1. Controller
Acemo GmbH, Schloss-Rahe-Straße 3, 52072 Aachen, Germany · info@acemo.eu
2. Hosting
This website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The servers are located in a data centre in Germany. Hetzner processes the data arising from your visit to this website exclusively on our behalf and in accordance with our instructions; we have concluded a data processing agreement with Hetzner under Art. 28 GDPR to that effect. The legal basis is our legitimate interest in the secure and reliable provision of this website (Art. 6(1)(f) GDPR). More information: hetzner.com/legal/privacy-policy.
3. Server log files
When you visit this website, technical access data (IP address, date and time, page requested, browser type, referrer URL) is logged automatically — both by our hosting provider's web server and by the application itself. This data is used solely to deliver, operate and secure the website (Art. 6(1)(f) GDPR) and is deleted automatically after a short period. To defend against overload and automated attacks, the IP address is additionally held briefly in memory in order to limit the number of requests per time window; it is not stored permanently for this purpose.
4. Contact form
When you contact us via the contact form, we process the information you provide (name, email address, optional phone number, subject, message) to handle your inquiry, based on Art. 6(1)(b) or (f) GDPR. The message is forwarded to us by email and additionally stored as a backup copy in our internal admin system so no inquiry is lost if the email delivery fails.
Alongside the message we also store your IP address and your browser identifier (user agent). These two items serve solely to trace and prevent abuse of the form (such as bulk spam submissions); the legal basis is our legitimate interest in the security and functioning of the form (Art. 6(1)(f) GDPR).
We delete this data once it is no longer required to process your inquiry, at the latest after 12 months, unless statutory retention obligations require otherwise.
5. Spam and abuse protection (Cloudflare Turnstile)
To protect the contact form from automated abuse, we use "Turnstile" provided by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Turnstile analyzes various signals (e.g. IP address, browser and device information) to distinguish humans from bots, without requiring users to solve a visual or text puzzle. When a form submission is checked, we also transmit your IP address to Cloudflare. The legal basis is our legitimate interest in a functional, abuse-protected contact form (Art. 6(1)(f) GDPR).
Cloudflare also processes data on servers in the USA. The transfer to the USA is based on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) and on Cloudflare, Inc.'s certification under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). More information: cloudflare.com/privacypolicy.
6. Cookies
This website uses strictly necessary cookies only:
- lang — stores your language choice (German/English). Lifetime: 1 year.
- cookie_notice_ack — remembers that you acknowledged the cookie notice at the bottom of the page, so it does not reappear on every visit. Lifetime: 1 year.
- acemo_session — in the protected admin area only: session cookie authenticating Acemo staff. Lifetime: 8 hours.
We do not use tracking or marketing cookies and do not build usage profiles. As all of the above cookies are strictly necessary to provide the service you have explicitly requested, no consent under § 25(2) TDDDG is required.
7. Audience measurement (self-hosted, cookieless)
To understand which parts of our website are used, we run our own privacy-preserving traffic statistics. The analysis runs exclusively on our own server; no data is transmitted to third parties and no cookies are set.
For each page view we process: the address requested, date and time, the referring page, language and campaign parameters in the URL, and — derived from the browser's user agent — device type, browser and operating system in coarse categories. Where our content delivery network supplies it, the country (not the location) is also stored. In addition, a small script reports how long a page was visible, how far it was scrolled, how wide the browser window is, and whether a document or an external link was clicked.
Your IP address is not stored. To group repeat views within a single day, we derive an irreversible checksum (SHA-256) from the IP address, user agent and domain. The random value ("salt") used for this changes daily and is then deleted, so the stored values can afterwards be linked neither to a person nor to each other. No cross-site or cross-day usage profiles are created and no individual is recognised.
Because no information is stored on or read from your device, no consent under § 25 TDDDG is required. The legal basis for the subsequent processing is our legitimate interest in statistical analysis and in designing our offering to meet actual demand (Art. 6(1)(f) GDPR). Raw data is deleted automatically after 400 days at the latest.
8. Embedded fonts
This website uses the "Inter" and "Space Grotesk" typefaces. The font files are served locally from our own server; no connection is made to third-party servers (e.g. Google Fonts).
9. Your rights
You have the right to access, rectify, erase, and restrict the processing of your personal data, as well as the right to data portability and to object to processing. You also have the right to lodge a complaint with the competent data protection supervisory authority.