Last updated: 17 October 2026
This privacy policy explains how personal data is processed when you visit lehmanngca.com (including www.lehmanngca.com) or contact us via the email address shown on this website. It is based on the EU General Data Protection Regulation (GDPR) and applicable German data protection law.
The controller within the meaning of Art. 4(7) GDPR is the person named in the legal notice (Impressum) at the end of this page. For all data protection matters, please contact info@lehmanngca.com.
This website is hosted and delivered by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (“Cloudflare”). When you open the website, Cloudflare automatically processes technical data transmitted by your browser, in particular your IP address, the date and time of access, the page requested, the referrer URL, the amount of data transferred, and your browser and operating system.
This processing is necessary to deliver the website to your device and to protect it against attacks and misuse. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and reliable provision of the website. Cloudflare acts as our processor under a data processing agreement pursuant to Art. 28 GDPR. Further information: cloudflare.com/privacypolicy.
This website does not use cookies, analytics, tracking, advertising or social media plug-ins, and no user profiles are created. All fonts are delivered from our own hosting; no data is sent to Google or other font providers.
If you contact us at the email address shown on this website, we process the data you provide, typically your name, email address, organisation, the content of your message and any attachments, in order to handle your enquiry and reply to you.
The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract or to steps prior to entering into one, and otherwise Art. 6(1)(f) GDPR; our legitimate interest is responding to enquiries and conducting business communication.
Our email service is provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (Microsoft 365), acting as our processor under a data processing agreement pursuant to Art. 28 GDPR.
Where an enquiry leads to further exchange, we may process the business contact details of you or your organisation (such as name, organisation, position, email address and telephone number) and notes on our communication in order to maintain the business relationship and to arrange and follow up on meetings. The legal basis is Art. 6(1)(b) GDPR where processing is necessary for a contract or pre-contractual steps, and otherwise Art. 6(1)(f) GDPR; our legitimate interest is maintaining and developing business relationships.
Personal data is disclosed to our processors Cloudflare (hosting) and Microsoft (email) as described above. It may also be disclosed to professional advisors bound by confidentiality, and to public authorities or courts where we are legally required to do so or where this is necessary to establish, exercise or defend legal claims. We do not sell personal data.
Cloudflare, Inc. is based in the USA, and Microsoft belongs to a US group of companies, so personal data may be processed in the USA. Transfers are based on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR), under which Cloudflare, Inc. and Microsoft Corporation are certified, and in addition on the EU standard contractual clauses (Art. 46(2)(c) GDPR). You can request a copy of these safeguards from us.
We store personal data for as long as it is needed for the purposes described above, which for business correspondence may include the duration of the business relationship, and beyond that only where we are legally required to retain it or where it is needed to establish, exercise or defend legal claims. Technical connection data is processed by Cloudflare only for the time necessary to deliver and secure the website.
You are not obliged to provide personal data. Without the technical data described in section 3, the website cannot be displayed; without your contact details, we cannot reply to your enquiry. We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Where processing is based on consent, you may withdraw it at any time with effect for the future (Art. 7(3) GDPR). To exercise your rights, contact info@lehmanngca.com.
Where we process your personal data on the basis of Art. 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation (Art. 21(1) GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. Where data is processed for direct marketing, you may object at any time without giving reasons (Art. 21(2) GDPR).
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.
Information pursuant to § 5 of the German Digital Services Act (DDG)
Sergej LehmannEmail: info@lehmanngca.com