Privacy Policy

Last updated: 8 October 2026

1. Controller

The controller responsible for the processing of personal data in connection with this website, the Foundora Client Portal and the services described in this Privacy Policy is:

Foundora Digital Agency

Inhaber: Maximilian Lücking

Blumlage 122

29221 Celle

Deutschland

Email: privacy@foundora-digital.com

2. General Information on Data Processing

We take the protection of your personal data seriously. Personal data is any information relating to an identified or identifiable natural person.

We process personal data only where necessary to operate our website and digital systems, respond to inquiries, manage customer accounts and projects, provide our services, fulfil contractual or pre-contractual obligations, process payments, provide support, protect our systems or comply with legal obligations.

Depending on the respective processing activity, processing may in particular be based on:

Art. 6(1)(b) GDPR where processing is necessary for steps taken prior to entering into a contract or for the performance of a contract;
Art. 6(1)(c) GDPR where processing is necessary to comply with a legal obligation;
Art. 6(1)(f) GDPR where processing is necessary for our legitimate interests or those of a third party and such interests are not overridden by the interests or fundamental rights and freedoms of the data subject; or
Art. 6(1)(a) GDPR where we request consent for a specific processing activity.

3. Website Hosting and Server Log Files

This website and its technical infrastructure are hosted by IONOS.

When you access our website or online services, technical information may automatically be processed by the hosting infrastructure and stored in server log files. This may include, in particular:

IP address;
date and time of access;
requested page or file;
referrer URL;
browser type and version;
operating system;
hostname or device information; and
information relating to successful or unsuccessful requests.

The processing of this data is necessary to securely and reliably provide our website and digital services, ensure technical stability and detect or investigate technical problems, misuse and security incidents.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and technically reliable operation and protection of our website and digital infrastructure.

Hosting provider:

IONOS SE

Elgendorfer Straße 57

56410 Montabaur

Deutschland

4. IONOS WebAnalytics

We use IONOS WebAnalytics to obtain statistical information about the use of our website.

IONOS WebAnalytics may process information relating to website visits, such as pages viewed, referring websites, browser and device information and other technical usage data.

According to IONOS, WebAnalytics does not use cookies for visitor analysis. IP addresses are anonymised during processing so that individual visitors cannot be directly identified through the analytics data available to us.

The information is used to analyse website usage, improve our website and ensure the efficient operation of our online presence.

The processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in analysing and improving the performance and usability of our website.

Provider:

IONOS SE

Elgendorfer Straße 57

56410 Montabaur

Deutschland

5. WordPress, Elementor and Foundora Systems

Our website and Client Portal are operated using WordPress. Website and portal functionality is created or managed using WordPress, Elementor, Elementor Pro and internally developed functionality.

These systems are used to provide, display and operate our website, forms, Client Portal and related functionality.

Where personal data is processed through WordPress, Elementor or internally developed functionality, such processing is carried out only to the extent necessary for the respective purposes described in this Privacy Policy.

6. Locally Hosted Fonts

Our website uses fonts, including Inter and Figtree, which are stored locally within our website infrastructure.

The font files are delivered from our own website environment. No connection to Google servers is established solely for the purpose of loading these fonts and no personal data is transmitted to Google for this purpose.

7. Project Inquiry Form

You can contact us using the project inquiry form available on our website.

When you submit a project inquiry, we may process information including:

name;
business name;
email address;
telephone number, if provided;
existing website;
requested project type and scope;
industry;
required website features;
estimated budget;
desired launch timeframe;
domain and hosting information;
existing branding and website content;
additional information provided by you; and
files voluntarily uploaded by you.

We process this information for the purpose of reviewing your inquiry, communicating with you, assessing your project requirements and preparing or discussing a potential proposal.

Where your inquiry relates to entering into a contractual relationship with us, the legal basis is Art. 6(1)(b) GDPR.

Where processing is necessary for other legitimate business communication, processing may be based on Art. 6(1)(f) GDPR. Our legitimate interest lies in handling and responding to business inquiries.

Submission of a project inquiry does not by itself create a Client Portal account or contractual relationship.

8. Initial File Uploads

Our project inquiry form may allow you to upload files voluntarily.

Uploaded files are processed for the purpose of reviewing and handling your project inquiry.

Please do not upload unnecessary sensitive personal information or files containing personal data that is not required for your project inquiry.

The legal basis is generally Art. 6(1)(b) GDPR where files are provided in connection with steps taken prior to entering into a contract.

9. Storage of Form Submissions

Information submitted through our website may be stored within our WordPress installation through Elementor’s submission functionality and may also be transmitted to us by email.

We retain inquiry data only for as long as necessary to process the inquiry and any subsequent business relationship, unless statutory retention obligations or other legitimate grounds require longer storage.

If no contractual relationship is established, data that is no longer required will be deleted in accordance with applicable data protection and retention requirements.

10. Contact by Email

If you contact us by email, we process the information contained in your message, including your email address and any other information you voluntarily provide.

The purpose of processing is to respond to and handle your inquiry or communication.

If your communication concerns a potential or existing contractual relationship, the legal basis is Art. 6(1)(b) GDPR.

For other business-related communications, processing may be based on Art. 6(1)(f) GDPR. Our legitimate interest lies in responding to inquiries and conducting business communications.

10A. Free Website Audit and Personal Review

Foundora provides a publicly accessible automated website-analysis function (“Free Website Audit”). Users may submit a publicly accessible website URL in order to receive a limited technical assessment.

When the Free Website Audit is used, we may process in particular:

the website URL submitted for analysis;
technical information retrieved from the submitted website in connection with the audit;
audit results and technical indicators generated from the analysis;
date and time of the audit request;
technical request, security and misuse-prevention information, which may include the IP address and related server-log information; and
information necessary to operate, secure and troubleshoot the audit function.

The submitted website URL and the technical information retrieved from it are processed for the purpose of carrying out the requested analysis, displaying the audit result and protecting the audit infrastructure against misuse, malicious requests and technical disruption.

Where the Free Website Audit is requested by the user as a website function, processing necessary to provide that requested function may be based on Art. 6(1)(b) GDPR where applicable. Processing necessary for technical security, misuse prevention, troubleshooting and protection of our systems is based on Art. 6(1)(f) GDPR. Our legitimate interests lie in providing a secure and reliable audit function and protecting our website and infrastructure.

The Free Website Audit does not require the user to provide their name or email address merely to run the initial automated audit.

Following a completed audit, users may voluntarily request a Free Personal Review. In connection with such a request, we may additionally process:

name;
email address;
the website URL submitted for review;
the previously generated audit result;
information voluntarily provided in the review request; and
internal analysis, notes, assessments, reports or PDF documents created by Foundora in connection with reviewing the website and evaluating a possible project.

This information is processed to handle the requested Personal Review, communicate with the requester, assess the website in greater detail and evaluate whether Foundora may be able to assist with a potential project.

Where the Personal Review is requested with a view to a possible business relationship, processing may be based on Art. 6(1)(b) GDPR. Where processing is necessary for handling legitimate business inquiries, documenting the review, preventing misuse or efficiently evaluating potential projects, processing may also be based on Art. 6(1)(f) GDPR. Our legitimate interests lie in responding to requested reviews, evaluating potential customer projects, maintaining reliable business processes and protecting the audit service against misuse.

Requesting a Free Personal Review does not create a contractual relationship and does not require the requester to purchase services.

Audit and review information is retained only for as long as necessary for the respective analysis, review, communication, security and business-inquiry purposes, unless statutory obligations or other legitimate grounds require longer retention. Data that is no longer required will be deleted or anonymised where appropriate.

The audit function may technically access the submitted public website in order to retrieve information necessary for the requested analysis. Users should therefore submit only website URLs that may lawfully be analysed and should not enter passwords, access credentials or other confidential information into the audit URL field.

11. Foundora Client Portal

Foundora provides authorised customers with access to a password-protected online customer area (“Client Portal”).

The Client Portal is operated within Foundora’s WordPress environment and is used to manage and communicate information relating to the customer relationship and individual projects.

Depending on the customer and project, the Client Portal may provide access to:

project information;
project status and progress;
project dates and updates;
proposals;
proposal acceptance;
invoices and payment-status information;
project files and uploads;
Care Plan information;
support requests and tickets;
project-related messages and notifications; and
customer account information.

Personal data processed through the Client Portal may include:

name and business information;
business email address and contact information;
customer and account identifiers;
project information;
proposal and contract information;
proposal acceptance information;
invoice and payment-status information;
project files;
support messages and attachments;
Care Plan and subscription information; and
technical information required for operation and security of the portal.

Where processing is necessary to establish, administer or perform a contractual relationship, the legal basis is Art. 6(1)(b) GDPR.

Processing necessary for the secure operation, administration and protection of the Client Portal may also be based on Art. 6(1)(f) GDPR. Our legitimate interests include operating a secure customer-management environment, protecting customer accounts and documenting business processes.

12. Client Portal Accounts and Login

Client Portal accounts are not automatically created when an initial project inquiry is submitted.

Where appropriate, Foundora may create a customer account following qualification of an inquiry or in connection with preparing or providing a proposal.

For account creation and administration, we may process:

name;
business name;
email address;
account identifier;
account status;
login-related information; and
information required to associate the account with the respective customer or project.

Authentication information is processed for the purpose of restricting access to authorised users.

Depending on the technical configuration of WordPress and the Client Portal, technical information such as login events, IP addresses or security-related log information may also be processed where necessary for authentication, troubleshooting, prevention of misuse and system security.

The legal basis for customer-account processing is generally Art. 6(1)(b) GDPR.

Security-related processing may additionally be based on Art. 6(1)(f) GDPR. Our legitimate interest lies in preventing unauthorised access and protecting our systems, customers and business information.

Passwords are not intended to be available to Foundora in plain text.

13. Proposals and Electronic Acceptance

Individual proposals may be made available to customers through the Client Portal.

In connection with the creation, provision and acceptance of a proposal, we may process:

customer and business information;
project information;
proposal contents;
pricing and service information;
proposal status;
date and time of acceptance;
customer or account identifier; and
technical transaction information where required to document the acceptance process.

This information is processed for the purpose of preparing proposals, concluding and administering contractual relationships and documenting whether and when a proposal was accepted.

The legal basis is Art. 6(1)(b) GDPR.

Where certain information must be retained for evidentiary purposes or to establish, exercise or defend legal claims, processing may also be based on Art. 6(1)(f) GDPR or applicable statutory obligations.

14. Project Management and Project Status

The Client Portal may display project stages, progress, project dates, updates, required actions and other project-management information.

For this purpose, we process information relating to:

the customer;
the relevant project;
agreed services;
project milestones;
project progress;
customer actions or approvals;
project updates; and
related administrative information.

Processing is necessary to organise, administer and perform the respective project.

The legal basis is Art. 6(1)(b) GDPR.

15. Foundora Desk

Foundora uses an internally developed administrative environment referred to as Foundora Desk to manage customer relationships, projects and related business processes.

Foundora Desk operates entirely within Foundora’s WordPress environment and is not a separate external platform or external service provider.

Depending on the respective customer relationship, Foundora Desk may be used to manage information relating to:

customers and contact persons;
project inquiries;
customer accounts;
projects and project stages;
proposals and proposal status;
proposal acceptance;
invoices and payment status;
project files;
Care Plans;
support tickets;
communications and notifications; and
internal administrative information necessary to manage the customer relationship.

Information may be exchanged between Foundora Desk and the Client Portal where required to provide portal functionality and administer customer projects.

Processing necessary for pre-contractual measures or performance of a customer contract is based on Art. 6(1)(b) GDPR.

Processing relating to internal organisation, documentation, system security and efficient administration may also be based on Art. 6(1)(f) GDPR. Our legitimate interests include efficient business administration, reliable project management, documentation of business processes and protection of our systems.

16. Automated Email Workflows with Make

Foundora uses Make for selected automation workflows relating to transactional and administrative email notifications.

Depending on the respective workflow, personal data transmitted to or processed through Make may include:

name;
business name;
email address;
customer or project identifier;
notification type;
relevant project, proposal, invoice, payment, file, Care Plan or support status information; and
other information necessary to generate or trigger the respective transactional notification.

Make is used by Foundora to automate the technical workflow for such communications. Foundora does not use Make to independently determine whether a proposal is accepted, whether a payment has been made or to make other contractual decisions concerning customers.

Automated emails may, for example, be triggered in connection with:

new proposals;
proposal acceptance;
project updates;
invoices or payment updates;
files;
Care Plans; or
support activity.

Where processing is necessary for the performance or administration of a contractual relationship, the legal basis is Art. 6(1)(b) GDPR.

Where processing serves efficient business administration and reliable communication with customers, processing may also be based on Art. 6(1)(f) GDPR.

Our legitimate interest lies in efficiently administering customer relationships and ensuring reliable transactional communication.

Make processes customer data as a service provider within the scope of its contractual data-processing arrangements.

Make is part of the Celonis group. Information regarding data protection for Make is provided by Celonis, including information concerning international data transfers and applicable safeguards.

Where personal data is transferred outside the European Economic Area, applicable safeguards may include adequacy decisions, the EU-U.S. Data Privacy Framework where applicable, or the European Commission’s Standard Contractual Clauses.

These workflows are not used by Foundora to make decisions based solely on automated processing that produce legal effects or similarly significantly affect individuals within the meaning of Art. 22 GDPR.

17. Portal File Uploads and Project Files

Customers may be able to upload or exchange files through the Client Portal.

Depending on the project, such files may include:

logos and brand assets;
images;
text and content;
project documents;
design materials;
technical files;
support attachments; and
other project-related materials.

Files are processed for the purpose for which they are submitted, including project implementation, review, communication, support or maintenance.

The legal basis is generally Art. 6(1)(b) GDPR.

Customers should avoid uploading personal data that is not necessary for the relevant project or support request and should not submit passwords, complete payment-card information or other unnecessary highly sensitive information through ordinary file uploads.

18. Support Tickets and Communications

Customers may submit support requests through the Client Portal.

Depending on the request, we may process:

customer and account information;
ticket number;
subject;
category;
urgency indication;
message content;
attachments;
ticket status;
replies;
timestamps; and
information relating to the relevant project or Care Plan.

We process this information to receive, manage, document and respond to support requests and to provide contractual support or maintenance services.

Where the support request relates to an existing contract or Care Plan, processing is based on Art. 6(1)(b) GDPR.

Where processing is necessary for general technical administration, security or documentation, processing may also be based on Art. 6(1)(f) GDPR.

19. Invoices and Payment Status in the Client Portal

The Client Portal may display invoice information and payment status relating to the customer.

For this purpose, we may process information such as:

customer and business information;
invoice number;
invoice date;
invoice amount;
payment status;
due date;
transaction reference; and
information necessary to associate a payment with the respective invoice or project.

This processing is used to administer the contractual relationship, provide customers with payment-status information and maintain accurate business records.

The legal basis is Art. 6(1)(b) GDPR.

Where invoice and accounting information must be retained to comply with legal obligations, processing is based on Art. 6(1)(c) GDPR.

20. Payment Processing with Stripe

We use Stripe to process online payments for our services, including individual project payments and recurring payments for Foundora Care Plans.

Depending on the selected payment method and circumstances of the transaction, Stripe may process personal data such as:

name;
email address;
billing address;
business name, where provided;
payment method and payment information;
transaction amount and currency;
transaction identifiers;
date and time of payment;
device and technical information; and
information used for fraud prevention, security and regulatory compliance.

Payment-card details and other sensitive payment credentials are generally entered directly into Stripe’s payment environment. We do not receive complete payment-card details from Stripe.

We process payment-related personal data where necessary to perform a contract pursuant to Art. 6(1)(b) GDPR.

Where processing is required to comply with statutory accounting, tax or other legal obligations, the legal basis is Art. 6(1)(c) GDPR.

Processing necessary for payment security, fraud prevention and protection of payment infrastructure may also be based on Art. 6(1)(f) GDPR.

Stripe may process certain personal data for its own purposes and on its own legal basis, including fraud prevention, security and compliance with financial and regulatory obligations.

Payment service provider:

Stripe Payments Europe, Limited

1 Grand Canal Street Lower

Grand Canal Dock

Dublin

Ireland

21. Care Plans and Subscription Management

Where a customer purchases or manages a Foundora Care Plan, we may process:

customer and business information;
selected Care Plan;
subscription status;
billing period;
subscription start or cancellation information;
payment status;
Stripe customer or subscription references; and
information required to provide the included maintenance and support services.

This information is processed for the purpose of establishing, administering, billing and providing the Care Plan.

The legal basis is Art. 6(1)(b) GDPR.

Where payment or accounting information must be retained by law, processing is based on Art. 6(1)(c) GDPR.

22. Invoicing and Accounting

We process customer, invoice, transaction and accounting information as necessary to issue invoices, record payments, maintain our accounts and comply with commercial and tax obligations.

For these purposes, we use Lexware for invoicing and accounting.

Depending on the respective transaction, information processed for these purposes may include:

name and business information;
billing and contact information;
invoice details;
services provided;
amounts and payment information;
transaction information; and
tax and accounting information.

The legal basis is Art. 6(1)(b) GDPR insofar as processing is required for contractual billing and Art. 6(1)(c) GDPR insofar as processing is required to comply with accounting, tax or other statutory obligations.

Personal data is transmitted to accounting or bookkeeping service providers only to the extent necessary for these purposes.

23. Electronic Notifications

Foundora may send transactional or administrative notifications relating to customer accounts, proposals, projects, invoices, payments, files, Care Plans or support activity.

These notifications may be generated automatically when a relevant event occurs within the Client Portal, Foundora Desk or an associated workflow.

Depending on the notification, we may process:

name;
email address;
customer or project identifier;
relevant event or status information; and
information required to generate and deliver the notification.

Where the notification is required for performance or administration of a contractual relationship, processing is based on Art. 6(1)(b) GDPR.

Other necessary administrative notifications may be based on Art. 6(1)(f) GDPR.

Transactional communications relating to an inquiry or existing customer relationship are separate from marketing communications.

24. Cookies, Login Technologies and Consent Management

Our website and Client Portal may use cookies or comparable browser technologies.

Some technologies are technically necessary to:

operate the website;
maintain secure login sessions;
authenticate Client Portal users;
maintain security functionality;
remember technical session information; or
provide functions expressly requested by the user.

Where storing information on or accessing information from a user’s device is strictly necessary to provide an expressly requested digital service, such technologies may be used without consent to the extent permitted by applicable law.

Where consent is legally required for a particular cookie or similar technology, that technology is only intended to be activated after the relevant consent has been provided.

We use Complianz to manage cookie and privacy preferences.

Complianz may store technically necessary information in your browser in order to remember your privacy choices and operate the consent mechanism.

Our current website configuration does not intentionally use advertising or marketing tracking cookies.

For detailed and up-to-date information about cookies and similar technologies used on our website, please refer to our separate Cookie Policy and the information available through our consent-management interface.

25. External Links and Social Media

Our website may contain links to external websites and social media platforms, such as Instagram.

If these are provided solely as external links, no content from the respective platform is embedded on our website through the link itself.

When you click such a link, you leave our website. The respective third-party provider is then responsible for the processing of personal data on its website or platform.

Please refer to the privacy information of the respective provider for further details.

26. Recipients and Service Providers

Where necessary for operation of our website and Client Portal, handling of inquiries, administration of customer relationships, performance of contracts, accounting, payment processing, communications and technical support, personal data may be processed by or disclosed to service providers.

Depending on the respective processing activity, categories of recipients may include:

hosting and infrastructure providers;
email providers;
website and technical service providers;
automation providers;
payment service providers;
accounting and invoicing providers;
consent-management providers;
professional advisers where necessary; and
other service providers required to provide or administer our services.

In particular:

IONOS SE may process personal data in connection with hosting, email and related infrastructure;
Stripe Payments Europe, Limited may process personal data in connection with payment and subscription processing;
Make / Celonis may process personal data where required for the automated processing of transactional email workflows; and
Lexware may process personal data in connection with invoicing and accounting.

Foundora Desk itself is not an external recipient. It operates within Foundora’s WordPress environment.

Where a service provider acts as a processor on our behalf, appropriate data-processing arrangements are concluded in accordance with Art. 28 GDPR where required.

Some providers may process personal data as independent controllers for particular purposes, especially where they are subject to their own statutory or regulatory obligations.

We do not sell personal data.

27. International Data Transfers

Some service providers used by us may process personal data outside Germany or the European Economic Area (EEA), or may engage affiliated companies or subprocessors located in other countries.

Where personal data is transferred outside the EEA, such transfers take place only where the requirements of applicable data protection law are met.

Depending on the respective recipient and destination country, this may include:

an adequacy decision of the European Commission;
participation in the EU-U.S. Data Privacy Framework where applicable;
the European Commission’s Standard Contractual Clauses; or
another legally recognised transfer mechanism.

In connection with Make, certain processing may involve entities or subprocessors outside the EEA. According to Make’s current privacy information, Celonis Inc. participates in the EU-U.S. Data Privacy Framework, and appropriate transfer mechanisms such as Standard Contractual Clauses are used for relevant transfers where required.

Further information regarding international transfers carried out by individual providers can be found in their respective privacy information.

28. Data Retention

We store personal data only for as long as necessary for the respective purpose or for as long as we are legally required or otherwise legally entitled to retain it.

The applicable retention period therefore depends on the category of information and the purpose for which it is processed.

In particular:

inquiry information is retained for as long as necessary to handle the inquiry and any resulting business relationship;
customer and project information may be retained for the duration of the contractual relationship and afterwards where required for documentation, legal claims or statutory obligations;
Client Portal account information may be retained while the account is required for the customer relationship and may subsequently be deleted, restricted or anonymised where appropriate;
project files and support information are retained for as long as reasonably required for the project, support relationship, documentation or applicable legal obligations;
proposal and acceptance information may be retained where necessary to document contractual agreements;
invoice, transaction and accounting information is retained in accordance with applicable statutory commercial and tax retention requirements;
automation data processed through service providers is retained in accordance with the relevant workflow requirements, contractual settings and applicable provider arrangements; and
technical and security information is retained only for as long as reasonably required for operation, troubleshooting, misuse prevention or security purposes, subject to applicable legal requirements.

Once the relevant purpose and any applicable legal retention period cease to apply, personal data will be deleted or anonymised where appropriate.

29. Your Rights under the GDPR

Subject to the applicable legal requirements, you have rights regarding your personal data, including:

the right of access under Art. 15 GDPR;
the right to rectification under Art. 16 GDPR;
the right to erasure under Art. 17 GDPR;
the right to restriction of processing under Art. 18 GDPR;
the right to data portability under Art. 20 GDPR;
the right to object under Art. 21 GDPR; and
the right to withdraw consent under Art. 7(3) GDPR where processing is based on consent.

Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

Where processing is based on Art. 6(1)(f) GDPR, you may have the right to object to such processing in accordance with Art. 21 GDPR.

To exercise your rights, contact:

privacy@foundora-digital.com

30. Right to Lodge a Complaint

You have the right to lodge a complaint with a competent data protection supervisory authority if you believe that the processing of your personal data infringes applicable data protection law.

You may in particular contact the supervisory authority responsible for your habitual residence, place of work or the place of the alleged infringement.

31. Security

We take appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Our website and Client Portal use encrypted HTTPS connections to protect information transmitted between your browser and our website.

Access to customer-specific areas is restricted through authentication mechanisms.

No internet-based system can provide absolute security. We therefore continuously consider appropriate technical and organisational measures in relation to the nature and risks of the processing.

32. Changes to this Privacy Policy

We may update this Privacy Policy where our website, Client Portal, Foundora Desk, business processes, service providers or legal requirements change.

The current version of this Privacy Policy is available on our website.

Last updated: 8 October 2026