OBELUS

Privacy notice

Information pursuant to Articles 13 and 14 GDPR: how OBELUS GmbH processes personal data on this website, and which rights you have.

On this page

This English text is a translation for your convenience. The German version is binding.

Last updated: 10 October 2026

1. Controller

The controller responsible for processing personal data on this website is:

OBELUS GmbH
Westerhamer Weg 30
82024 Taufkirchen
Germany

Represented by the Managing Director Tomas Langara
Phone: +49 8151 187 40 10
Email: tomas.langara@obelus.de

Data protection officer

As a rule, fewer than 20 people at OBELUS GmbH are constantly involved in the automated processing of personal data. We are therefore not required to appoint a data protection officer under Section 38 of the German Federal Data Protection Act (BDSG). Please send questions about data protection to the address above.

We process personal data only as far as is necessary for the purpose concerned, on these legal bases of the General Data Protection Regulation (GDPR):

  • Art. 6(1)(b) GDPR: to perform a contract or to take steps before entering into one, for example when you ask us for a quote;
  • Art. 6(1)(c) GDPR: to meet legal obligations, for example retention duties under commercial and tax law;
  • Art. 6(1)(f) GDPR: to pursue legitimate interests, for example the secure and reliable operation of this website and answering enquiries;
  • Art. 6(1)(a) GDPR: on the basis of your consent, where we ask for it in a particular case. You can withdraw consent at any time with effect for the future.

3. This website

3.1 Hosting

This website is hosted by Railway Corporation, 548 Market St PMB 68956, San Francisco, CA 94104, USA. The website’s servers, its database and its file storage are located in Railway’s EU West region (Amsterdam, Netherlands). Railway processes the data on our behalf as a processor (Art. 28 GDPR). As Railway is based in the USA, access from the USA cannot be ruled out; such transfers are covered by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

3.2 Server log files

Each time the website is called up, the hosting service automatically records technical data that your browser sends: IP address, date and time, the address requested, the HTTP status code, the amount of data transferred and the browser identification (user agent). We need these data to deliver the website, find errors and fend off attacks (Art. 6(1)(f) GDPR). The logs are not combined with other data and are deleted automatically after no more than 30 days.

3.3 Contact by form, email and telephone

On this website you can send us an enquiry through the contact form. We process what you enter: your name, your email address and your message, and, where you give them, your company, your phone number and the topic. Mandatory fields are marked with an asterisk; all other details are optional. We also record the language, the page on which you sent the form and the time.

We store your enquiry in this website’s database (Railway, EU West region) in order to handle and answer it. Only the staff of OBELUS GmbH who handle enquiries have access, as well as our processors within the scope of their tasks, for example for hosting and the technical support of the website.

The legal basis is Art. 6(1)(b) GDPR where your enquiry aims at a contract or at steps before a contract, and Art. 6(1)(f) GDPR otherwise; our legitimate interest is to answer your enquiry. We delete your enquiry once it has been dealt with in full and no further contact is expected. If a contract results from it, we keep the correspondence for as long as retention duties under commercial and tax law apply (usually 6 to 10 years).

3.4 Protecting the forms from misuse

To fend off automated mass submissions, our forms contain a check field that people do not see and a signed time stamp. We also limit the number of submissions per sender: for this we create a salted hash value from your IP address, keep it in working memory only and discard it after ten minutes at the latest. Your IP address itself is not stored in the process. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting the website from misuse.

Our forms also use Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, which checks whether a form is sent by a person. It is loaded only when you start to use a form. Cloudflare processes your IP address and technical characteristics of your browser and device, and may store or read information on your device for this purpose. This access is strictly necessary to send the form you asked to send (Section 25(2) No. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG). The legal basis for the processing is Art. 6(1)(f) GDPR; our legitimate interest is protection against automated submissions. Cloudflare takes part in the EU-U.S. Data Privacy Framework, so transfers to the USA rely on the adequacy decision of the European Commission (Art. 45 GDPR).

3.5 Cookies and storage on your device

This website sets no cookies for visitors and uses no analytics, tracking or marketing services, so no cookie banner is needed. We do not embed content from third parties such as videos, maps or social media plugins. For Cloudflare Turnstile on our forms, section 3.4 applies. Interactive elements may keep a setting you choose yourself, for example pausing an animation, in your browser’s local storage; this information stays on your device. The editing area of the website, used only by our staff, sets a technically necessary session cookie after sign-in.

3.6 Fonts

The fonts of this website are stored on our own server and loaded from there. Calling up the website creates no connection to Google Fonts or any other font provider.

This website links to mapperstudio.io, the website of Mapper Studio, our own product, and to the LinkedIn page of OBELUS GmbH. Data reach the provider concerned only when you follow a link; from then on, the privacy notices of the provider concerned apply. No content from these providers is embedded in our pages.

4. Your rights

Subject to the conditions of the GDPR, you have the right to:

  • access your personal data (Art. 15);
  • rectification of inaccurate data (Art. 16);
  • erasure (Art. 17);
  • restriction of processing (Art. 18);
  • data portability (Art. 20);
  • withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal (Art. 7(3)).

To exercise these rights, write to tomas.langara@obelus.de or to the address in section 1.

Right to object

Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). We then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for OBELUS GmbH is the Bayerisches Landesamt für Datenschutz­aufsicht (BayLDA), Promenade 27, 91522 Ansbach, Germany, www.lda.bayern.de.

5. Automated decision-making

We do not use your personal data for automated decision-making with legal or similarly significant effect within the meaning of Art. 22 GDPR.

6. Changes to this notice

We update this privacy notice whenever our website, our services or the legal situation change. The version published here applies to each visit.