1. Controller
LeoLan Digital, proprietor Kamaleddin Nazari, Reickerstrasse 132, 01237 Dresden, Germany; business@leolan.net; +49 351 21788680.
2. Website delivery
IP address, time, requested resource, referrer, browser and device data are processed to deliver the site securely and reliably (Article 6(1)(f) GDPR). The public website is served through GitHub Pages and protected and cached by Cloudflare.
3. Contact forms and demo chat
When you contact us, we process your name, contact details, hotel details and message to answer the enquiry or take pre-contract steps (Article 6(1)(b) or (f) GDPR). Forms and demo chat use a LeoLan-operated n8n installation hosted on Hetzner Online GmbH infrastructure. Demo messages may currently be sent to documented external AI providers, in particular OpenAI. Do not enter special-category personal data.
4. Consent and device storage
Necessary storage supports services you request. Analytics and marketing technologies load only after consent (Article 6(1)(a) GDPR and section 25(1) TDDDG). You can withdraw consent for the future through the cookie setting or by deleting the consent cookie.
5. Analytics and marketing
After consent, Google Analytics 4 (Google Ireland Limited) and Meta Pixel (Meta Platforms Ireland Limited) may measure usage and device information. Data may be transferred outside the EEA using adequacy decisions or standard contractual clauses where required. These scripts do not load without consent.
6. NOVA local primary storage
Operational NOVA application and contract data at rest are primarily stored in a local server and PostgreSQL environment operated and administered by LeoLan. Media may additionally be stored on LeoLan-operated locally connected network storage. This does not exclude transmissions for activated external functions.
7. NOVA recipients by function
Depending on booked and activated functions, data may be sent to Cloudflare (security/transport), Hetzner (workflow component hosting), OpenAI (external AI), Resend (transactional email), Meta Platforms/WhatsApp (communication), Stripe (payment), and PMS providers selected by the customer. Purpose, categories, location and legal basis for the concrete setup are documented before production use. n8n is self-hosted software in this setup and does not receive data merely because the software is used.
8. Planned local AI server and 95% target
A dedicated local AI server is planned as the future standard path for suitable AI functions. The target of at least 95% fully local AI processing cases per customer and calendar month applies only after documented commissioning, approval and measurement. This is currently neither a measured actual rate nor a guarantee. See the AI processing notice.
9. Processing for hotel customers
Where LeoLan processes guest or employee data on behalf of a hotel customer, the hotel is generally the controller and LeoLan the processor. Before processing starts, the parties agree a separate versioned DPA with security measures and a subprocessor list. The public pages are pre-contract information.
10. Retention
Enquiries are retained as long as needed for handling, follow-up and legal evidence. Contract and booking records follow statutory retention duties. Production customer data is deleted or returned under the contract, instructions and deletion plan.
11. Your rights
Subject to the GDPR, you can request access, rectification, erasure, restriction, portability and object to processing. Consent can be withdrawn for the future. Contact business@leolan.net.
12. Complaint and updates
You may complain to a data protection supervisory authority, including the Saxon Data Protection and Transparency Commissioner. This notice is updated when data flows or law change. Last updated 15 September 2026.