Privacy Policy

Last updated: July 2026

Protecting your personal data is important to us. Below we inform you, in accordance with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and the German Telecommunications Digital Services Data Protection Act (TDDDG), about how personal data is processed in connection with this website.

1. Controller

[Company Name]
[Street Address]
[Postal Code] [City]
[Country]

Email: hello@novolabo.com
Website: www.novolabo.com

Commercial register: [Register Court], [HRB Number]
VAT ID: [VAT ID Number]

2. General information on data processing

Personal data means any information relating to an identified or identifiable natural person (Art. 4(1) GDPR).

We process personal data only as necessary to provide a functional website and our content and services, or where you have given consent or another legal basis permits the processing.

3. Hosting and server log files

When you access this website, the hosting provider or web server automatically stores information in so-called server log files. This may include in particular:

• IP address (possibly truncated/anonymized)
• Date and time of the request
• Requested URL / file
• Referrer URL
• Browser type and version as well as operating system
• Amount of data transferred and HTTP status code

Purpose: Technical provision, stability, and security of the website (e.g. defence against attacks).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and reliable operation).

Retention: Log data is generally retained only for a limited period and then deleted or anonymized, unless longer retention is required to investigate security incidents.

4. Contact by email

If you contact us by email (e.g. at hello@novolabo.com), we process the data you provide (in particular email address, name, message content, and any other information contained in the email).

Purpose: Handling your enquiry and any follow-up correspondence.

Legal basis:

• Art. 6(1)(b) GDPR, where the enquiry relates to initiating or performing a contract
• Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries)
• Art. 6(1)(a) GDPR, where you have given consent

Retention: We store the data for as long as necessary to process the enquiry or as required by statutory retention obligations (e.g. commercial and tax law). Data is then deleted unless legitimate interests require longer storage.

5. Cookies and similar technologies

This website may use cookies and similar technologies (e.g. local storage).

Necessary / technically required cookies
These are required for the operation of the website (e.g. storing your cookie consent). Legal basis: Art. 6(1)(f) GDPR in conjunction with § 25(2) TDDDG.

Non-essential cookies (e.g. statistics / marketing)
These are set only if you have previously given consent. Legal basis: Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG.

You may withdraw your consent at any time with effect for the future, e.g. via the consent banner settings (if displayed) or by deleting or blocking cookies in your browser. The lawfulness of processing carried out before withdrawal remains unaffected.

6. Web analytics and reach measurement (Google Analytics / Google Tag Manager)

Where configured, we use Google Analytics 4 and/or Google Tag Manager to analyse website usage (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; and possibly Google LLC, USA).

Collection and transmission of statistics or marketing data via these services takes place only after your consent (consent banner or Cookiebot, if used).

Data that may be processed includes:

• Truncated/anonymized IP address
• Device and browser information
• Approximate location data (derived from the IP address)
• Page views, time on page, interactions (e.g. clicks, scroll depth)
• Referrer and, where applicable, UTM parameters

Purpose: Analysis of website usage, improvement of content and technology, measurement of marketing activities.

Legal basis: Art. 6(1)(a) GDPR (consent).

Third-country transfer: Transfer to the USA or to Google LLC cannot be ruled out. Google relies inter alia on EU Commission Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. Details: https://policies.google.com/privacy

Withdrawal: You may withdraw your consent at any time (consent banner / browser settings).

7. Consent management (optional Cookiebot)

If we use a consent management service (e.g. Cookiebot / Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark), it stores your cookie preferences in order to document and manage your consent.

Legal basis: Art. 6(1)(c) GDPR (legal obligation to manage consent) and Art. 6(1)(f) GDPR or Art. 6(1)(a) GDPR depending on the scope of functions.

8. Web Vitals and performance measurement

To improve website performance, technical metrics (e.g. load times, Core Web Vitals) may be collected and, if analytics consent has been given, transmitted to the analytics provider. Without consent to statistics cookies, no corresponding analytics transmission takes place.

9. Disclosure of data

We transfer your personal data to third parties only if:

• you have consented (Art. 6(1)(a) GDPR),
• disclosure is necessary for performance of a contract (Art. 6(1)(b) GDPR),
• a legal obligation exists (Art. 6(1)(c) GDPR), or
• disclosure is necessary to protect legitimate interests and your interests do not override (Art. 6(1)(f) GDPR),

and, where applicable, to processors bound by our instructions under Art. 28 GDPR (e.g. hosting, email, or analytics providers).

We do not sell your personal data.

10. Retention period

Unless more specific periods are stated in this policy, we store personal data only for as long as necessary for the respective purposes or as required by statutory retention periods. After the purpose ceases or the periods expire, data is deleted or anonymized.

11. Your rights

Where the legal requirements are met, you have the following rights:

• Access to your personal data stored by us (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on Art. 6(1)(e) or (f) GDPR (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

To exercise your rights, a simple message to hello@novolabo.com is sufficient.

12. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement (Art. 77 GDPR).

Supervisory authority competent for us:

[Name of Supervisory Authority]
[Address of Supervisory Authority]
[Postal Code] [City]
Website: https://www.example-datenschutz.de

13. No automated decision-making

No automated decision-making including profiling within the meaning of Art. 22 GDPR takes place in connection with this website.

14. SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, this site uses SSL/TLS encryption. You can recognise an encrypted connection by “https://” in your browser’s address bar.

15. Updates to this privacy policy

We reserve the right to adapt this privacy policy so that it always complies with current legal requirements or to implement changes to our services. The version current at the time of your visit applies.