email to office@leto.space. For messages you send by email, the legal basis is Art. 6(1)(f) GDPR, our legitimate interest in answering requests addressed to us. Where your request concerns a contract or the steps before one, the legal basis is also Art. 6(1)(b) GDPR. If your request does not lead to an engagement, we delete your message 12 months after we have finished handling it. If it does lead to an engagement, we keep it for as long as statutory retention obligations require.
Booking an initial call
The buttons for booking a call are links to our booking page on Microsoft Bookings, part of Microsoft 365. No data is transmitted to Microsoft when our pages load; only when you follow the link does your browser open the booking page on a Microsoft server.
When you book an appointment, we receive the details you enter on the booking page, such as your name, email address and the information you provide about your request, together with the chosen date and time. The appointment is stored in our Microsoft 365 calendar. Microsoft processes this data on our behalf under the same data processing agreement as described for the contact form. We use the data to prepare and hold the call. Legal basis: Art. 6(1)(b) GDPR, steps taken at your request before entering into a contract. If the call does not lead to an engagement, we delete the booking 12 months after the call. If it does, we keep it for as long as statutory retention obligations require.
The booking page itself is provided by Microsoft and may use cookies and similar technologies of Microsoft. Further information: Microsoft Privacy Statement (opens microsoft.com)
Clients and project participants
When LETO SPACE GmbH provides consulting, analysis, workshop and project services under our terms and conditions, we process personal data of the people involved in an engagement:
- Contact persons at our clients, partners and providers: name, organisation, role, business contact details and our correspondence with them.
- Participants in interviews, workshops and training: name, organisation, role, their contributions, for example interview notes and workshop results, and their attendance.
- Content data that clients provide to us for the engagement, to the extent it contains personal data.
We receive this data from you or from the organisation you work for, for example from our clients, who name contact persons and participants to us. There is no statutory obligation to provide this data to us. Without the contact details of the contact persons, however, we cannot carry out an engagement.
We use this data to prepare and perform the contract, to communicate with the people involved, to document the project and to invoice our services. Legal basis: Art. 6(1)(b) GDPR where you are yourself our contracting party or where the processing serves steps taken at your request before entering into a contract; Art. 6(1)(f) GDPR, our legitimate interest in performing the engagement with the organisation you work for, where you are a contact person of an organisation or a participant; and Art. 6(1)(c) GDPR where statutory retention obligations require us to keep data.
Where we process personal data on behalf of a client, we act as its processor under an agreement pursuant to Art. 28 GDPR. In that case the client is the controller, and the client's privacy information applies.
Correspondence, calendar entries and project files are held in Microsoft 365, which Microsoft processes on our behalf as described in the section on the contact form and email. We use AI services as aids, for example for research, summarising, translation and data analysis, only where they process data on our behalf under an agreement pursuant to Art. 28 GDPR and their terms exclude the use of inputs for training AI models. Where data are transferred to a country outside the European Economic Area in the process, this takes place only on the basis of an adequacy decision under Art. 45 GDPR, such as the EU-US Data Privacy Framework, or of standard contractual clauses under Art. 46(2)(c) GDPR. Experts and subcontractors whom we bring into an engagement receive the data they need for their part of the work and are bound to confidentiality. Where a contract or a funding agreement requires it, we pass data to public funding bodies or contracting authorities.
We keep accounting records, including invoices and the vouchers belonging to them, for seven years (§ 132 BAO). We keep contract-related correspondence and project documentation for as long as claims arising from the engagement can be raised. Under our terms and conditions, warranty claims must be asserted in court within six months of handover, and claims for damages become time-barred one year after knowledge of the damage and of the person causing it, but no later than three years after the event giving rise to the claim. After that, we delete this data. We delete the data of interview, workshop and training participants as soon as the project documentation no longer needs it.
Your rights are described in the section "Your rights" below.
Job applications
When you apply for a position with us, we process the data contained in your application: your name and contact details, your CV, covering letter and any documents you attach, together with the correspondence and assessment notes that arise during the application process. This data is held in our own Odoo system, which we operate on servers we control at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (data centre location: Nuremberg), under a data processing agreement pursuant to Art. 28 GDPR. Your application is not transmitted to any external recruitment platform or applicant-tracking service.
Legal basis: Art. 6(1)(b) GDPR, the taking of steps at your request prior to entering into a contract of employment. Where an application discloses special categories of personal data (for example information relating to a disability), we process these only on the basis of Art. 9(2)(b) GDPR, in order to meet our obligations under employment law.
Retention: if your application is not successful, we retain your application data for six months after the process concludes, so that we are able to respond to any claim under the Austrian Equal Treatment Act (Gleichbehandlungsgesetz), which provides a six-month limitation period. Your data is deleted thereafter. We will keep your application on file beyond that period only if you expressly ask us to, and you may withdraw that request at any time.
Your application data is also contained in our encrypted backups. Where data has been deleted from the live system, any copy remaining in a backup is not used for any purpose and is removed as that backup is rotated out.
To request access to, correction of, or erasure of your application data, please contact office@leto.space.
Links to other websites
This website contains links to other websites, for example to our products, to LinkedIn and to the sources we cite. These are plain links: no content from these websites is embedded in our pages, and no data is transmitted to them until you follow a link. Once you do, the privacy policy of the website you open applies.
Your rights
Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Where you have given consent, you may withdraw it at any time with effect for the future (Art. 7(3)). To exercise these rights, write to office@leto.space.
Right to object: Where we process your data on the basis of our legitimate interest (server logs, spam protection of the contact form, Umami, Sentry, enquiries by email, contact persons and participants in our engagements), you may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR).
If you believe that our processing of your data infringes data protection law, you have the right to lodge a complaint with a supervisory authority. In Austria, this is the Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at (opens dsb.gv.at).