Privacy Policy

This is a non-binding English translation. In case of discrepancies, the German version applies.

1. Controller

Controller within the meaning of Art. 4 (7) GDPR is:

Blck Horizon Solutions GmbH
Mittelstraße 11
40789 Monheim am Rhein
Germany
(Wholly-owned subsidiary of Blck Horizon Holding)
General enquiries: info@labnote-light.com
Data protection / legal: legal@labnote-light.com
Further information: Legal Notice

2. Data protection officer

We have not appointed a data protection officer because the statutory requirements for a mandatory designation pursuant to Art. 37 GDPR / § 38 BDSG are not met. For data protection enquiries, please use the email address above.

3. Hosting and data location

LabNote Light and the marketing website are hosted on Lovable Cloud (operator: Lovable AB, Sweden), which uses Supabase (operator: Supabase Inc., processed via its EU entity Supabase Ireland Ltd.) on AWS infrastructure in the European Union. Databases, file storage and backups remain within the EU.

Lovable and Supabase act as processors pursuant to Art. 28 GDPR. The corresponding Data Processing Agreements are available at lovable.dev/data-processing-agreement and supabase.com/legal/dpa. Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in secure and reliable provision of our service).

4. Server log files

When you access our website, the hosting provider automatically collects and stores the following information in so-called server log files: IP address (shortened where possible), date and time of the request, time zone difference to GMT, content of the request (specific page), HTTP status code, amount of data transferred, referrer URL, browser, operating system and language. Legal basis is Art. 6 (1)(f) GDPR; the legitimate interest lies in IT security, abuse defence and the stable operation of the service. Storage period: typically up to 30 days, in the event of security incidents until clarification.

5. Registration and user account

When you register a user account, we process the data entered during registration (in particular: email address, name, organisation, hashed password, time of registration). The processing is carried out for the establishment, performance and termination of the contractual relationship on the basis of Art. 6 (1)(b) GDPR. Account data are stored for the duration of the user account; after termination, they are deleted within 30 days, unless statutory retention periods (in particular under § 257 HGB, § 147 AO: 6 or 10 years for accounting-relevant documents) require further storage.

6. Use of LabNote Light (customer content)

Within the scope of using the software, the customer organisation may itself store personal data (e.g. of employees, project participants, samples). In this respect, the customer organisation is the controller within the meaning of Art. 4 (7) GDPR; we act as a processor pursuant to Art. 28 GDPR on the basis of a separate Data Processing Agreement. Further details are set out in the DPA.

7. Contact by email

If you contact us by email (e.g. info@labnote-light.com, support@labnote-light.com, sales@labnote-light.com, legal@labnote-light.com, billing@labnote-light.com), the data you provide (email address, name where applicable, message content) are processed for the purpose of handling your enquiry. Our business email is operated via Google Workspace (Google Ireland Ltd.) on EU servers; see section 9 below for details on this processor. Legal basis is Art. 6 (1)(b) GDPR insofar as your enquiry relates to the performance of a contract or pre-contractual measures, otherwise Art. 6 (1)(f) GDPR (legitimate interest in answering enquiries). Enquiries are deleted as soon as they are no longer required and no statutory retention periods preclude this.

7a. Newsletter (double opt-in)

If you subscribe to our newsletter, we use the double opt-in procedure: after entering your email address, we send a confirmation email containing a confirmation link. We process your email address, the confirmation token, your IP address and the timestamp of subscription/confirmation in order to document consent and prevent misuse. Legal basis is Art. 6 (1)(a) GDPR (consent). You can withdraw your consent at any time via the unsubscribe link in every newsletter or by emailing us. After unsubscription, your data will be deleted unless statutory retention periods apply (we may retain proof of prior consent on the basis of Art. 6 (1)(c) GDPR / Art. 7 (1) GDPR for the limitation period).

8. Cookies and similar technologies

We use strictly necessary cookies and storage technologies (in particular for login sessions and the storage of your cookie consent) on the basis of § 25 (2) no. 2 TDDDG (storage absolutely necessary for the provision of a telemedia service expressly requested by the user) in conjunction with Art. 6 (1)(f) GDPR.

Non-essential cookies (in particular for analytics or marketing) are only used after your prior, voluntary, informed and revocable consent in accordance with § 25 (1) TDDDG and Art. 6 (1)(a) GDPR. You give your consent via our cookie banner. You can revoke your consent at any time with effect for the future via the link "Cookie settings" in the footer of our website.

8a. Reach measurement (first-party analytics)

On our public marketing pages we record pageviews (URL path, referrer, browser language) only after your prior consent via our cookie banner (§ 25 (1) TDDDG, Art. 6 (1)(a) GDPR). No third-party analytics service is used; data are stored exclusively in our own database within the EU. Within the authenticated application (/app) we additionally record the path together with your user ID and the active organisation ID for product analytics, abuse prevention and contractually owed service operation on the basis of Art. 6 (1)(b) and (f) GDPR. Storage period: 12 months.

8b. Search Console (Google Search Console)

We use Google Search Console (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to measure the technical reachability of our website in Google Search and to receive indexing reports. Search Console only processes aggregated, non-personal data (e.g. number of impressions and clicks per query and URL) which Google collects from its own search service. We do not embed any tracking script of Google Search Console on our website; no personal data of our visitors is transmitted to Google on this basis. Legal basis is Art. 6 (1)(f) GDPR (legitimate interest in the technical optimisation of our reach). Google may transfer aggregated data to its parent company Google LLC in the USA; the transfer is safeguarded by EU Standard Contractual Clauses (Art. 46 (2)(c) GDPR) and Google's certification under the EU-US Data Privacy Framework.

8c. Business email (Google Workspace)

For sending and receiving business email (including info@labnote-light.com, support@labnote-light.com, sales@labnote-light.com, legal@labnote-light.com, billing@labnote-light.com and noreply@labnote-light.com) we use Google Workspace, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Workspace acts as a processor pursuant to Art. 28 GDPR on the basis of the Google Workspace Data Processing Amendment, which we have concluded; data are stored in Google's EU data centres. Processed data include sender/recipient address, subject, message content and attachments. Legal basis is Art. 6 (1)(b) and (f) GDPR (performance of pre-contractual / contractual measures and legitimate interest in business communication). Where Google transfers data to Google LLC in the USA for technical reasons, the transfer is safeguarded by EU Standard Contractual Clauses (Art. 46 (2)(c) GDPR) and Google's certification under the EU-US Data Privacy Framework. Further information: workspace.google.com/terms/dpa_terms.html.

9. Processors and subprocessors

We use the following processors. Hosting and application data remain within the European Union. Transfers to the USA in the context of Google services are safeguarded by EU Standard Contractual Clauses pursuant to Art. 46 (2)(c) GDPR and the EU-US Data Privacy Framework.

An up-to-date list of subprocessors is available on request from legal@labnote-light.com. Changes to the subprocessor list are announced in good time before they take effect; the customer has the right to object to a new subprocessor for important reasons under data protection law.

10. No automated decision-making

We do not use automated decision-making within the meaning of Art. 22 GDPR, including profiling.

11. Your rights as a data subject

You have the following rights vis-à-vis us with regard to the personal data concerning you: right of access (Art. 15 GDPR), right to rectification (Art. 16 GDPR), right to erasure (Art. 17 GDPR), right to restriction of processing (Art. 18 GDPR), right to data portability (Art. 20 GDPR) and the right to object (Art. 21 GDPR).

Right to object pursuant to Art. 21 GDPR: You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you which is based on Art. 6 (1)(e) or (f) GDPR. We will then no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.

If processing is based on consent (Art. 6 (1)(a) or Art. 9 (2)(a) GDPR), you have the right to withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

12. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR (Art. 77 GDPR). The supervisory authority responsible for us is:

State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia
Kavalleriestr. 2–4
40213 Düsseldorf, Germany
www.ldi.nrw.de

13. Data security

We use TLS encryption (HTTPS) for the transmission of data via the internet. Within the application, we implement technical and organisational measures (TOMs) appropriate to the state of the art pursuant to Art. 32 GDPR, in particular role-based access control (RBAC), Row Level Security in the database, audit logs and encrypted backups.

14. Changes to this Privacy Policy

We reserve the right to amend this Privacy Policy in order to adapt it to changed legal situations or to changes in the service. The current version applies, retrievable on this page.