Privacy Policy

Effective date: 23 October 2026 · Website: eastboundlink.com

Controller

Sascha Lotz, trading as Lotz Business Link
Kirchenplatz 1a
91093 Heßdorf
Germany
Email: hello@eastboundlink.com

In this policy, “Eastbound Link”, “we” and “us” refer to the controller identified above, operating under the Eastbound Link brand.

Scope of this policy

This policy explains the processing of personal data through the Eastbound Link website and in connection with related business enquiries.

Website hosting and access logs

When you access the website, technical data may include your IP address, request time, requested page, referrer, browser and operating system, and response status. We process the technical data actually collected by our hosting setup to deliver the website, maintain security and investigate faults. The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the secure and reliable operation of the website.

• Hosting provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, together with Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany.
• Processing locations: Cloudflare operates a global network, so technical data may be processed in the European Union and the United States.
• Transfers outside the EEA: covered by the EU Standard Contractual Clauses and Cloudflare's data processing terms.
• Logs and retention: we do not operate a separate log database of our own. Standard technical logs are processed by the hosting provider for the purposes described above and kept only for as long as needed for security and troubleshooting.

Cookies and similar technologies

We do not use cookies or similar technologies for analytics, advertising or tracking. Our hosting provider Cloudflare may set strictly necessary security cookies — for example __cf_bm and, where a security challenge is triggered, cf_clearance — to protect the website against automated abuse. These are strictly necessary and rely on the exception in section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG). Because no optional cookies are used, no consent banner is displayed and no consent is required.

Email and business enquiries

We process contact details, correspondence and the information you provide in order to respond to enquiries and manage business relationships. Article 6(1)(b) GDPR applies where processing is necessary for a contract with you or for pre-contractual steps you request. For representatives of business customers, Article 6(1)(f) GDPR generally applies, based on our interest in communicating with the business. Legal record-keeping obligations are based on Article 6(1)(c) GDPR.

• Email provider: Google Workspace — Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
• Transfers outside the EEA: Google is certified under the EU–US Data Privacy Framework; transfers are otherwise covered by the EU Standard Contractual Clauses.
• Retention: enquiry data is kept for as long as needed to handle the request and any resulting business relationship. Statutory retention periods, in particular commercial and tax record-keeping duties, apply where relevant.

Providing enquiry information is voluntary. However, without the necessary contact or project details we may be unable to respond or to provide the requested service.

Contact form

When you use the contact form, we process the fields you complete — name, email address, company, area of interest and your message — in order to handle your request.

• Legal basis: Article 6(1)(b) GDPR for your own contractual or pre-contractual enquiry, otherwise Article 6(1)(f) GDPR for business communication.
• Delivery provider: Resend, Inc. (San Francisco, USA), which transmits the form content to our inbox on our instructions.
• Transfers outside the EEA: covered by the EU Standard Contractual Clauses.
• Spam protection: an invisible honeypot field is used. No third-party CAPTCHA is loaded.
• Retention: as described under “Email and business enquiries”.

Fonts and third-party content

All fonts used on this website are hosted on our own server. No connection is made to Google Fonts or any other font provider, and no personal data is transmitted to them for that purpose.

We do not embed external videos, maps, social media plugins or booking tools.

Analytics, advertising and newsletter

We do not use analytics or advertising tools, we do not create user profiles, and we do not operate a newsletter. No corresponding personal data is processed.

Recipients and international transfers

Recipients of personal data are limited to the service providers named in this policy — hosting, email and form delivery — each acting on our instructions and, where required, under a data processing agreement. We do not sell personal data.

Where data is transferred outside the EEA, we rely on an adequacy decision (including the EU–US Data Privacy Framework) or on the EU Standard Contractual Clauses. You may request a copy of the relevant safeguards from us.

Retention and automated decisions

Data-specific retention periods or deletion criteria are stated in the relevant sections above. Legal retention requirements, or the need to establish, exercise or defend legal claims, may require longer retention.

We do not carry out automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

Your rights

Subject to the legal conditions, you may request access, rectification, erasure, restriction of processing and data portability. You may withdraw consent at any time with effect for the future. Withdrawal does not affect processing lawfully carried out before withdrawal. To exercise your rights, contact hello@eastboundlink.com.

Where processing relies on Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. You may object to processing for direct marketing at any time.

Complaints

You may complain to a supervisory authority, in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement. The supervisory authority for private-sector organisations in Bavaria is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

Complaint information at the BayLDA

Changes to this policy

We may update this policy to reflect changes to the website or to the law. The effective date shown above indicates the current version.