PRIVACY POLICY
Last updated: October 13, 2026
Thank you for visiting. This privacy policy explains which personal data we process when you visit legendsone-alliance.com, why we do so, on which legal basis and what rights you have. Personal data is any information that can be used to identify you personally, such as your name, email address or IP address.
1. Controller
The controller responsible for data processing on this website is:
LegendsOne Alliance AG
Unterschweinstiege 2-14
60549 Frankfurt am Main
Germany
Represented by: Boris Staab (Spokesman of the Executive Board), Jürgen Pütz (Executive Board)
Email: contact@legendsone-alliance.com
Phone: +49 (0)69 95 50 76 811
For any questions about data protection, please contact us using the details above.
2. Hosting and server log files
This website is hosted by Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, on servers located in Germany. We have concluded a data processing agreement with Hetzner pursuant to Art. 28 GDPR.
When you access the website, your browser automatically transmits data to our server. The following information is stored in server log files:
- IP address of the requesting device
- date and time of access
- page or file accessed
- amount of data transferred and whether the request was successful
- browser type and version and operating system
- referrer URL (the previously visited page)
We need this data to deliver the website securely and reliably and to detect attacks or misuse. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR. Log files are deleted after 7 days at the latest unless they are required to investigate a specific security incident. This data is not combined with other data.
3. Cookies and fonts
We do not use cookies for analytics, tracking or advertising. On pages with a form we only set two strictly necessary cookies:
- CRAFT_CSRF_TOKEN: protects our forms against abusive, forged submissions (security cookie)
- PHPSESSID: technical session identifier required to submit the form
Both cookies are deleted when you close your browser. They are strictly necessary for the forms to work and are therefore set without consent (Section 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR). You can delete or block cookies in your browser at any time; the forms may then not work.
All fonts are loaded directly from our own server. There is no connection to Google Fonts or any other provider.
4. Contact by email or phone
If you contact us by email or phone, we process the information you provide, usually your name, contact details and the content of your message, in order to respond to your request. The legal basis is Art. 6(1)(b) GDPR where your request relates to a contract or pre-contractual steps, and otherwise our legitimate interest in responding to enquiries under Art. 6(1)(f) GDPR.
Our mailbox is provided by Microsoft 365 of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, under a data processing agreement. A transfer to the USA cannot be ruled out. Microsoft is certified under the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR).
We delete your request once it has been fully dealt with, unless statutory retention obligations (for example under commercial or tax law) apply.
5. Contact form and magazine request
We offer two forms on our website:
- Contact form (“Kontakt” page): first name, last name, email address and message are required; the phone number is optional.
- “Magazin anfordern” form (home page): first name, last name and email address are required.
We need the required information to process your request or to send you the magazine. Without it we cannot deal with your request. We use your data solely for this purpose and not for advertising.
The legal basis is Art. 6(1)(b) GDPR (processing your request or fulfilling your order) and additionally our legitimate interest in responding to enquiries under Art. 6(1)(f) GDPR.
Your entries are stored in our content management system on our hosting provider’s servers (see section 2) and forwarded by email to our mailbox (see section 4). Your IP address is not stored. Entries stored in the system are deleted automatically after three years; emails are deleted once your request has been fully dealt with and no statutory retention obligations apply.
6. YouTube videos
On some pages we embed videos from YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Videos are only loaded when you click “Play video”. Before that, only a preview image from our own server is displayed and no data is transmitted to YouTube or Google. Only your click establishes a connection to YouTube, using the privacy-enhanced mode (youtube-nocookie.com). When you click, your IP address, information about your browser and the page you are visiting are transmitted to Google in particular. Google may also store cookies or similar technologies on your device. If you are logged in to a Google account, Google may associate the request with your account.
The legal basis is your consent, which you give by clicking “Play video” (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Your consent only applies to the respective video; the next time you visit the page, the video will again only load after another click. Data may be transferred to the USA. Google is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).
For more information, please see Google’s privacy policy: policies.google.com/privacy.
7. Redirect to the subscription platform
The buttons “Jetzt Anleihe zeichnen” and “Zum SPV-3” take you to the subscription platform at legends.ownity.com, which is technically operated by Ownity AG, Unterschweinstiege 2-14, 60549 Frankfurt am Main, Germany. Data is only transmitted to the platform once you click these links. Registration, subscription and all related data processing are governed by the privacy policy displayed on the platform.
8. Recipients and transfers to third countries
Within our company, your data is only accessible to those who need it to deal with your request. External recipients are exclusively the service providers named in this policy who act on our behalf, and public authorities where we are legally obliged to disclose data. We do not sell data and do not pass it on to third parties for advertising purposes. Transfers to countries outside the EU or EEA only take place in the cases described and only on the basis of an adequacy decision of the European Commission or appropriate safeguards.
9. Your rights
You have the right at any time to:
- access the data we hold about you (Art. 15 GDPR)
- rectification of inaccurate data (Art. 16 GDPR)
- erasure of your data (Art. 17 GDPR)
- restriction of processing (Art. 18 GDPR)
- data portability (Art. 20 GDPR)
- withdraw any consent given, with effect for the future (Art. 7(3) GDPR)
Simply contact us using the details above.
Right to object (Art. 21 GDPR): Where we process your data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims.
10. Right to lodge a complaint with a supervisory authority
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is:
Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (Hessian Commissioner for Data Protection and Freedom of Information)
Gustav-Stresemann-Ring 1
65189 Wiesbaden, Germany
datenschutz.hessen.de
11. Data security
This website is fully encrypted using SSL/TLS, which you can recognise by the “https://” in your browser’s address bar. We also protect your data through technical and organisational measures that we review regularly. Please note that unencrypted emails are not fully protected in transit.
12. No obligation to provide data, no automated decisions
You are not obliged to provide us with personal data. However, we cannot process a request without the information marked as required. We do not use automated decision-making, including profiling (Art. 22 GDPR).
13. Changes to this privacy policy
We update this privacy policy when our website, our service providers or the legal requirements change. The version published on this page applies.