Privacy Notice
1. Controller
Blue Shades GmbH
Carl-Becker-Straße 9
40764 Langenfeld
Germany
Managing Director: Tim Faulhammer
Email: hello@blueshades.eu
2. Hosting and provision of the website
This website is provided through Microsoft Azure Static Web Apps. Our contractual partner and processor is:
Microsoft Ireland Operations Limited
One Microsoft Place
South County Business Park
Leopardstown
Dublin 18
Ireland
The Azure resource is configured in the “West Europe” region in the Netherlands. Azure Static Web Apps uses a globally distributed technical infrastructure to deliver static content.
When you access the website, technically necessary connection data is processed. This may include, in particular, the IP address of the accessing device, the date and time of access, the page or file requested, the volume of data transferred, browser type and version, operating system, referrer information, and status or error codes.
This processing is necessary to deliver the website, maintain its stability and security, and detect technical faults and abusive access. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure, stable and economically efficient provision of our website.
Blue Shades GmbH does not use its own analytics tools and does not perform user-related analysis of access data. Microsoft processes technical operational and access data under the agreed data processing terms. The data is retained only for as long as necessary for technical operation, security, and compliance with legal or contractual obligations.
3. International data transfers
We have entered into a data processing agreement with Microsoft based on the Microsoft Products and Services Data Protection Addendum.
Although the Azure resource is configured in the “West Europe” region, certain technical processing, network transfers or support access outside the European Economic Area cannot be fully excluded for globally operated cloud services.
Where personal data is transferred to countries outside the European Economic Area, this is based on an applicable adequacy decision of the European Commission or appropriate safeguards pursuant to Article 46 GDPR, in particular the EU Standard Contractual Clauses included in the Microsoft Data Protection Addendum.
Further information is available in the Microsoft Products and Services Data Protection Addendum and the information about the Microsoft EU Data Boundary.
4. Contact by email
If you contact us by email, we process only the data you provide in order to handle your enquiry. This may include your name, email address, company and role, other contact details, and the content, attachments and history of the correspondence.
Processing is carried out to take steps at your request prior to entering into a contract or to perform a contract under Article 6(1)(b) GDPR. Other business enquiries are processed under Article 6(1)(f) GDPR. Our legitimate interest is handling and responding to business enquiries.
Providing this information is neither legally nor generally contractually required. Without sufficient contact information, however, we may be unable to respond to your enquiry.
We use Microsoft 365 / Exchange Online for email communication. Our contractual partner and processor is Microsoft Ireland Operations Limited. Mailbox content at rest is stored in Germany in accordance with the data region configured for our tenant.
We use the submitted data solely to handle your enquiry and any resulting business relationship. Enquiries that are not subject to retention obligations are deleted after they have been fully dealt with, provided there is no legitimate interest in continued storage.
If correspondence qualifies as a commercial or business letter or as a document relevant for tax purposes, it is retained for the applicable statutory period. In particular, these periods are six years for commercial and business correspondence and eight years for accounting records. Longer periods may apply in individual cases under other laws or where necessary to establish, exercise or defend legal claims.
5. LinkedIn
Our website contains a simple link to a LinkedIn profile. No LinkedIn plugins, analytics pixels or embedded LinkedIn content are loaded. Merely visiting our website therefore does not establish a connection to LinkedIn through this link.
Only when you click the link do you leave our website. LinkedIn then processes data under its own responsibility. According to LinkedIn, LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland is generally responsible for users in the European Economic Area.
Information about LinkedIn’s processing is available in the LinkedIn Privacy Policy.
If you contact us through LinkedIn, we process the information you provide solely to handle your enquiry. Depending on the content of the enquiry, the legal basis is Article 6(1)(b) or (f) GDPR.
6. Local storage of your language preference
The website may store your selected language in your browser’s local storage under the key “blueShadesLanguage”. Only the value “de” or “en” is stored. No individual user identifier is created.
The storage is used to preserve the language you expressly selected when moving between pages. It takes place only after you actively choose a language. The legal basis for storing or accessing this information is Section 25(2)(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG).
The preference remains stored until it is overwritten by another language selection or deleted by you from your browser data.
7. Cookies and analytics
This website currently does not use cookies, analytics tools, advertising trackers, marketing technologies, social-media plugins, embedded videos or maps, or externally loaded fonts.
As no cookies or comparable technologies requiring consent are used, no consent banner is displayed. If the website is extended in the future to include services requiring consent, those services will be activated only after the relevant consent has been obtained.
8. Recipients
Where necessary for the relevant purpose, personal data may be disclosed to the following recipients or categories of recipients:
- Microsoft Ireland Operations Limited and the subprocessors used in accordance with the Microsoft Data Protection Addendum,
- public authorities and courts where disclosure is required by law.
Data is not disclosed for advertising purposes.
9. Retention periods
We retain personal data only for as long as necessary for the relevant processing purpose. It is then deleted unless statutory retention obligations, an ongoing contractual relationship, or legitimate interests in establishing, exercising or defending legal claims require continued storage.
10. Your rights
Where the legal requirements are met, you have the following rights in particular:
- right of access under Article 15 GDPR,
- right to rectification under Article 16 GDPR,
- right to erasure under Article 17 GDPR,
- right to restriction of processing under Article 18 GDPR,
- right to data portability under Article 20 GDPR,
- right to object under Article 21 GDPR.
To exercise your rights, please contact hello@blueshades.eu.
11. Right to object
Where we process personal data on the basis of Article 6(1)(f) GDPR, you have the right to object to that processing at any time on grounds relating to your particular situation.
We will then no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing is necessary to establish, exercise or defend legal claims.
12. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority. The authority generally responsible for Blue Shades GmbH is:
State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia
Postfach 20 04 44
40102 Düsseldorf
Germany
Contact the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia
You may also contact any other supervisory authority competent under Article 77 GDPR.
13. Automated decision-making and profiling
No automated decision-making, including profiling within the meaning of Article 22 GDPR, takes place in connection with this website.
14. Updates to this privacy notice
We update this privacy notice if the website, the service providers used, the processing activities or the applicable legal requirements change.
Last updated: August 2026