FreyaLabsPrivacy policy
Controller
The controller for data processing on this website is R-S Digital Transformation Ventures UG (haftungsbeschränkt), Gerhart-Hauptmann-Straße 19, 82140 Olching, Germany, represented by its managing director Maximilian Rink-Schoen. Email: hello@freyalabs.de. FreyaLabs is a brand of this company.
Privacy at a glance
This policy explains which personal data we process when you visit this website, why, and on what legal basis. Personal data is any data that can identify you personally. We receive it in two ways: you give it to us, for example through a form, or our systems record technical data such as browser, operating system and time when you open a page. We need this technical data to provide the website reliably and securely. We do not analyse your usage behaviour.
Data protection officer
We are not legally required to appoint a data protection officer. Please send questions about data protection to hello@freyalabs.de.
Legal bases
Where you have consented to processing, we process your data under Art. 6(1)(a) GDPR; you can withdraw your consent at any time. Where your data is needed to perform a contract or for pre-contractual steps, the basis is Art. 6(1)(b) GDPR, and for legal obligations Art. 6(1)(c) GDPR. Other processing is based on our legitimate interest under Art. 6(1)(f) GDPR. The sections below state which basis applies. We do not store information on your device or access it unless this is strictly necessary for technical reasons (§ 25(2) TDDDG, German Telecommunications Digital Services Data Protection Act).
Storage period
Unless a more specific period is stated in this policy, your data remains with us until the purpose of processing no longer applies. If you make a justified request for erasure or withdraw your consent, we delete your data unless other legal grounds for keeping it apply, such as retention periods under tax or commercial law. In that case we delete it once those grounds cease to apply.
Recipients and processors
We only pass on personal data where this is necessary to perform a contract, where we are legally obliged to, where we have a legitimate interest under Art. 6(1)(f) GDPR, or where another legal basis permits it. Service providers that process data on our behalf are only engaged under a data processing agreement pursuant to Art. 28 GDPR. These are currently Railway (hosting), Brevo (newsletter and confirmation e-mails), our e-mail provider [e-mail provider] and Google (video calls).
Hosting
This website is hosted by Railway Corporation, San Francisco, USA. When you open the website, Railway processes the server log files including your IP address (see below). We use Railway based on Art. 6(1)(f) GDPR; our legitimate interest is providing the website reliably and securely. A data processing agreement is in place with Railway. For transfers to the USA it includes the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR); Railway also states that it is certified under the EU-US Data Privacy Framework.
Server log files
When you open the website, information transmitted by your browser is recorded automatically: browser type and version, operating system, referrer URL, time of the request and IP address. This data is not combined with other sources. To prevent abuse of our forms, we also count for at most ten minutes how many requests come from an IP address. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the technically sound and secure operation of the website.
Cookies and tracking
We do not use cookies or comparable recognition techniques, nor any analytics or advertising tools or embedded third-party content. That is why we do not show a cookie banner.
SSL/TLS encryption
For security reasons this website uses SSL/TLS encryption, for example for requests you send us through forms. You can recognise an encrypted connection by “https://” in the address bar and the lock icon in your browser. Data you send us cannot be read by third parties. Communication by e-mail, by contrast, cannot be fully protected against access by third parties.
Contact form
When you use the contact form, we process the data you enter (name, company, email, phone number, industry, comment) to handle your request and any follow-up questions. The details are not stored on the website but e-mailed to hello@freyalabs.de through our e-mail provider [e-mail provider]. The legal basis is Art. 6(1)(b) GDPR where your request aims at a contract, and Art. 6(1)(a) GDPR through your consent via the checkbox. We do not pass the data on without your consent and delete it once your request has been fully handled, you ask for deletion or you withdraw your consent, unless statutory retention periods apply.
Requests by e-mail or phone
When you contact us by e-mail or phone, we process your request including the personal data it contains (e.g. name, concern) to handle it. The legal basis is Art. 6(1)(b) GDPR where your request relates to a contract or pre-contractual steps, otherwise our legitimate interest in handling requests (Art. 6(1)(f) GDPR). We do not pass this data on without your consent and delete it once your concern has been dealt with, unless statutory retention periods apply.
Newsletter, guide and readiness check (double opt-in)
When you subscribe to the newsletter, request our guide or ask for your readiness-check evaluation by e-mail, we process your e-mail address, your language, your check answers (readiness check only) and your optional choices on newsletter and personal follow-up. So that nobody can sign up someone else, we use double opt-in: only after you click the link in our confirmation e-mail do we add you and deliver the guide or evaluation. We use Brevo (Sendinblue SAS, Paris, France) as processor to manage addresses and send confirmation e-mails; data is stored in the EU. Brevo logs time and IP address of sign-up and confirmation as proof. Legal bases: Art. 6(1)(b) GDPR for delivering guide and evaluation at your request, Art. 6(1)(a) GDPR (consent) for the newsletter and personal follow-up. You can unsubscribe at any time via the link in every e-mail or by writing to hello@freyalabs.de, and withdraw your consent with effect for the future. Without newsletter consent we do not use your address for marketing.
Video calls with Google Meet
For intro calls and other video meetings we use Google Meet, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This involves processing your name, e-mail address, time and duration of participation, audio and video, chat content and technical data such as IP address and device data. The legal basis is Art. 6(1)(b) GDPR where the call serves to prepare or perform a contract, otherwise our legitimate interest in straightforward communication (Art. 6(1)(f) GDPR). A data processing agreement is in place with Google; transfers to the USA rely on the EU-US Data Privacy Framework, under which Google is certified, and on the European Commission’s standard contractual clauses. We do not record calls.
Access, rectification and erasure
Within the statutory provisions you have the right at any time to free information about your stored personal data, its origin, recipients and the purpose of processing, and where applicable a right to have this data rectified or erased. For this and any other questions about data protection, please contact hello@freyalabs.de.
Right to restriction of processing
You can ask us to restrict the processing of your data: if you dispute its accuracy, for as long as we check it; if the processing was unlawful and you prefer restriction to erasure; if we no longer need the data but you need it to establish, exercise or defend legal claims; and if you have objected under Art. 21(1) GDPR, as long as it is not yet clear whose interests prevail. Apart from storing it, we then only process restricted data with your consent, to establish, exercise or defend legal claims, to protect the rights of others, or for reasons of important public interest.
Right to data portability
On request, we hand over data that we process automatically based on your consent or to perform a contract to you or a third party you name, in a common machine-readable format. Direct transfer to another controller takes place where technically feasible.
Withdrawal of consent
Many processing operations are only possible with your express consent. You can withdraw consent at any time with effect for the future, for example by e-mail to hello@freyalabs.de or via the unsubscribe link in the newsletter. The lawfulness of processing carried out before the withdrawal remains unaffected.
Right to object under Art. 21 GDPR
Where processing is based on Art. 6(1)(e) or (f) GDPR, you have the right to object at any time on grounds relating to your particular situation; this also applies to profiling based on these provisions. After an objection we no longer process the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims (Art. 21(1) GDPR). Where your data is processed for direct marketing, you may object to this at any time; your data will then no longer be used for direct marketing (Art. 21(2) GDPR).
Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany. This right is without prejudice to any other administrative or judicial remedy.