Privacy Policy

Last updated: 15 July 2026

1. Controller

The controller responsible for processing personal data on this website is:

Duna Digital GmbH
Schillerpromenade 39
12049 Berlin
Germany

Managing Director: Marton Molnar
Telephone: +49 30 69200 1094
Email: [email protected]

2. Provision of the website and server logs

When you access our website, technically necessary connection data is processed. This may include your IP address, the date and time of access, the requested URL, the referrer URL, browser and operating system information, the user agent, the amount of data transferred and the HTTP status code.

This processing is necessary to deliver the website, ensure its stability and security, investigate technical errors and prevent misuse. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of our website.

We use services provided by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, to deliver and protect the website. Cloudflare provides content delivery, DDoS protection and web security services. Cloudflare may process connection data for these purposes. Processing in the United States is possible. Cloudflare states that it relies, among other safeguards, on the EU-US Data Privacy Framework and Standard Contractual Clauses for international data transfers. Further information is available in Cloudflare's Privacy Policy.

Server logs are retained only for as long as necessary for operation, error analysis and security. If a specific security incident occurs, the relevant logs may be retained for longer until the incident has been fully resolved. Technical backup copies are overwritten in accordance with the operational backup cycle.

3. Contact form, email enquiries and technical backup

If you contact us through the contact form or by email, we process the information you provide. Depending on your enquiry, this may include the project type, budget range, schedule, name, email address, company, telephone number and your message.

We use this data to process your enquiry, answer follow-up questions, prepare a proposal or quotation and initiate a potential business relationship. The legal basis is Article 6(1)(b) GDPR where the processing concerns pre-contractual measures or a contract. For other business enquiries, the legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the processing and documentation of business communications.

The form data is delivered to us by email. For technical email delivery, we use Resend, a service provided by Plus Five Five, Inc. d/b/a Resend, 2261 Market Street #5039, San Francisco, CA 94114, USA. The information you enter in the form fields, including the content of your message, is transmitted to Resend for this purpose. Processing in the United States is possible. The data processing agreement concluded with Resend includes the European Commission's Standard Contractual Clauses to safeguard transfers to the United States. Resend also states that it participates in the EU-US Data Privacy Framework. Further information is available in Resend's Privacy Policy.

We also store the data submitted through the form in an internal technical log. This log serves as a backup so that failed deliveries can be investigated and enquiries can be recovered in the event of technical problems. It is accessible only to authorised persons and is included in server-side backups. Depending on the context, the legal basis is Article 6(1)(b) or (f) GDPR. Our legitimate interest is the reliable processing of enquiries and the prevention of lost enquiries.

Contact enquiries and the associated technical backup logs are retained for as long as necessary to process the enquiry, document business communications and recover enquiries in the event of technical problems. They are then deleted unless statutory retention obligations, contractual requirements or legitimate grounds for establishing, exercising or defending legal claims require continued retention. Copies contained in backups remain until they are overwritten as part of the regular backup cycle.

4. Protection of the contact form with Cloudflare Turnstile

We use Cloudflare Turnstile to protect the contact form against automated submissions, spam and misuse. Turnstile evaluates technical signals from the browser environment. These may include the IP address, TLS fingerprint, user agent, site key and the corresponding source page. The result is sent to our server as a short-lived token. Our server sends this token to Cloudflare for verification.

Cloudflare processes these signals on our behalf to provide Turnstile and, according to Cloudflare, also under its own responsibility to improve bot detection. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is protecting the form and our systems and ensuring that enquiries originate from people. Further information is available in Cloudflare's Turnstile Privacy Addendum.

5. Consent management, language selection and cookies

We use our own consent management solution built into this website. No external consent management provider is used. Your consent selection is stored in the technically necessary cookie duna_cookie_consent, which is set by duna.digital. The cookie is host-only, is transmitted only over secure HTTPS connections (Secure) and is set with SameSite=Lax. It contains the version of the consent settings, the time of your selection and your choices for the available categories. The consent manager itself does not transmit any data to third parties.

If you explicitly choose German or English using the language switcher, we also store this choice in the technically necessary cookie duna_locale. It contains only the value de or en, is likewise host-only, set with Secure and SameSite=Lax, and stored for no longer than 365 days. Cloudflare reads this cookie when you open the home page so that your explicit choice takes precedence over the language preference transmitted by your browser. If you have not made an explicit choice, an English browser preference may take you to the English version on your first visit to the home page. Other pages are not redirected automatically.

The cookies are stored for no longer than 365 days. Their storage is necessary so that the website can reliably apply your consent and language choices without asking you again on every visit. The legal bases are Article 6(1)(c) GDPR for compliance with statutory record-keeping obligations and Article 6(1)(f) GDPR for the reliable and user-friendly operation of the website. The technically necessary cookies are set and accessed on the basis of Section 25(2)(2) TDDDG.

Strictly necessary functions are always active. Optional categories are enabled only in accordance with your selection. You can change your consent selection or withdraw it with effect for the future at any time through the “Cookie settings” link in the footer. You can change your language choice through the language switcher. If you delete the cookies in your browser, the relevant settings will be determined or requested again on your next visit. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

6. Google Analytics 4

If you explicitly consent to the “Analytics” category, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics is completely blocked before you consent. Without consent, the Google library is not loaded and neither data nor consent signals are transmitted to Google.

After you consent, Google Analytics processes page views, session data, approximate location, and browser and device information in particular. Google uses the first-party cookies _ga and _ga_<identifier> for this purpose. We technically limit their lifetime to no more than 365 days from the time they are first set and disable Google Signals and personalised advertising features. Our own events do not transmit names, email addresses, telephone numbers, message content or other directly identifying information.

For access from the European Union, Switzerland or the United Kingdom, Google states that the IP address is used only to derive an approximate location and is discarded before logging. Further processing by Google LLC and other Google group companies in the United States is possible. Google states that such transfers rely, among other safeguards, on the EU-US Data Privacy Framework and, where required, Standard Contractual Clauses. Further information is available in the Google information on data and privacy in Europe and the Google Privacy Policy.

The legal basis for this processing is your consent under Article 6(1)(a) GDPR. Analytics cookies are stored and accessed on the basis of Section 25(1) TDDDG. You can withdraw your consent with effect for the future at any time through the “Cookie settings” link in the footer. When you withdraw consent, we remove the cookies belonging to this category and reload the page without Google Analytics. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

7. Recipients and international data transfers

Within Duna Digital GmbH, access to personal data is restricted to people who require it to process your enquiry or operate the website. We also use carefully selected technical service providers for hosting, website security, contact form protection and email delivery, in particular Cloudflare and Resend. If you consent to analytics, Google Ireland Limited also receives the analytics data described in section 6. The providers process data only to the extent required and on the basis of the applicable agreements. We do not use an external consent management provider, Google Tag Manager or Google Ads.

For transfers to countries outside the European Union or the European Economic Area, we use recognised safeguards where required, such as an adequacy decision, the EU-US Data Privacy Framework or the European Commission Standard Contractual Clauses.

8. Your rights

Subject to the applicable statutory requirements, you have the following rights in particular:

access to the personal data we process about you,
rectification of inaccurate data or completion of incomplete data,
erasure of your data,
restriction of processing,
data portability,
withdrawal of consent with effect for the future,
objection to processing based on Article 6(1)(e) or (f) GDPR.

Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

To exercise your rights, send a message to [email protected].

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59-61, 10555 Berlin, Germany, email: [email protected].

9. Encryption and security

This website uses TLS encryption. We take appropriate technical and organisational measures to protect personal data against loss, manipulation and unauthorised access. However, completely risk-free data transmission over the internet cannot be guaranteed.

10. Updates to this Privacy Policy

We update this Privacy Policy when our website, the services we use or legal requirements change. The version published on this page at the relevant time applies.