Privacy policy

1. Who is responsible

OOHLEMON GmbH
Höferlesbach 9
73525 Schwäbisch Gmünd, Germany
Email: info@oohlemon.com
Phone: +49 176 10244712

2. What we process and why

• Visiting this website: our host automatically records server log files (e.g. IP address, date and time, browser type, page visited) to keep the site running securely and without errors — legitimate interest, Art. 6(1)(f) GDPR. They are deleted after a short time.
• Analytics: we only use analytics services with your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time via “Cookie settings” in the site footer.
• Analytics with PostHog: if you allow “Analytics” in the cookie banner, we use PostHog (PostHog Inc., USA) for privacy-friendly reach measurement. Processing takes place on servers in the European Union. We record pages visited, time on page, the referring page and technical characteristics of your browser and device (e.g. browser type, operating system, screen size, language). We do not use cookies for this and do not store any identifiers on your device. The legal basis is your consent, which you can withdraw at any time via “Cookie settings” in the site footer. A data processing agreement under Art. 28 GDPR is in place with PostHog. Data is deleted as soon as the purpose no longer applies or your consent is withdrawn.
• Registration statistics: when you create an account we transmit a pseudonymous “registration” event to PostHog (see above): an internal account identifier and, where applicable, the campaign parameters (utm_*) of the link that brought you to us. This measures which channels bring us customers — legitimate interest, Art. 6(1)(f) GDPR. You may object at any time (Art. 21 GDPR), e.g. by emailing info@oohlemon.com.
• Contact requests (form, email, WhatsApp): your details (name, email address and, if provided, company and phone number) to handle your request and any follow-up questions — Art. 6(1)(b) GDPR (pre-contractual steps) or Art. 6(1)(f) GDPR (legitimate interest). We only share them with the service providers needed to run the form and process your request (see section 3), or where legally required. The optional field “How did you hear about us?” is voluntary and used to measure our marketing channels (Art. 6(1)(f) GDPR; you may object). We delete the data once your request is dealt with, unless statutory retention periods apply.
• Customer account (v2.app.oohlemon.com): name, email address, company details and contract data, including payment data via our payment provider — to perform the contract (Art. 6(1)(b) GDPR). Only our payment providers process payment data; we don't store full card details.
• Social media connections (e.g. TikTok, Instagram/Meta, LinkedIn): only if you connect an account in your OOHLEMON account do we pass the data needed for the connection (e.g. authorisation tokens, the account's display name) to the platform. You can disconnect at any time; we then delete the access data stored with us. This website doesn't embed social media plugins that send data when you simply visit it.

3. Hosting and encryption

This website and the OOHLEMON platform are hosted by external service providers with servers in the European Union. They are contractually bound as processors under Art. 28 GDPR. All data is transferred with SSL/TLS encryption. Specifically: this website runs on Vercel (EU region); the OOHLEMON platform (app and database) on servers in Germany. Media files are stored and delivered via Cloudflare (Cloudflare, Inc., USA; processing agreement with EU Standard Contractual Clauses). For handling inquiries we also use Airtable, Inc. (USA; processor, SCCs), Postmark (ActiveCampaign, LLC, USA; processor, SCCs) for email delivery, and the messenger service Telegram (Telegram FZ LLC) to notify our team immediately (legitimate interest in prompt handling; you may object via info@oohlemon.com).

4. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing (Art. 21). You can withdraw any consent at any time with effect for the future (Art. 7(3) GDPR). Just email info@oohlemon.com. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or where the alleged infringement took place (Art. 77 GDPR).