Privacy Policy

This is a non-binding English translation. In case of discrepancies, the German version applies.

1. Controller

Blck Horizon Solutions GmbH ("Blck Horizon Solutions")
Mittelstraße 11
40789 Monheim am Rhein
Germany
Email: legal@labnote-light.com
Phone: +49 157 59044257
Further details: Legal Notice (Impressum)

2. Data protection officer

No data protection officer has been appointed because the requirements of Art. 37 GDPR and Section 38 of the German Federal Data Protection Act (BDSG) are not met. Data protection enquiries should be sent to legal@labnote-light.com.

3. Provision of the website and application

The website and application are delivered via the platform of Lovable Labs Sweden AB, Regeringsgatan 25, 111 53 Stockholm, Sweden. Database, authentication, file storage and server-side functions are operated by Supabase, Inc. on Amazon Web Services infrastructure in the Frankfurt am Main region. Both act as processors under Art. 28 GDPR. Access from third countries, in particular the USA, via sub-processors or in support cases cannot be ruled out; it is safeguarded by EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). The legal basis is Art. 6(1)(f) GDPR – the legitimate interest lies in secure and reliable provision of the service – and, for logged-in users, additionally Art. 6(1)(b) GDPR.

4. Server and security logs

When the site is accessed, the following data is processed for technical reasons: IP address, date and time, requested address, HTTP status code, data volume transferred, referrer, browser and operating system. To prevent misuse, Blck Horizon Solutions additionally logs login attempts, rate limits and invalid inputs with IP address and browser identifier. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in IT security and stable operation. Failed login attempts are deleted after 90 days and logs of API requests after 180 days; other log data is deleted once it is no longer required for these purposes, in the case of security incidents after they have been resolved. Where Lovable processes log data under its own responsibility for security, billing, analytics and product development purposes, Lovable's privacy policy applies.

5. Storage in the browser

The following technically necessary storage technologies are used for operation: login session and security tokens, settings such as language, the stored cookie choice, and a local cache for collaborative editing of entries. The legal basis is Section 25(2) no. 2 TDDDG; for the subsequent processing, Art. 6(1)(b) or (f) GDPR. Storage that is not necessary only takes place with consent given via the cookie banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR); consent can be withdrawn at any time via "Cookie settings" in the footer. The individual entries with purpose and storage period are listed in the Cookie Policy.

6. Audience measurement

On the public pages, page views (path, referrer, browser language) are only recorded with consent and are stored exclusively in our own database (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). In the logged-in application, visited paths are recorded together with user and organisation ID for product improvement, misuse prevention and operational monitoring (Art. 6(1)(f) GDPR). Storage period: 12 months. No third-party analytics services are used.

7. Registration, user account and contract

The following is processed: email address, name, organisation, role, the password in hashed form, previous password hashes for enforcing the password policy, times of registration and login, and, where used, the configuration of multi-factor authentication. The purpose is to provide the account and perform the contract; the legal basis is Art. 6(1)(b) GDPR. This information is required to conclude the contract; without it, use is not possible. Account data is stored for the duration of the account and deleted without undue delay after the account is deleted, unless statutory retention obligations (Section 257 HGB, Section 147 AO) prevent this; backup copies are overwritten in the course of the backup cycle.

8. Payment processing

Payments, subscriptions and invoices are processed via Stripe (Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). Transmitted are the organisation's billing data, email address, selected plan and payment information; card data is entered directly with Stripe. Stripe processes payment data for fraud prevention and to comply with legal obligations under its own responsibility and uses cookies and device data for this purpose during the payment process. The legal basis is Art. 6(1)(b) GDPR, and for fraud prevention Art. 6(1)(f) GDPR. Transfers to Stripe, Inc. in the USA take place on the basis of the EU-US Data Privacy Framework and EU Standard Contractual Clauses.

9. Customer content (processing on behalf)

Content that organisations store in LabNote.Light – such as lab journals, samples, documents, electronic signatures and the associated audit trail – is processed by Blck Horizon Solutions on behalf of the respective organisation on the basis of a data processing agreement (Art. 28 GDPR). The organisation is the controller for this data; requests from data subjects must be addressed to it. The same applies to the customer portal through which laboratories provide their clients with status and reports; sign-in there uses a one-time code sent by email.

10. AI features

AI features (assistant, transcription of voice recordings, translation, extraction from safety data sheets, support assistant) are only available if an organisation's administration has enabled them and agreed to the transmission to the AI provider. The relevant content is then transmitted via the AI gateway of Lovable Labs Sweden AB to language models from Google or OpenAI; processing in the USA is possible and safeguarded by EU Standard Contractual Clauses. Alternatively, an organisation can configure its own AI provider; in that case the organisation's contract with that provider applies. Only usage data is logged (organisation, user ID, function, model, token count, duration), no content. The usage data is deleted after 365 days.

11. Email communication and system messages

When contacting us by email, the email address, name and content of the message are processed to handle the request – under Art. 6(1)(b) GDPR where it relates to a contract, otherwise under Art. 6(1)(f) GDPR. Mailboxes are operated via Google Workspace (Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland; processor). A transfer to the USA is possible; it takes place on the basis of the EU-US Data Privacy Framework and EU Standard Contractual Clauses. System messages such as confirmations, invitations, password resets and notifications are sent through the email service of Lovable Labs Sweden AB by default. Resend, Inc. is used for certain security notifications and, where enabled, as an alternative email delivery service. The legal basis is Art. 6(1)(b) or (f) GDPR; a send log with recipient address, template and status serves to monitor delivery. Support requests submitted as tickets via the application are deleted three years after their last change (Art. 6(1)(b) and (f) GDPR; limitation period under Section 195 BGB). Other data is deleted once it is no longer required and no retention obligations apply.

12. Live chat

A live chat is available on the public pages. The messages, name and email address (provided voluntarily), browser language and browser identifier, and a session key stored in the browser are processed. The legal basis is Art. 6(1)(b) GDPR where it relates to a contract, otherwise Art. 6(1)(f) GDPR; the legitimate interest lies in answering enquiries. The messages are stored in the database and deleted once they are no longer required to handle the request and no retention obligations apply.

13. Newsletter

The newsletter uses the double opt-in procedure. The email address, IP address and the times of subscription and confirmation are processed. With consent, we also record whether a newsletter was opened and which links were clicked. The legal basis is Art. 6(1)(a) GDPR. Consent can be withdrawn at any time via the unsubscribe link or by email; the data is then deleted. The data is permanently deleted 30 days after unsubscription. The newsletter is sent through the email service of Lovable Labs Sweden AB by default and through Resend, Inc. where the alternative delivery service is enabled.

14. Status notifications

Anyone who subscribes to incident notifications on the status page confirms the email address via a link. The email address and the times of subscription and confirmation are processed. The legal basis is Art. 6(1)(a) GDPR; unsubscription is possible at any time via the link in each message.

15. Recipients and third-country transfers

Personal data is received only by the following bodies, and by authorities where there is a legal obligation. Data is neither sold nor passed on for advertising purposes.

16. Rights of data subjects

Data subjects have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). Requests should be addressed to legal@labnote-light.com.

17. Right to object under Art. 21 GDPR

Where processing is based on Art. 6(1)(f) GDPR, data subjects may object at any time on grounds relating to their particular situation. The data will then no longer be processed unless there are compelling legitimate grounds that override the interests, rights and freedoms of the data subject, or the processing serves the establishment, exercise or defence of legal claims.

18. Withdrawal of consent

Consent given can be withdrawn at any time with effect for the future; the lawfulness of processing carried out until then remains unaffected (Art. 7(3) GDPR).

19. Right to lodge a complaint

Data subjects may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority for Blck Horizon Solutions is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestraße 2–4, 40213 Düsseldorf.

20. Automated decisions

Automated decision-making, including profiling within the meaning of Art. 22 GDPR, does not take place.

21. Changes

This policy is updated when the service or the legal situation changes. The version currently available on this page applies.