DEEN
Book a free consultation
Book a free consultation

Privacy Policy

Privacy Policy

Thank you for your interest in 24luna. Protecting your personal data matters to us. Below we explain which data is processed when you visit this website, for what purpose, on what legal basis, and what rights you have.

1. Controller

The controller responsible for data processing on this website is:

OPG One Productivity Group GmbH (24 Luna by OPG)
Strassburger Strasse 18
10405 Berlin
Germany

Represented by the managing directors Bernd Kopin and Patrick A. Lorenz.
Phone: +49 30 40361380
Email: info@opg.onl

2. Data protection officer

We have not appointed a data protection officer, as the statutory requirements for a mandatory appointment do not apply to us. For any questions about data protection, please contact us directly using the details given above.

3. Visiting the website and hosting

This website is operated on servers of Hetzner Online GmbH, Industriestrasse 25, 91710 Gunzenhausen, Germany. The server is located in Germany and is operated and maintained on our behalf. Data processing agreements pursuant to Art. 28 GDPR are in place with the service providers involved.

When you access our pages, your browser transmits technically necessary data which the server logs briefly: IP address, date and time, the address requested, volume transferred, browser type and operating system. This processing is required to deliver the website, keep it running reliably and fend off attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in secure and uninterrupted operation. Logs are deleted regularly and are not combined with other data.

The connection to our website is encrypted (you can tell by the padlock symbol in your browser), so that third parties cannot read the transmitted data in transit.

4. Fonts and preview images

The fonts used on this website are stored on our own server. No connection to Google or any other font provider is established when you visit. We also serve the preview images of embedded videos from our own server, so that no connection to third parties is made before you give your consent.

5. Contact form

If you write to us using the form, we process the details you provide: name, company, email address and your message. We also record which page the enquiry was sent from, in which language, which page you came from (where your browser transmits this) and — where present — a campaign identifier from the address you used. We use this information solely to handle your enquiry and to get in touch with you.

The legal basis is Art. 6(1)(b) GDPR where the enquiry relates to a contract, and otherwise Art. 6(1)(f) GDPR based on our legitimate interest in responding to enquiries.

Storage and transfer: Your enquiry is first stored on our own server and then transferred to the work management system monday.com, which we use to handle enquiries. The provider is monday.com Ltd., 6 Yitzhak Sadeh St., Tel Aviv 6777506, Israel. The data in our account is stored on servers within the European Union; insofar as the provider processes data in Israel, an adequacy decision of the EU Commission confirms that Israel offers a level of data protection comparable to the EU. We have concluded a data processing agreement with the provider. Within our company, the staff responsible for enquiries are notified when a new enquiry arrives.

Protection against abuse: To fend off automated bulk submissions, we check how many enquiries arrive from the same IP address in quick succession. For this purpose the IP address is held only briefly in memory, is not stored permanently and is not linked to your enquiry. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in preventing abuse.

6. Contact by email or phone

If you contact us by email or phone, we process your details in order to deal with your request. The legal basis is Art. 6(1)(b) GDPR where a contract is concerned, and otherwise Art. 6(1)(f) GDPR. Please note that unencrypted emails can be read by third parties in transit.

7. Appointment booking via Calendly (loaded only after your consent)

On this website you can book an appointment with us via an embedded calendar. The calendar is not loaded automatically. You first see a notice with a button. As long as you do not press it, no connection to the provider is established.

After you click, the calendar of Calendly LLC, 271 17th Street NW, 10th Floor, Atlanta, Georgia 30363, USA is loaded. Your IP address, browser data and the page you are on are transmitted to Calendly, and Calendly sets its own cookies. In the course of this, further services are technically embedded which Calendly uses for operation, abuse prevention and payment processing — including Google reCAPTCHA and Google account services (Google Ireland Limited or Google LLC) as well as Stripe (Stripe, Inc.). If you book an appointment, Calendly additionally processes the data you enter there (name, email address, chosen time slot, optional details) and passes it on to us.

Calendly is certified under the EU-US Data Privacy Framework; the EU Commission’s standard contractual clauses apply in addition. Nevertheless, it cannot be ruled out that US authorities access data transferred to the USA.

The sole legal basis for loading the calendar is your consent under Art. 6(1)(a) GDPR and Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG). You may withdraw your consent at any time with effect for the future by reloading the page and not pressing the button again; cookies already set can be deleted via your browser settings.

8. YouTube videos (loaded only after your consent)

This website embeds videos from YouTube. These are likewise not loaded automatically; until you click, you only see a preview image served from our own server.

After you click, the YouTube player (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) is loaded in privacy-enhanced mode. In this mode, according to YouTube, no information about visitors is stored before the video is played. When you play the video, your IP address and device information are transmitted to Google; if you are signed in to your Google account, Google may associate the playback with your account. A transfer to Google LLC in the USA may take place; Google LLC is certified under the EU-US Data Privacy Framework.

The sole legal basis for loading the player is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Withdrawal works as described in section 7.

9. Cookies

During a normal visit to this website we set no cookies and store no information on your device. That is why there is no cookie banner here: there is nothing you would need to consent to.

Two exceptions, both of which arise only through your own action:

  • The services named in sections 7 and 8 set their own cookies after your explicit consent, over which we have no influence.
  • In the access-protected editorial area, which is used only by our staff, a technically necessary cookie is set after signing in that keeps the session alive (Section 25(2) TDDDG). Visitors to the website are not affected.

10. Analytics, tracking and advertising

We ourselves use no services for audience measurement, tracking or advertising. During a normal visit to this website no usage profile is created of you, your visit is not tracked across websites, and no connection to third parties is established.

This changes as soon as you load the appointment calendar yourself via the button (section 7). Inside the Calendly frame, further services are then loaded whose selection we do not control. In a measurement taken on 27 August 2026, the scripts of the following providers were loaded:

  • Calendly (calendly.com, assets.calendly.com, dfp.calendly.com) – calendar operation and abuse prevention
  • Google reCAPTCHA and Google account sign-in (recaptcha.net, gstatic.com, accounts.google.com)
  • Google Analytics and Google Tag Manager (google-analytics.com, googletagmanager.com) – audience measurement
  • Segment (cdn.segment.io) – collecting and forwarding usage data
  • Amplitude (loaded via cdn.segment.io) – product and usage analytics
  • Meta/Facebook pixel (connect.facebook.net) – reach and advertising measurement
  • Braze (js.appboycdn.com) – customer communication
  • Sprig (cdn.sprig.com, api.sprig.com) – usage surveys
  • Stripe (js.stripe.com, m.stripe.com, m.stripe.network) – payment processing and fraud detection; sets its own cookie
  • Airbrake (notifier-configs.airbrake.io) – error logging

These services belong to Calendly's calendar, not to our website. We receive no analyses from them and build no usage profile of you. The extent to which the providers named process data for their own purposes is governed by the terms of Calendly and of the respective providers.

The sole legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. As long as you do not press the button, none of this is loaded. If you would rather avoid it, use the contact form instead of the calendar, or send us an email.

11. Links to third-party offerings

This website contains links to third-party offerings, such as our profiles on LinkedIn and YouTube, the careers portal of the One Productivity Group and the registration pages of external event organisers. These are plain links; simply visiting our pages transmits no data to these providers. If you follow a link, the privacy notice of the respective provider applies. Job applications are handled exclusively via the careers portal, where we provide separate information on the processing of applicant data.

12. Recipients and transfers to third countries

Your data is passed on only to the parties named in this policy, or where we are legally obliged to do so. In summary:

  • Hosting and server operation: service providers in Germany, acting on our behalf and on our instructions.
  • Handling of enquiries: monday.com Ltd. (servers in the EU; Israel covered by an adequacy decision).
  • Only after your consent: Calendly LLC (USA) and Google/YouTube (Ireland, USA) — each certified under the EU-US Data Privacy Framework or covered by standard contractual clauses.
  • Only after your consent and only inside the calendar frame: the further providers named in section 10 (Segment, Meta, Braze, Sprig, Stripe, Airbrake), some of them processing data in the USA.

13. Retention

We store personal data only for as long as necessary for the purposes described or as required by statutory retention periods. Enquiries via the contact form and by email are deleted once they have been dealt with conclusively and no retention obligations apply. If a contract is concluded, the commercial and tax retention periods of six or ten years apply. Server logs are deleted regularly.

14. Your rights

You have the following rights with regard to the personal data concerning you:

  • right of access (Art. 15 GDPR),
  • right to rectification (Art. 16 GDPR),
  • right to erasure (Art. 17 GDPR),
  • right to restriction of processing (Art. 18 GDPR),
  • right to data portability (Art. 20 GDPR),
  • right to withdraw any consent given at any time with effect for the future (Art. 7(3) GDPR).

Right to object: Where we process your data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

To exercise your rights, an informal message to the contact details given in section 1 is sufficient.

15. Right to lodge a complaint with a supervisory authority

Irrespective of the rights above, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or the place of the alleged infringement. The supervisory authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, Germany.

16. No automated decision-making, no obligation to provide data

We make no decisions based solely on automated processing and carry out no profiling. You are neither legally nor contractually obliged to provide us with personal data. Without your contact details, however, we cannot respond to an enquiry.

17. Changes to this privacy policy

We update this policy whenever the website or the legal situation changes. The version published here applies.

Last updated: August 2026