Privacy policy
Thank you for your interest in our company. The protection of your personal data is important to us. Below we inform you about the processing of personal data when you use our website.
I. Controller and Data Protection Officer
Controller within the meaning of the GDPR:
mosaic IT GmbH
Arthur-Hoffmann-Str. 175
04277 Leipzig, Germany
From 1 October 2026: Barfußgäßchen 12, 04109 Leipzig, Germany
Phone: +49 571 783484 – 0
Email: info@mosaic-it.de
Data Protection Officer:
datarea GmbH
Meißner Straße 103
01445 Radebeul, Germany
Phone: 0351 27 22 08 80
II. General information on data processing
As a matter of principle, we process personal data of our users only to the extent necessary to provide a functioning website as well as our content and services. Processing generally takes place only with the user's consent; an exception applies in cases where prior consent cannot be obtained for factual reasons and the processing is permitted by law.
Legal bases are Art. 6(1)(a) GDPR (consent), (b) (performance of a contract), (c) (legal obligation), (d) (vital interests) and (f) (legitimate interests).
Erasure and storage period: The personal data of the data subject is erased or blocked as soon as the purpose of storage no longer applies, unless statutory retention obligations require otherwise.
III. Provision of the website and creation of log files
Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device: browser type and version used, operating system, internet service provider, IP address, date and time of access, websites from which the system reaches our site, and the pages accessed. The legal basis is Art. 6(1)(f) GDPR. The log files do not contain IP addresses or other data that would allow attribution to a user; the data is deleted at the end of the session.
IV. Use of cookies
Our website uses cookies – text files that are stored in or by the internet browser on the user's computer system.
Technically necessary cookies store, among other things, information about consent for service groups (legal basis: Art. 6(1)(f) GDPR).
Analysis and marketing cookies are set only with your consent (legal basis: Art. 6(1)(a) GDPR). You can adjust or withdraw your consent at any time.
Where HubSpot tracking is active, the following cookies may be set according to the provider's documentation:
| Cookie | Purpose | Lifetime | Category |
|---|---|---|---|
__hstc |
Main cookie for visitor tracking | 6 months | Analytics |
hubspotutk |
Visitor GUID, maps form submissions | 6 months | Analytics |
__hssc |
Session tracking | 30 minutes | Analytics |
__hssrc |
Session-restart detection | End of session | Analytics |
__hs_cookie_cat_pref |
stores the chosen consent categories | 6 months | necessary |
__hs_opt_out / __hs_do_not_track |
opt-out / do-not-track preference | 6 months | necessary |
__cf_bm |
bot protection (CDN) | 30 minutes | necessary |
This is the provider's list of possible cookies (source: HubSpot documentation "What cookies does HubSpot set in a visitor's browser") – not evidence of the cookies actually set on this website. Which are actually set depends on the HubSpot features enabled (tracking, chat) and your consent, and must be reconciled with the real consent tool before go-live.
[TO BE CONFIRMED] Still to be decided: the consent/cookie-banner tool of the new website (HubSpot's own consent banner or an external CMP) and therefore the exact withdrawal path (the previous "consent icon" wording stems from the old site and is not confirmed). It is documented that HubSpot stores the consent categories in the cookie __hs_cookie_cat_pref (6 months).
V. Contact form and email contact
Our website provides a contact form that can be used to get in touch electronically. The data entered in the input mask is processed, as well as IP address, date and time and user-agent information. The legal basis is Art. 6(1)(a) GDPR, and for email contact Art. 6(1)(b) or (f) GDPR. The data is deleted as soon as the respective conversation has ended.
[TO BE CONFIRMED] The retention/erasure period for additionally collected technical data (IP address, timestamp, user agent) is to be defined. The previous "seven days" figure stems from the old website and is not a HubSpot default (HubSpot does not enforce a 7-day deletion); the actual period is to be set by mosaic or configured via HubSpot data retention.
VI. Website operation (HubSpot) and services used
Content management, forms and hosting: HubSpot
This website is operated on the HubSpot platform (provider: HubSpot, Inc. / HubSpot Ireland Ltd.). HubSpot provides content management, forms and – subject to your consent – reach/usage analytics, and processes personal data as a processor under a data processing agreement. Legal bases are Art. 6(1)(b) and (f) GDPR (operation/provision) and (a) (consent-based analytics/marketing functions).
Processing location: The account runs in HubSpot's EU region (recorded as the data region in the HubSpot account settings). HubSpot stores EU customer data primarily in Germany on Amazon Web Services (AWS). However, HubSpot expressly states that individual processing operations may also occur outside this region – e.g. support/service access by HubSpot, delivery of emails/notifications, delivery via content delivery networks, and certain sub-processors. Third-country transfer: Where a transfer to the US occurs, HubSpot relies in its data processing agreement (DPA) on the EU Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework. HubSpot publishes the list of sub-processors and their processing locations at legal.hubspot.com/sub-processors-page; the DPA is available at legal.hubspot.com/dpa.
[TO BE CONFIRMED] A blanket "EU only" statement is not accurate: it must be confirmed which of the above operations actually involve processing outside the EU in this setup (support access, email/notification delivery, CDN, optional sub-processors) and which optional sub-processors are enabled. The location/legal-basis statements above are provider-documented; a final legal review remains required.
Further analytics/marketing services
[TO BE CONFIRMED – not yet verified] Whether and which additional analytics or marketing services (e.g. Google Analytics/Ads, LinkedIn, a lead-detection service) are actually used on the new website is still to be clarified. Only after confirmation will the respective providers, purposes, legal bases, retention periods and any third-country transfers be named here. Until then no statements are made (the details of the previous WordPress site are not adopted unchecked).
VII. Your rights as a data subject
If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:
- Right of access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to notification of recipients (Art. 19 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object to processing (Art. 21 GDPR)
- Right to withdraw consent under data protection law – at any time with effect for the future
- Right not to be subject to a decision based solely on automated processing (Art. 22 GDPR)
- Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)
Version: 7 April 2026 (German original). English working translation of this Date.