Privacy policy
1. Controllers
This privacy policy explains which personal data we process when you visit clesea.com, for what purpose and on what legal basis, and which rights you have. Personal data is any information relating to an identified or identifiable natural person, such as a name, e-mail address, telephone number or IP address.
The controllers responsible for this website are:
CLESEA Service e.K., owner Manda Namegabe, Güterstraße 58, 54295 Trier, Germany, phone +49 651 99 18 90 90, e-mail info@clesea.com
CLESEA Service S.à r.l., 40-42 Grand-Rue, L-6630 Wasserbillig, Luxembourg, phone +352 20 60 22 63, e-mail info@clesea.lu
Both companies operate this website together and are joint controllers under Art. 26 GDPR. They have agreed who fulfils which obligations: CLESEA Service S.à r.l. handles enquiries from Luxembourg, CLESEA Service e.K. handles all others. CLESEA Service e.K. is responsible for the technical operation of the website and for providing the information in this privacy policy. You may exercise your rights against either company.
For any questions about data protection and to exercise your rights, please contact us at info@clesea.com or at the addresses above. We have not appointed a data protection officer, as the legal requirements for doing so are not met.
2. Legal bases
We process personal data in accordance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act, the German Telecommunications Digital Services Data Protection Act (TDDDG), the Luxembourg Act of 1 August 2018 implementing the GDPR and Article 4 of the amended Luxembourg Act of 30 May 2005 on specific provisions for the protection of individuals with regard to the processing of personal data in the electronic communications sector. Depending on the purpose, we rely on:
- Consent, Art. 6(1)(a) GDPR; for storing and accessing information on your device additionally § 25(1) TDDDG
- Contract or pre-contractual measures, Art. 6(1)(b) GDPR, for example when you enquire about our services
- Legal obligation, Art. 6(1)(c) GDPR, for example retention under commercial and tax law
- Legitimate interest, Art. 6(1)(f) GDPR, for example in the secure and reliable operation of the website
- Employment, Art. 6(1)(b) GDPR, for applications with a view to entering into an employment relationship
We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.
3. Hosting, server log files and encryption
The website is hosted by Mittwald CM Service GmbH & Co. KG, Königsberger Straße 4-6, 32339 Espelkamp, Germany. A data processing agreement under Art. 28 GDPR is in place with Mittwald.
Each time a page is accessed, the server automatically stores:
- the IP address of the accessing device
- the date and time of access
- the page accessed and the amount of data transferred
- the page you came from (referrer)
- browser, operating system and device type
We need this data to deliver the pages, find errors and defend against attacks. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR. We do not combine this data with other data sources. Log files are deleted in line with the host's rules, after 30 days at the latest, unless they are needed longer to investigate a security incident.
The website uses TLS encryption, recognisable by “https://” and the padlock symbol in the address bar. This protects the data you send us from being read by third parties.
4. Cookies and consent
Cookies are small text files stored by your browser. We set technically necessary cookies without consent, because the website would not work otherwise (§ 25(2) TDDDG, Art. 6(1)(f) GDPR). All other cookies and services are loaded only after you agree in the cookie banner.
To manage your consent we use the TYPO3 extension “Cookie Consent”, based on Klaro. It runs on our own server; no data is transferred to third parties. You can change or withdraw your choice at any time via the link “Customize privacy settings”. Withdrawal takes effect for the future only.
- clesea (entry in the browser's local storage, not a cookie): stores your choice in the cookie banner (necessary, 1 year)
- fe_typo_user: TYPO3 session identifier (necessary, end of session)
- _ga: distinguishes visitors for Google Analytics (consent only, 2 years)
- _ga_PYS4CSVX0S: stores the session state for Google Analytics (consent only, 2 years)
- _gcl_au: links enquiries to a click on a Google ad (consent only, 90 days)
You can also delete or block cookies in your browser. Some functions of the website may then not work.
Fonts: The fonts used on this website are stored on our own server. No connection is made to Google or other font providers.
5. Contact, forms and applications
Contact by e-mail or phone. When you write to us or call us, we process your details to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry concerns our services, otherwise our legitimate interest in answering it under Art. 6(1)(f) GDPR.
Call-back service and quotation request. These forms ask for your name, contact details and information about the job you need. Mandatory fields are marked. Without the information in the mandatory fields we cannot call you back or prepare a quotation; you are not legally or contractually obliged to provide it. We use the data to call you back or to prepare a quotation, under Art. 6(1)(b) GDPR. Your details are sent to our office by e-mail. We only pass them on to third parties where this is necessary for your job, for example to a subcontractor who carries out part of the work.
Applications. Through the application form or by e-mail we receive your contact details, your CV and any other documents you send us. We use them solely for the application process, under Art. 6(1)(b) GDPR. Only the people deciding on the hiring have access. If no employment relationship results, we delete your documents twelve months after the end of the process, so that we can defend ourselves against possible discrimination claims, in Germany for example under the General Equal Treatment Act (Art. 6(1)(f) GDPR). With your consent, we keep them longer in order to contact you about suitable vacancies (Art. 6(1)(a) GDPR).
E-mail service. Our e-mails are also handled via Mittwald servers, see section 3.
6. Google Analytics and Google Ads
Both services load only if you agree in the cookie banner. Without your consent, no connection to Google is established. Both services are loaded via Google Tag Manager, a Google tool we use to manage measurement on our website; it does not set any cookies of its own.
Provider. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). For Google Analytics, a data processing agreement under Art. 28 GDPR is in place with Google. Where Google processes the data for Google Ads, Google acts as an independent controller.
Google Analytics 4. We use Google Analytics to understand how our website is used: which pages are viewed, for how long, how visitors arrive and whether they submit a form or click a phone number. This involves device and browser information, approximate location at country and region level, and a random identifier stored in a cookie. Google Analytics 4 does not store full IP addresses. The data is deleted after 14 months. We have switched off personalised advertising based on this data, as well as the sharing of data for Google's own purposes, except for technical support.
Conversion measurement for Google Ads. We advertise on Google. To measure whether a visit from an ad leads to an enquiry, Google Analytics passes these events to our Google Ads account. We only see aggregated figures, such as how many enquiries an ad produced, and no information that identifies you personally.
Legal basis and withdrawal. Your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw it at any time via “Customize privacy settings”; processing carried out before withdrawal remains lawful.
Transfer to the USA. Google may transfer data to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR).
More information: Google's Privacy Policy, https://policies.google.com/privacy, and “How Google uses information from sites”, https://policies.google.com/technologies/partner-sites
7. Links to social networks
Our website links to our pages on Facebook and LinkedIn. These are plain links; no data is transferred to these networks when you visit our website. Only when you click a link does the privacy policy of the respective network apply.
8. Recipients and retention
Your data is only received by those who need it for the respective purpose: our office staff, our service provider Mittwald (hosting and e-mail) as processor, Google only with your consent, partly as a processor and partly as an independent controller (see section 6), subcontractors only for your job, and public authorities where we are legally obliged.
We store personal data only as long as necessary for the respective purpose. Enquiries that do not lead to an order are deleted after twelve months. Data from orders is kept as long as required by commercial and tax law, usually six to ten years. Retention periods for log files, applications and Google Analytics are stated in the respective sections.
9. Your rights
You have the right to:
- access your stored data (Art. 15 GDPR)
- rectification of inaccurate data (Art. 16 GDPR)
- erasure (Art. 17 GDPR)
- restriction of processing (Art. 18 GDPR)
- data portability (Art. 20 GDPR)
- withdraw consent with effect for the future (Art. 7(3) GDPR)
Right to object under Art. 21 GDPR. Where we process your data on the basis of our legitimate interest, you may object at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
For any request, an informal message to info@clesea.com is sufficient.
10. Right to lodge a complaint
You may lodge a complaint with any data protection supervisory authority, in particular in the place of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR). The authorities responsible for us are:
- for CLESEA Service e.K.: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz, Germany, www.datenschutz.rlp.de
- for CLESEA Service S.à r.l.: Commission nationale pour la protection des données (CNPD), 15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg, cnpd.public.lu
11. Changes
We update this privacy policy when our website or the legal situation changes. The version published here applies.
Last updated: October 2026