Lotus LibreAI systems
Book audit

Privacy policy

Last updated:

This policy explains how LOTUS LIBRE B.V. processes personal data when you visit lotuslibre.com, send us a request through the contact form or write to us by email. We wrote it to be read, not just to exist.

Who is responsible

The controller under the General Data Protection Regulation (GDPR) is:

LOTUS LIBRE B.V. Rijshoeve 3, 5382 KX Vinkel, the Netherlands Email: hello@lotuslibre.com

We have not appointed a data protection officer, as we are not required to. For any privacy question, write to the address above.

In short

  • No cookies, no analytics, no trackers. This website sets no cookies and loads no third-party scripts, fonts or embeds. That is why you don’t see a cookie banner.
  • We only process what you send us through the contact form or by email, plus the minimum technical data needed to run and protect the website.
  • We never sell your data and never use it for advertising.

Visiting the website

When you open a page, our web server automatically processes technical data that your browser sends: IP address, date and time, requested page, referrer, browser type and operating system. We need this to deliver the page and to detect and stop abuse.

  • Legal basis: our legitimate interest in operating a secure website (Art. 6(1)(f) GDPR).
  • Retention: server logs are deleted automatically after 14 days, unless an entry is needed to investigate a specific security incident.

The website is hosted on our own server at Hetzner Online GmbH in Germany (EU), which acts as our processor.

The contact form

When you request an audit through the form, we process:

  • your name and email address (required);
  • phone number and company name (optional);
  • your area of interest and message (optional);
  • the page language and page address from which you sent the form, and campaign parameters (UTM) if the link you followed contained them;
  • your IP address and browser identifier (user agent), to protect the form against spam and abuse.

Purpose and legal basis. We use this data to answer your request and to take steps before a possible contract (Art. 6(1)(b) GDPR). We use the IP address and user agent for security and rate limiting, based on our legitimate interest (Art. 6(1)(f) GDPR). A temporary counter tied to your IP address is deleted automatically after one hour.

Where it goes. Your request is stored in our internal workspace on our server in Germany. Our partners are notified inside that workspace and, as a short notification containing your name, contact details and message, through the Telegram messaging service (Telegram Messenger Inc.). Telegram may process data outside the EU; we use it only for this internal notification.

Retention. We keep requests for up to 12 months after our last contact. If a contract follows, data needed for it is kept for as long as the contract runs and then for the statutory retention period (7 years for Dutch tax records).

Email

If you write to hello@lotuslibre.com, we process your email address, the content of your message and any attachments to reply to you (Art. 6(1)(b) or (f) GDPR). Incoming email is routed by Cloudflare, Inc. and delivered to a mailbox at Google (Gmail). Both providers may process data in the United States; transfers are based on the EU–US Data Privacy Framework and/or Standard Contractual Clauses.

Recipients

We share personal data only with the service providers named above (hosting, email routing and mailbox, internal notifications), bound by data processing terms, and with authorities where the law requires it. We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

Your rights

You have the right to access your data, to have it corrected or erased, to restrict processing, to data portability, and to object to processing based on our legitimate interest. Where processing is based on consent, you can withdraw it at any time with effect for the future. To exercise any right, email hello@lotuslibre.com — we answer within one month.

You also have the right to lodge a complaint with a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl); you may also contact the authority in the EU country where you live or work.

Security

The website is served exclusively over HTTPS with a strict content security policy. Access to our systems is limited to the partners of the studio and protected with strong authentication.

Changes

We update this policy when our processing changes. The date at the top shows the latest version.