Drafted in good faith and pending review by a qualified lawyer before general availability.
Who is responsible
The controller for this website within the meaning of the GDPR is MergeLabs GmbH. Postal address and register details are on the imprint. For anything concerning your data, write to [email protected].
This website sets no cookies
We set no cookies, and we write nothing to local or session storage. That is why you are not being asked to dismiss a consent banner: there is no non-essential processing to consent to. Nothing on these pages tracks you across sites, builds a profile of you, or is shared with an advertising network.
What is collected when you visit
These pages are static files. Serving them produces the ordinary server log entries any web server produces: the requested address, the date and time, the amount of data sent, the referring page, your browser and operating system, and your IP address. This is processed on the basis of our legitimate interest in delivering and securing the site (Art. 6(1)(f) GDPR), used to operate and protect it, and not combined with any other data or used to identify you.
Hosting and log processing are carried out by our hosting provider, acting as a processor under a data processing agreement.
Analytics
If analytics are enabled on this site, we use Umami, which is cookieless, stores no personal identifiers and collects no cross-site data. It is configured per deployment; where it is switched off, no analytics requests are made at all.
Fonts, media and embedded content
The typeface on these pages is loaded from Fontshare (api.fontshare.com and cdn.fontshare.com), a font delivery service operated by the Indian Type Foundry. Your browser requests the font files directly from them, so they receive your IP address and browser details as part of that request in the same way any web host does; they set no cookies and we send them nothing about you. Some fonts may instead be served by Bunny Fonts (fonts.bunny.net), an EU-hosted service that keeps no logs. Product screenshots and photographs are served from our own delivery CDN, which likewise receives your IP address as part of the request. There are no embedded videos, social widgets, chat widgets or advertising tags on these pages.
When you get in touch
If you email us, or book a meeting through the scheduling link on this site, we process the details you give us in order to answer you and to hold the meeting (Art. 6(1)(b) and (f) GDPR). Booking a meeting takes you to Calendly, an external service with its own privacy policy; what you enter there is processed by them as well as reaching us. We keep enquiry correspondence for as long as it takes to deal with the matter, and any longer only where a legal retention period requires it.
The platform is a separate matter
This policy covers the website you are reading. Where you use the Cothena platform to run events, personal data about your staff, volunteers and attendees is processed on your instructions: you are the controller and we act as processor under a data processing agreement, which forms part of the customer contract. That agreement, rather than this page, governs how attendee data is handled, where it is stored, how long it is kept and who may access it.
Your rights
You have the right to ask what personal data we hold about you, to have it corrected or erased, to have its processing restricted, to receive it in a portable form, and to object to processing carried out on the basis of legitimate interest. Where processing rests on consent, you may withdraw that consent at any time with effect for the future. Write to[email protected] and we will act on it.
You also have the right to complain to a supervisory authority. In Germany that is the data protection authority of the federal state in which the company is established.
Changes
We update this policy when what we do changes. The version published here is the one that applies.