100% data protection for your online surveys
LamaPoll is built for companies in Germany, Austria and Switzerland that take data protection and security seriously. We know how much the careful handling and protection of your personal data matters to you. GDPR-compliant data handling is central to everything we do, and it is one of the reasons we are a leading provider of secure online surveys.
Table of contents
- You keep full control of your data: all data you collect belongs to you alone, there are no interfaces to third-party providers, and only you can view, edit and permanently delete it at any time.
- LamaPoll processes data exclusively in Germany: all servers are located in Germany and are subject to German data protection and security law.
- Your data is secure: both our operations and our data centres hold independent TÜV certification to DIN ISO 27001.
- We guarantee you a GDPR-compliant data processing agreement
After a thorough market analysis, we chose LamaPoll. The reasons: a German company based in Berlin, German data protection law and German servers. Working with them has been completely smooth so far, both technically and organisationally. We are very satisfied and are happy to recommend LamaPoll.
Privacy policy for the use of the following websites
https://www.lamapoll.de, https://app.lamapoll.de, https://www.lamapoll.com
For all data protection matters, Mr Notev, our managing partner, is your contact. He can be reached by email at (support@lamapoll.de) and by post at (LamaPoll – Notev – Grünberger Str. 44 a – 10245 Berlin). We have also appointed a data protection officer, whom you can reach by email at (reg@lamapoll.de) and by post at (LamaPoll DSB – Grünberger Str. 44 a – 10245 Berlin).
Section 1 Information on the processing of personal data
a) Below we inform you about the processing of personal data when you use our websites whose web address begins with “https://www.lamapoll.de”, “https://app.lamapoll.de” or “https://www.lamapoll.com”, or with “http://www.lamapoll.de”, “http://app.lamapoll.de” or “http://www.lamapoll.com”.
b) Visits to other websites whose web address does contain the character string “lamapoll.de”, “lamapoll.com” or “sslsurvey.de”, but where “lamapoll.de” or “lamapoll.com” is not directly preceded by “www.” or “app.”, are not covered by this privacy policy. Those websites are governed by the separate privacy notices and statements provided there.
c) Personal data is all data that can be related to you personally, for example: name, address, email addresses, user behaviour. Processing means any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; see Art. 4 sentence 1 no. 4 of the EU General Data Protection Regulation (GDPR).
d) The controller pursuant to Art. 4(7) of the EU General Data Protection Regulation (GDPR) is Lamano GmbH & Co. KG, Grünberger Str. 44 a, 10245 Berlin, represented by its general partner Lamas GmbH, Grünberger Str. 44 a, 10245 Berlin, which in turn is represented by its managing partners Maik Maibaum and Stoyko Notev (see our legal notice).
Section 2 Your rights
a) You have the following rights against us with regard to the personal data concerning you:
- right of access,
- right to rectification or erasure,
- right to restriction of processing,
- right to object to processing,
- right to data portability.
b) You also have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data.
Section 3 Processing of personal data when you visit our websites
a) If you use our websites purely for information purposes, meaning that you do not submit any other information to us and only access our websites, we process only the personal data that your browser transmits to our server in connection with the page requests. When you view our websites, we process the following data, which is technically necessary for us to display our websites to you and to ensure the stability and security of our IT systems (the legal basis is Art. 6(1) sentence 1 lit. f GDPR):
- IP address
- date and time of the request
- time zone difference from Greenwich Mean Time (GMT)
- content of the request (specific page)
- access status/HTTP status code
- volume of data transferred in each case
- website from which the request originates
- browser
- operating system and its interface
- language and version of the browser software.
b) In addition to the data listed above, cookies are stored on your computer when you use our websites whose web address begins with “https://app.lamapoll”. Cookies are small text files that are stored on your hard drive and assigned to the browser you use, and through which certain information flows to the entity that sets the cookie (in this case, to us). Cookies cannot run programs or transfer viruses to your computer. They serve to make our online offering more user-friendly and effective overall.
c) Use of cookies:
Our websites whose web address begins with “https://app.lamapoll” currently use the following types of cookies, the scope and function of which are explained below:
- transient cookies
- persistent cookies
Transient cookies are deleted automatically when you close your browser. This applies in particular to session cookies. These store a session ID, which allows different requests from your browser to be assigned to the shared session. This means your computer can be recognised when you return to our website. Session cookies are deleted when you log out or close your browser.
Persistent cookies are deleted automatically after a set period, which can vary from cookie to cookie. You can delete cookies at any time in the security settings of your browser.
You can configure your browser settings as you wish and, for example, refuse third-party cookies or all cookies. Please note that in that case you may not be able to use all functions of our websites.
d) Data under Section 3 (a) is stored temporarily in log files for up to 21 days in order to safeguard technical operations. The legal basis for this processing is Art. 6(1) lit. f GDPR. Processing this data under Section 3 (a) to the extent described is strictly necessary in order to display the website to you, to operate our website technically and to maintain IT security, so you have no right to object in this respect. Notwithstanding this, we will still review any objections raised on a case-by-case basis (see Section 7 (b)).
e) To prevent unauthorised access by third parties to your personal data, all our websites are made available to you in a TLS-encrypted form, both for retrieval and for sending any data on your part.
f) YouTube: Videos on this website are embedded from YouTube. When the videos are played, the service provider may store cookies on the user’s computer. We have no influence over this storage.
When you visit our websites, additional YouTube services are offered via what is known as a two-click solution. No data is transmitted to the operators when the website is first opened. Only after users have consented by clicking accordingly as part of the opt-in procedure is data (including the URL of the current page and the user’s IP address) transmitted to YouTube, from that point on and on every subsequent visit. Users can decide for themselves whether to activate the YouTube videos and thereby agree to the data transfer. Users can withdraw this consent at any time and prevent any further data transfer to the operators by clicking accordingly on the homepage (opt-in procedure).
By default, the websites embed only deactivated images of the YouTube channel, which do not establish an automated connection to YouTube’s servers. This means the operator receives no data from the user when the websites are opened. Only when the user enables video playback by clicking “Enable permanently” do they consent to data being transmitted to the respective operator. To save the setting chosen by the user, a cookie is set that stores the parameters. No personal data is stored when these cookies are set; they contain only anonymised data used to adapt the browser. The videos are then active and can be played by the user. If the user wishes to disable the automatic loading of YouTube videos, they must click the “Disable external videos” option below the video. This also updates the cookie settings.
You can find YouTube’s privacy policy here: https://policies.google.com/privacy?hl=en&gl=de
Section 4 Further functions and offerings on our websites / involvement of third parties by us
a) In addition to the purely informational use of our websites, which is subject to this privacy policy, we offer various services that you can use if you are interested. To do so, you generally have to provide further personal data, which we use ourselves to provide the respective service for you and to which the principles of data processing set out above apply.
b) In some cases we use external service providers to process your data. These have been carefully selected and commissioned by us, are bound by our instructions and are checked regularly.
c) Where our service providers are based in a country outside the European Economic Area (EEA), we inform you of this and of the consequences separately.
Section 5 Processing on behalf of our customers
a) Our core business is providing web-based systems that our customers use to run web-based online surveys on their own responsibility.
b) For this purpose we provide our customers with our technical infrastructure for conducting online surveys, acting as what data protection law calls a processor. Customers who use our systems to conduct online surveys have concluded a data processing agreement with us that complies with the applicable statutory provisions, in particular those of the GDPR.
c) Responsibility for the lawfulness of the processing of personal data, and in particular for providing proper and complete data protection information to the data subjects of such online surveys, lies solely with whoever conducts the online survey (as a rule, therefore, our customers, for whom we act on their behalf and on their instructions). Only the party conducting the survey, who is also clearly named in every survey, is the controller within the meaning of Art. 4(7) GDPR.
d) For the sake of clarity as to who bears data protection responsibility, all web-based online surveys accessible on the technical basis of our systems are delivered exclusively on websites whose web address does not begin with “https://www.lamapoll” or “https://app.lamapoll”. This privacy policy therefore does not apply to any online survey provided by means of our technology. This follows directly from Section 5 here, read together with Section 1 (a) and (b) of this policy.
To exercise any data protection rights against such a controller who conducts web-based online surveys using our technical systems, please contact that controller directly, using the contact details clearly stated in each online survey or the privacy policy provided for the respective online survey by whoever operates it.
Section 6 Further functions and offerings on our websites in detail
1. Contacting us
When you contact us by email or via a contact form, the data you provide (your email address, where applicable your name and telephone number, and possibly further personal data you submit yourself) is stored by us in order to answer your questions. The legal basis for this is Art. 6(1) sentence 1 lit. f GDPR, provided the enquiry has no connection to a specific contract or pre-contractual relationship between you and us. If, on the other hand, your enquiry relates to a specific contract between you and us or to pre-contractual communication in that regard, the legal basis for the processing is Art. 6(1) sentence 1 lit. b GDPR. We delete the data arising in this context as soon as storage is no longer necessary to handle your enquiry. We review whether it is still necessary every two years. Where statutory retention obligations apply, the legal basis for the processing is also Art. 6(1) sentence 1 lit. c GDPR. Where statutory retention obligations exist, the data subject to them continues to be stored for the duration of the statutory obligation. However, once your enquiry has been dealt with conclusively, we restrict further processing so that the data is stored solely to fulfil any applicable statutory retention obligation.
2. Use of the blog function
a) In our blog, where we publish various posts on topics relating to our business, you can leave public comments. Your comments are published under the name you provide, alongside the post you chose to comment on. We recommend using a pseudonym rather than your real name for the purpose of publishing your comments.
b) Providing a name, your email address and the comment text itself is required; all further information is voluntary. When you submit a comment, in addition to the name, email address and any further voluntary information you provide, we also store your IP address, which we delete after two weeks. Storing the name is necessary alongside your comment so that it can be published under a specific name. The email address is stored so that, should you object to further processing in future, we can verify that the person raising the objection is indeed the author of the comment in question. The legal basis is Art. 6(1) sentence 1 lit. f GDPR. We reserve the right to delete comments that are complained of as unlawful by third parties or by us.
c) Comments you submit are published by us until you object to their further publication and we accept your objection, or until we remove your comment ourselves. Notwithstanding your right to object, you may also simply tell us at any time that you wish a comment of yours to be deleted and no longer visible online in future. To exercise your right to object or to submit a request for deletion, please simply contact us (see our legal notice).
d) If we delete your comments, if you request that comments be deleted, or if you object to the processing of your data arising from your comments and we accept your objection, we will restrict the processing of all the data mentioned above relating to the comment concerned, so that it is no longer published but continues to be stored. Where you object to further processing of your data relating to your comments, or request that a comment be deleted, we will also store your objection or your deletion request. This storage takes place so that we can effectively defend ourselves against any legal claims arising in connection with your comment and any further related communication and, where applicable, pursue recourse should we ourselves be held legally liable for comments made by third parties. The legal basis for this processing is Art. 6(1) sentence 1 lit. f GDPR.
e) All data relating to restricted comments is no longer published and — together with any data under paragraph 4 — is retained by us until the end of the third year following the start of the restriction. After this period, the data is permanently deleted.
3. Use of our infrastructure to create surveys
a) If you wish to create web-based online surveys yourself using our technical infrastructure and run them using our technical resources, you must first provide an email address and a password in our registration form and submit it. We require this data so that you can log in to create, manage and evaluate the surveys you want on our systems, allowing us to fulfil our contract with you to enable you to create and run surveys. Providing your email address is also necessary so that we can contact you where we have queries of our own, for example regarding complaints or objections about your activities, and so that we can send you an activation link to verify your email address and access, as well as, for example, assistance if you forget the password to your account. The legal basis for this processing is Art. 6(1) sentence 1 lit. b GDPR and Art. 6(1) sentence 1 lit. f GDPR.
b) For the registration of your email address described in paragraph 1 above, we use what is known as the double opt-in procedure. This means that after you register, we send an email to the email address you provided, in which we first simply ask you to confirm that you initiated a registration for our services using that email address.
If you do not confirm your registration within 24 hours of submitting it, your stored data is automatically deleted after six months. The purpose of this temporary storage without your confirmation is to prevent the abusive mass registration of the same email addresses to the detriment and annoyance of third parties. The legal basis is Art. 6(1) sentence 1 lit. f GDPR.
We also store the IP addresses you used and the times of your registration and confirmation. The purpose of this is to enable us to prove your registration and, where applicable, to investigate any possible misuse of your personal data, as well as to defend ourselves against any accusation of sending unsolicited advertising/emails. The legal basis is Art. 6(1) sentence 1 lit. f GDPR.
Once you confirm your registration after receiving the confirmation email, we will initially continue to store the data referred to above until either you tell us that you object to further processing for the future and we act on your objection, or you request that we delete your entire account (“registration”) with our system by contacting us (see our legal notice).
If you have objected to the future processing of that data and we have acted on your objection, or if you have requested that we delete your entire account (“registration”) with our system, we will delete the data referred to in paragraphs 1 and 2 above, as well as your objection itself or your request for deletion, and any related communication, no later than three years after the end of the calendar year in which you objected to further processing and we accepted your objection by notifying you, or in which you requested deletion of your entire account, unless and to the extent that longer statutory retention obligations apply to specific data in an individual case, in which case that data is handled in accordance with paragraph 7, sentences 4 and 5 below. This further period of storage, where no statutory retention obligation otherwise applies, is necessary to enable us, even after your request for deletion or your accepted objection, to prove your registration as well as your objection or your request for deletion in the event of a legal dispute. The legal basis here, too, is Art. 6(1) sentence 1 lit. f GDPR.
c) Following successful verification of your email address, we also require you to provide the following further data for processing:
- company name (if applicable)
- your first and last name
- your address details (street, postcode, city, country, PO box if applicable)
- a VAT ID (if applicable)
This data is likewise processed for the purpose of performing our contract with you, in particular for billing, invoicing and, where applicable, debt collection. This data is also processed for the purposes of our legal defence, should third parties bring claims against us in connection with your activities and we wish or need to take action against you in that context, or need to examine and contact you regarding possible action against you. The legal basis is Art. 6(1) sentence 1 lit. b GDPR and Art. 6(1) sentence 1 lit. f GDPR.
d) Any further information about you is provided voluntarily and may be withdrawn at any time. Where you provide such information, its purpose is to enable us to assess more closely whether you are entitled to discounts or special free services for particular target groups, which we grant in certain cases. The legal basis here is Art. 6(1) sentence 1 lit. f GDPR.
e) Following your registration, you may, under your own data protection responsibility, compile and store surveys and survey components via our websites and, if you wish, make them publicly accessible to other internet users, and then evaluate the results. As part of your prior registration, you also conclude a data processing agreement with us, meaning that, in respect of your entire use of our systems to compile, store, run and evaluate online surveys, we do not carry out any processing of personal data as a controller under data protection law. The background to this is that, as a registered user of our online survey functions, you are yourself to be regarded as the party responsible under data protection law for all these related processes and processing of personal data, which we carry out for you solely as a processor.
f) Where you have already supplemented the data from your registration under paragraphs a) and b) with further data under paragraphs c) and d), this supplementary data will likewise initially continue to be stored until either you tell us that you object to further processing for the future and we act on your objection, or you request that we delete this data by contacting us (see our legal notice).
g) Where you have requested the deletion of the data under paragraphs c) and d), or have objected to the processing of this data and we have accepted your objection, we will immediately restrict the use and processing of this data and will ultimately delete it once storage is no longer required, in particular for legal proceedings or recourse against you. We review whether this is still necessary every two years. The legal basis is Art. 6(1) sentence 1 lit. f GDPR. Where statutory retention obligations apply, the legal basis for the processing is Art. 6(1) sentence 1 lit. b GDPR. Where statutory retention obligations exist, the data subject to them continues to be stored for the duration of the statutory obligation and is deleted thereafter.
h) Where you order chargeable services from us, we also pass on the invoice recipient data you provide to our tax adviser for the purposes of financial accounting. The legal basis for this processing of your data, in the form of disclosure, is Art. 6(1) sentence 1 lit. f GDPR.
We use the payment service provider Stripe Payments Europe, Limited, Ireland (“Stripe”) to process payments.
When you pay via Stripe, the personal data required to process the payment is transmitted to Stripe. This may include in particular your name, email address, billing address, payment or account details, payment method, transaction amount and further transaction data, as well as technical data such as IP address, browser and device information.
This processing is carried out, to the extent necessary for the performance of the contract, on the basis of Art. 6(1) lit. b GDPR. Where the paying person is not our contractual partner themselves, the processing is based on our legitimate interest in proper and secure payment processing pursuant to Art. 6(1) lit. f GDPR. Processing required by law is carried out on the basis of Art. 6(1) lit. c GDPR.
Stripe also processes certain data under its own data protection responsibility, in particular for fraud prevention, security, and compliance with legal and regulatory obligations.
In connection with the use of Stripe, personal data may also be transferred to countries outside the European Union or the European Economic Area, in particular the USA. According to its own statements, Stripe uses the transfer mechanisms required under data protection law for this purpose, in particular the EU-U.S. Data Privacy Framework and, where necessary, the European Commission's standard contractual clauses.
Stripe stores the data for as long as necessary for payment processing and to fulfil statutory, regulatory and other legitimate retention purposes.
Further information on data processing by Stripe is available at:
https://stripe.com/de/privacy
https://stripe.com/legal/privacy-center
4. Use of Matomo (formerly Piwik)
This website uses the open-source software Matomo without using tracking cookies. Your IP address is anonymised immediately on receipt and before it is stored. No processing of personal data therefore takes place.
The legal basis for the use of Matomo is Art. 6(1) sentence 1 lit. f GDPR.
Data processed with Matomo is processed exclusively on our servers in Germany. The data is not passed on to third parties.
The following data is collected with Matomo:
(1) 2 bytes of the IP address of the user's accessing system
(2) the page accessed
(3) the page from which the user reached the page accessed (referrer)
(4) the subpages visited from the page accessed
(5) the time spent on the page
(6) how often the page is accessed
You can object to this data processing:
If you delete cookies in your internet browser, the opt-out cookie will also be deleted. You will need to submit your objection again the next time you visit our website.
5. Forms and surveys for job applicants
Our website regularly offers online applications for job seekers. If you apply to us via the applicant survey, we will process personal data (such as, but not limited to, your name, address, telephone number, cover letter, references and photo). We obtain this data directly from you, not from third-party sources.
We process your personal data to carry out the application process. The legal bases for this are Section 26(1) of the German Federal Data Protection Act (BDSG) and Art. 6(1)(b) GDPR.
Your data is not passed on to third parties and is processed exclusively by authorised personnel. We process your personal data only for as long as necessary to fulfil the processing purposes stated above and, in the case of unsuccessful applications, delete it no later than 6 months after receipt (Art. 6(1)(f) GDPR).
Section 7 Objection to or withdrawal of consent to the processing of your data
a) If you have given consent to the processing of your data, you may withdraw it at any time. Such withdrawal affects the lawfulness of the processing of your personal data from the point at which you notify us of the withdrawal.
b) Where we base the processing of your personal data on a balancing of interests, you may object to that processing. This is the case in particular where the processing is not necessary to perform a contract with you, as we indicate in each case in the description of the relevant function below. If you object, please explain why we should not process your personal data as described. If your objection is well-founded, we will review the situation and either stop or adjust the data processing, or explain to you our compelling legitimate grounds for continuing the processing.
c) You may of course object at any time to the processing of your personal data for advertising and data analysis purposes. You can notify us of your objection to advertising using the following contact details: by post to Lamano GmbH & Co. KG, Grünberger Str. 44 a – 10245 Berlin, or by email to support@lamapoll.de.
Individual data processing agreement
Entering into an individual data processing agreement involves considerable effort. We therefore offer individual DPAs only in exceptional cases. Please note that both our internal data protection review and the legal assessment by our lawyer incur costs. In addition, each individual data processing arrangement must be administered separately. The fee for an individual agreement therefore depends on the work involved. We charge for this service regardless of the outcome, usually a minimum of €6,000.
