Privacy policy
Thank you for your interest in our company. The protection of your personal data is important to us. Below we inform you about the processing of personal data when you use our website. The German version is legally binding.
I. Controller and Data Protection Officer
Controller within the meaning of the GDPR:
mosaic IT GmbH
Barfußgäßchen 12
04109 Leipzig, Germany
Phone: +49 571 783484 0
Email: info@mosaic-it.de
Data Protection Officer:
datarea GmbH
Meißner Straße 103
01445 Radebeul, Germany
Phone: +49 351 27 22 08 80
II. General information on data processing
As a matter of principle, we process personal data of our users only to the extent necessary to provide a functioning website as well as our content and services, or where you have given your consent.
Legal bases are Art. 6(1)(a) GDPR (consent), (b) (performance of a contract and pre-contractual measures), (c) (legal obligation) and (f) (legitimate interests). Storing and accessing information on your device is additionally governed by Section 25 of the German TDDDG.
Erasure and storage period: Personal data is erased or blocked as soon as the purpose of storage no longer applies, unless statutory retention obligations require otherwise.
III. Provision of the website and server log files
When you visit our website, our hosting provider HubSpot and the content delivery network used by HubSpot (Cloudflare) automatically process information transmitted by your browser: IP address, date and time of access, page accessed, the website from which you came, browser type and version, and operating system. This processing is technically necessary to deliver the website, ensure its stability and security, and fend off attacks. The legal basis is Art. 6(1)(f) GDPR. The data is stored in the provider's server log files and deleted in line with the provider's rules. We do not combine this data with other data sources to identify individual visitors.
IV. Cookies and consent
Our website uses cookies. These are small text files stored in your browser.
Technically necessary cookies are required to operate the website, for example to store your choice in the cookie banner (legal basis: Section 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR).
Analytics and marketing cookies are set only with your consent (legal basis: Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You make your choice in our cookie banner on your first visit. You can change or withdraw it at any time via the “Cookie settings” link at the bottom of every page. Withdrawal applies for the future.
With your consent, the following cookies may be set:
| Cookie | Purpose | Lifetime | Category |
|---|---|---|---|
__hs_cookie_cat_pref | stores your choice in the cookie banner | 6 months | necessary |
__cf_bm | protection against automated access (content delivery network) | 30 minutes | necessary |
__hstc | recognises returning visitors (HubSpot) | 6 months | analytics |
hubspotutk | links visits and form submissions (HubSpot) | 6 months | analytics |
__hssc | session tracking (HubSpot) | 30 minutes | analytics |
__hssrc | detects a session restart (HubSpot) | end of session | analytics |
_gcl_au | ad conversion measurement (Google Ads) | 3 months | marketing |
IDE (doubleclick.net) | ad measurement and remarketing (Google Ads) | up to 13 months | marketing |
V. Contact forms, meeting booking and email contact
Forms: When you use one of our forms (for example contact, support, trial, live demo, download, partner enquiry), we process the data you enter and technical transmission data (IP address, date and time, browser information) in order to handle your request. The legal basis is Art. 6(1)(b) GDPR where your request relates to a contract or pre-contractual measures, otherwise Art. 6(1)(f) GDPR (handling enquiries) or Art. 6(1)(a) GDPR where you have given consent, for example to receive information.
Meeting booking: To book an initial consultation we use HubSpot's meeting scheduling tool. We process your name, email address, phone number, company and the selected time. The invitation is sent from the calendar of the respective contact person (Microsoft 365, provider: Microsoft Ireland Operations Limited); online meetings take place via Microsoft Teams. The legal basis is Art. 6(1)(b) GDPR.
Email contact: If you email us, we process your details to handle your enquiry (Art. 6(1)(b) or (f) GDPR).
Storage period: We store this data for as long as the business relationship exists or until you withdraw your consent. After that we delete it, observing statutory retention periods.
VI. Services used
Website operation, forms and analytics: HubSpot
This website is operated on the HubSpot platform (provider: HubSpot Ireland Ltd., One Sir John Rogerson's Quay, Dublin 2, Ireland; parent company HubSpot, Inc., USA). HubSpot provides content management, forms, meeting booking and, only with your consent, analytics and ad measurement functions. HubSpot processes personal data as a processor under a data processing agreement. Legal bases are Art. 6(1)(b) and (f) GDPR (operation and provision) and Art. 6(1)(a) GDPR (analytics and marketing functions).
Processing location and third-country transfers: Our HubSpot account runs in the EU data region; HubSpot stores the data in data centres in Germany (Amazon Web Services). Individual processing operations may also take place outside the EU, in particular support access by HubSpot, the sending of emails and notifications, delivery via content delivery networks, and sub-processors. For transfers to the US, HubSpot relies on the EU-US Data Privacy Framework and the EU Standard Contractual Clauses. The list of sub-processors is available at legal.hubspot.com/sub-processors-page and the data processing agreement at legal.hubspot.com/dpa.
Google Ads (conversion tracking and remarketing)
With your consent we use Google Ads (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google Ads helps us measure whether visits and enquiries result from our ads (conversion tracking) and allows us to show visitors of our website relevant ads later (remarketing). For this purpose the cookies _gcl_au and IDE listed above are set and usage data including your IP address is transmitted to Google. The legal basis is your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR), which you can withdraw at any time via “Cookie settings”. A transfer to Google LLC in the US is possible; Google LLC is certified under the EU-US Data Privacy Framework. More information: policies.google.com/privacy.
External links
Our website contains links to external services, for example our applicant portal at Personio, LinkedIn and YouTube. Merely visiting our website does not transmit any data to these providers. Only when you click a link do the privacy terms of the respective provider apply.
VII. Your rights as a data subject
If your personal data is processed, you have the following rights vis-à-vis the controller:
- Right of access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to notification of recipients (Art. 19 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object to processing (Art. 21 GDPR)
- Right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR)
- Right not to be subject to a decision based solely on automated processing (Art. 22 GDPR)
- Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)
Version: 29 September 2026