Privacy policy

Language note

This is a convenience translation of the German privacy policy. In case of any discrepancy, the German version published at 0x41-labs.com/datenschutz prevails.

1. General information

Protecting your personal data matters to us. This privacy policy explains which personal data is processed when you use this website, for which purposes it is processed and which rights you have under data protection law.

Personal data is processed in particular on the basis of the General Data Protection Regulation (GDPR) and the applicable data protection provisions.

2. Controller

The controller for the processing of personal data on this website is:

3. Data protection officer

0x41 Labs has not appointed a data protection officer, as there is no statutory obligation to do so. For any questions regarding data protection, please contact the controller named above directly.

4. Visiting the website

When you access this website, technically necessary information may be processed that is required to provide and securely operate the site. This may include in particular:

• IP address
• date and time of access
• pages and files requested
• volume of data transferred
• referrer URL
• browser and operating system used
• technical connection and access data

This processing serves the technical provision of the website, the stability and security of the service, the detection and prevention of attacks and misuse, and error analysis and technical optimisation.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in providing this website securely, reliably and in technically sound condition.

5. Hosting and servers

This website is operated on Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. As part of the hosting, personal data that arises technically when the website is visited may be processed — in particular IP addresses, access timestamps, technical information about the device, and server and connection data.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in the secure and reliable technical provision of this website. The processing takes place under a data processing agreement pursuant to Art. 28 GDPR. Where data is transferred to the USA in this context, this is done on the basis of appropriate safeguards pursuant to Art. 44 et seq. GDPR.

6. Contacting us by email

If you contact us by email, the personal data you submit (in particular your name, email address and the content of your message) is processed in order to handle and answer your enquiry.

The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to entering into or performing a contract, otherwise Art. 6(1)(f) GDPR to safeguard our legitimate interest in communicating with prospects, clients and business partners.

7. Contact form

This website provides a contact form. If you use it, the data you enter is processed in order to handle your enquiry. This may include:

• name
• company
• email address
• phone number
• subject or project title
• project description
• intended timeframe
• budget indication
• any further information you choose to provide

Mandatory fields are marked as such in the contact form. The data is processed solely to handle your enquiry, to contact you and — where you wish — to prepare a possible project or contractual relationship.

The legal basis is Art. 6(1)(b) GDPR where the enquiry relates to entering into or performing a contract, and Art. 6(1)(f) GDPR for all other enquiries.

8. Transmission of contact form data

The details submitted through the contact form are delivered to us by email. For sending those emails we use the service Resend (Resend, Inc., USA) as a processor. The data entered in the form is processed technically and delivered to our mailbox.

The data is not sold to third parties for advertising purposes or otherwise used for third-party advertising. Where data is transferred to a third country in this context, this is done on the basis of appropriate safeguards pursuant to Art. 44 et seq. GDPR.

9. Spam and abuse protection

To protect the contact form against spam and automated submissions, we use a technical honeypot mechanism and server-side rate limiting. No external captcha or third-party bot detection service is used.

10. Retention period

Personal data is generally stored only for as long as it is required for the respective purpose or for as long as statutory retention obligations apply.

Enquiries that do not lead to a contractual relationship are deleted as soon as they are no longer required for handling and follow-up and no statutory retention obligations prevent deletion. If a contractual relationship comes about, data may be retained within the statutory retention periods.

11. Disclosure to third parties and recipients

Personal data is generally not disclosed to third parties without a legal basis. Disclosure may occur in particular where it is necessary for the technical provision of the website, to handle your enquiry, to perform a contract or to comply with statutory obligations.

Possible recipients are in particular:

• hosting and infrastructure providers (Vercel)
• email service providers (Resend)
• audience measurement providers (Vercel Analytics)
• tax advisors or other service providers bound to confidentiality, where necessary
• authorities and public bodies, where required by law

12. Web analytics and statistics

We use Vercel Analytics and Vercel Speed Insights for aggregated, technical analysis of website usage. According to the provider, these services collect anonymised or aggregated usage and performance data and do not use cookies for cross-device recognition. No marketing or advertising profiles are created.

The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in the technical evaluation and optimisation of the website.

13. Cookies and similar technologies

This website uses only technically necessary technologies that are required to operate and secure the site. No cookies are used for marketing or tracking purposes, so no consent management is required.

14. Fonts and external resources

The fonts used are served locally from our own server and are not loaded from external providers when a page is opened. No visitor data is therefore transmitted to font providers.

15. Data security

We take appropriate technical and organisational measures to protect personal data against loss, manipulation and unauthorised access. These include in particular encrypted transmission via TLS/HTTPS, access restrictions, regular updates of the software in use and protection against automated and abusive access.

16. Your rights

As a data subject you have, subject to the statutory requirements, in particular the following rights:

• right of access
• right to rectification
• right to erasure
• right to restriction of processing
• right to data portability
• right to object to processing based on Art. 6(1)(f) GDPR
• right to withdraw consent with effect for the future

17. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data. The competent authority may in particular be the one at your habitual residence, your place of work or the place of the alleged infringement. The competent authority for the controller is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).

18. Exercising your data protection rights

To exercise your rights, you can contact the controller at any time:

19. No automated decision-making

No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place in connection with this website.

20. Updates to this privacy policy

This privacy policy may be adapted if the technical implementation of this website, the services used or the legal requirements change. The current version published on this website applies in each case.