Privacy Policy
Data controller
LM Project Advisory UG (haftungsbeschränkt)
Frauenthal 7
20149 Hamburg
Germany
projects@lev-miller.de
+49 40 46663746
Hosting and email
Hosting and email are operated with STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. Technical connection data such as IP address, time, requested resource and browser information is processed to deliver and secure the website. The legal basis is Article 6(1)(f) GDPR, our legitimate interest in secure operation. STRATO processes hosting and email data as a service provider under the applicable processing agreement. Technical hosting logs follow the agreed STRATO retention periods. STRATO privacy information.
Enquiries and acknowledgements
The form sends your name, email, subject, message and, where provided, company, telephone number and contact preference to our server using an encrypted connection. Email is needed for the acknowledgement; a telephone number is required if you request a call. We store the enquiry in protected server storage and forward it to our project mailbox. An automatic acknowledgement confirms receipt, not an appointment or a paid contract. The basis is Article 6(1)(b) GDPR for contractual or pre-contractual enquiries, otherwise Article 6(1)(f), our interest in responding. Please do not initially send documents or particularly sensitive details. File uploads are not offered.
Security and temporary storage
We use verification tokens, a hidden form trap and temporary request limits to prevent abuse. IP addresses are stored only as a keyed cryptographic check value for up to 24 hours, never in usage statistics. Form tokens last two hours. Protected server copies of enquiries are deleted after at most 180 days; necessary correspondence remains in the project mailbox and any required archive. Deletion occurs through scheduled maintenance or the next server request. Security processing is based on Article 6(1)(f) GDPR.
Optional usage statistics
Only after you opt in, our own STRATO-hosted solution records page views, language, referring domain without its path, and general events such as opening or successfully submitting an enquiry. Only daily totals are stored. There are no visitor profiles, user IDs or links to enquiry contents. IP addresses are technically required for connections but are not stored in statistics. Daily aggregates are deleted after 13 months. The basis is Article 6(1)(a) GDPR and, where applicable, terminal-device consent under section 25(1) TDDDG. Refusing statistics does not affect enquiries.
Your browser choice
Your statistics choice is saved for up to 180 days in localStorage under “lmpa-privacy-v24”. You can change it and withdraw consent for the future through “Privacy settings” in the footer. Essential enquiry functions need no visitor cookies. The protected administration area uses a session cookie only for administrators. Fonts and images load from the website host. No advertising pixels or embedded maps are used.
Client documents and recipients
Project documents are mainly digital on business-controlled computers and in the email mailbox. Paper copies are temporary. Access is limited to management and, where applicable, expressly authorised staff on a need-to-know basis. Clients can request their own materials through the contact address; there is no client portal. Additional cloud storage will be introduced only after the actual service has been selected and assessed and this notice updated. Necessary information may be shared within the agreed engagement and authority with lawyers, notaries, tax advisers, translators, courts and competent authorities. Only necessary data is shared. External professionals and authorities generally act as independent controllers; processors receive the appropriate contractual obligations. Bases include Article 6(1)(b), (c) or (f) GDPR; special categories require additional conditions.
AI-assisted preparation
We may use AI to analyse and prepare materials and explain this in the engagement. The current workflow uses only effectively anonymised content. Removing names alone is insufficient if other information still identifies someone. Identifiable originals will not be entered into general-purpose AI services before the lawful basis, processing settings, recipients, international transfers and necessary agreements have been assessed. Human review and responsibility remain with us.
Retention and deletion
Data is retained for its purpose. Unsuccessful general enquiries with no further retention basis are normally deleted within six months. Depending on the document category, statutory periods include ten years for commercial books and annual accounts, eight years for accounting vouchers, and six years for business correspondence. The start of these periods and tax exceptions follow the HGB and AO. Other project materials are deleted after their purpose ends unless legal duties, outstanding claims or documented legitimate reasons require retention. Not all client data is kept for ten years.
Your rights
Subject to the GDPR, you have rights of access, correction, erasure, restriction and portability. You may object on grounds relating to your situation where processing relies on legitimate interests, and withdraw consent for the future. You can complain to a supervisory authority, including the Hamburg Commissioner for Data Protection and Freedom of Information. Contact projects@lev-miller.de to exercise your rights.
Last updated
16 October 2026. Changes to the services actually used will be reflected here.