Privacy

1Controller

The controller responsible for the processing of personal data on this website and for bookings at my.riverlabs.de (section 4.5) is Riverlabs GmbH, represented by its managing director, Cedric May (hereinafter “Riverlabs”):

Email

hello@riverlabs.de

Phone

+49 30 83799031

Riverlabs is not required to appoint a data protection officer. Data protection enquiries can be sent to Riverlabs using the contact details above.

2At a glance

• No cookies, no trackingNo cookies, no analytics and no profiling on riverlabs.de (section 5).
• Server logs at VercelVisiting creates server logs, such as IP address and time, for operation and security (section 3).
• Nothing from third partiesTypeface, images, map and code come from riverlabs.de itself, not from third parties (section 5).
• Contact when you chooseFurther data only if you write, call or book a meeting (section 4).
• Booking a meetingAt my.riverlabs.de: Google Calendar, preparation with Mistral AI, providers in section 4.8.
• Your rightsAccess, erasure, objection and more: an email to hello@riverlabs.de is enough (section 9).

This website is built to collect as little data as possible. It has no contact form, no login, no newsletter and no payment function. Riverlabs uses no cookies, no audience measurement, no marketing tracking and no embedded third-party content. The typeface, images, the map on the contact page and code are served from this website (via Vercel).

Personal data is nevertheless processed when you visit, to the extent necessary to deliver and secure the website (section 3). Riverlabs receives further data only if you get in touch yourself or book a meeting (section 4). Bookings are made at my.riverlabs.de, a separate application of Riverlabs; sections 4.5 to 4.9 describe what is processed there and which service providers are involved.

3Provision of the website and server logs

3.1Provider

The website is provided on the infrastructure of Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA (“Vercel”).

3.2Data processed

When the website is accessed, Vercel processes technically necessary connection and access data (server logs). In particular, this may include:

• IP address and approximate location information derived from it,
• date and time of the request,
• requested address or file and HTTP status code,
• referrer, where transmitted by the browser,
• the language setting your browser sends with every request (Accept-Language),
• browser, device and operating system information (user agent),
• technical identifiers such as request or diagnostic IDs.

3.3Purposes and legal basis

The processing serves to deliver the website in the appropriate language version, to keep it stable and secure, to analyse technical errors and to detect and prevent abusive access. The legal basis is Art. 6(1)(f) GDPR. Riverlabs' legitimate interest lies in a secure, functioning and error-free provision of its website.

3.4Role of Vercel

Where Vercel processes personal data on behalf of Riverlabs, it does so under a data processing agreement pursuant to Art. 28 GDPR (Vercel’s Data Processing Addendum). Vercel states that it also processes certain service data and metadata arising from the use of its services as an independent controller. Details are set out in Vercel’s privacy notice (vercel.com/legal/privacy-notice).

3.5Transfers to third countries

Vercel states that it processes data mainly in the USA and may also process it in other countries. Vercel is certified under the EU-U.S. Data Privacy Framework. Transfers to certified companies in the USA are therefore covered by the European Commission’s adequacy decision of 10 July 2023 (Implementing Decision (EU) 2023/1795, Art. 45 GDPR). For transfers to other third countries or outside the certification, Vercel’s Data Processing Addendum provides for the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

3.6Retention

Server logs are kept only as long as necessary for the purposes stated. For logs that Riverlabs manages in its Vercel account, retention and deletion follow the settings and retention periods of the plan in use. The relevant criteria are secure provision, error analysis and defending against specific attacks. Where data is needed to investigate a specific security incident, it is kept until the investigation is completed. Where Vercel processes data as an independent controller, the periods stated in Vercel’s privacy notice apply.

4Contact by email, phone or booking a meeting

4.1Data processed and purposes

If you contact Riverlabs by email (for example at hello@riverlabs.de) or by phone, Riverlabs processes your contact details, the content of your message and the communication data needed to handle it, to answer your enquiry.

The contact page (/contact) lists the ways to reach Riverlabs. It has no form and does not by itself transmit any data to Riverlabs. If you arrange a visit to Riverlabs, Riverlabs also processes the date and time of the visit and the names of the people coming, to prepare the visit and let you in.

An email or phone link on this website does not by itself transmit any data to Riverlabs. It only opens your own email or phone application, for email possibly with a pre-filled subject line. Data is transmitted only when you send a message or make a call yourself.

4.2Legal bases

• Art. 6(1)(b) GDPR, where your enquiry concerns the conclusion or performance of a contract with you;
• Art. 6(1)(f) GDPR in all other cases, for example enquiries from contacts at other companies; the legitimate interest lies in handling business and other enquiries properly;
• Art. 6(1)(c) GDPR for retention, where statutory retention obligations apply.

4.3Email service: Google Workspace

Emails to addresses at riverlabs.de are processed with Google Workspace, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, on behalf of Riverlabs under a data processing agreement pursuant to Art. 28 GDPR. Data may also be transferred to Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023, Art. 45 GDPR); in addition, Google’s contract terms provide for standard contractual clauses (Art. 46(2)(c) GDPR).

4.4Retention

Communication data is deleted once your enquiry has been fully dealt with and no statutory retention obligations or legitimate grounds for further retention apply, such as the establishment, exercise or defence of legal claims. Riverlabs keeps business letters, which may include emails, for six years under Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO), and accounting records for eight years. The periods begin at the end of the calendar year.

4.5Booking a meeting at my.riverlabs.de

A meeting button on this website, for example in the imprint or on the contact page, takes you to the booking page at my.riverlabs.de/meeting (German version: my.riverlabs.de/termin). It is a service of Riverlabs GmbH and runs on its own software (Riverlabs OS); Riverlabs is the controller there as well (section 1). The button itself transmits no data. Only when you open the booking page does its server, operated at Cloudflare (section 4.8), process your browser’s connection data, as section 3.2 describes for this website.

When you book a meeting, Riverlabs processes:

• your name and email address (required) and, if you wish, your company and topic,
• the type, day, time and length of the meeting, and your language and time zone,
• for a meeting in person, your phone number, and for a visit also your address, its coordinates, the calculated travel time and your directions,
• the name and email address of further participants you add,
• changes and cancellations, including any reason you give,
• your IP address, to limit bulk requests; with the booking it is stored only as a check value (hash) formed with a secret key.

Riverlabs uses these details to show free times, to enter the meeting in the calendar, to send you and the further participants the invitation, a calendar file, reminders (one day and one hour before) and changes by email, to hold the meeting and to let you move or cancel it. Further participants receive an invitation that shows your name; please add only people who expect the invitation. Riverlabs receives their names and email addresses from the person who books the meeting (Art. 14(2)(f) GDPR).

The legal basis is Art. 6(1)(b) GDPR where the meeting serves to prepare or perform a contract with you. In all other cases, for example when you book on behalf of a company, and for the data of further participants and the limiting of bulk requests, it is Art. 6(1)(f) GDPR; the legitimate interest lies in arranging and holding business meetings and in protecting the service against misuse.

For a visit, you look up your address in a search field. The Riverlabs server requests suggestions, coordinates, travel time and the map image from Mapbox; Mapbox receives the search text and the coordinates, not your IP address. The page also loads the map tiles (OpenStreetMap data) from OpenFreeMap through the Riverlabs server; OpenFreeMap receives neither your IP address nor your address.

The booking page sets no cookies and uses no tracking. When you choose a language or a calendar view, your browser remembers this choice in its local storage; this is necessary for the setting you requested (Section 25(2) no. 2 TDDDG). It stores your name, email address and company there only if you tick “Remember my details on this device” (consent, Section 25(1) TDDDG, Art. 6(1)(a) GDPR); untick it and they are deleted.

4.6Preparing the meeting

So that Cedric May is well prepared for the conversation, after a booking Riverlabs matches your email address and its domain against its own customer records; no new record is created. For an address at your company (not at a general email service), the server fetches the publicly accessible home page of the company website. From your name, company, the type of meeting, your topic, an existing customer record and the text of that home page, Mistral AI writes a short summary with talking points. It is meant for Cedric May only, is not part of the calendar entry and is sent to his phone as a notification one hour before the meeting.

The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in a well-prepared conversation. The summary makes no decision about you (section 12). You can object to this processing (section 10); it will then not take place for your meeting.

4.7Meeting page and video room

Each booked meeting has a meeting page at my.riverlabs.de that all participants can open through the link in the invitation. It shows the time, place, participants, agenda and, after the conversation, the notes that have been shared. A preview image of this page for shared links shows the title, time, place and the participants' names, but no email addresses, no address of a visit and no content of the conversation.

For video meetings, Riverlabs offers its own video room besides Google Meet. Picture and sound run through Cloudflare’s real-time service. If you wish, the video room turns your voice into text live so that the agenda and notes keep up. This happens only if you agree to it in the video room, and you can switch it off at any time during the conversation (Art. 6(1)(a) GDPR, withdrawal under Art. 7(3) GDPR). Your browser then sends only the sound of your own microphone, directly to ElevenLabs in the USA; ElevenLabs also receives your IP address. From the text, Google’s Gemini (processed in the EU), or Mistral AI as a fallback, picks out agenda items, decisions and tasks. The text and the results are stored on the meeting page. Your browser remembers your consent and video room settings (such as background effects) locally.

4.8Service providers for bookings

These providers process the data on behalf of Riverlabs (Art. 28 GDPR). Transfers to the USA rely on the European Commission’s adequacy decision of 10 July 2023 (EU-U.S. Data Privacy Framework, Art. 45 GDPR) where the provider is certified, and otherwise on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

4.9Retention for bookings

Riverlabs keeps booking data for as long as it is needed for the meeting and the business relationship, and beyond that only where statutory retention obligations apply (section 4.4). What the video room holds during a conversation is deleted 14 days after it ends; notes and results on the meeting page remain until they are deleted. You can delete what your browser stores locally at any time in the browser. At your request, Riverlabs deletes your booking data unless an obligation or a legitimate reason stands in the way.

5No cookies, no storage in your browser

Riverlabs uses no cookies or similar technologies on this website (riverlabs.de). No information is stored in or read from your browser unless it is strictly necessary to deliver the page or to provide a function you have expressly requested (Section 25 of the German Telecommunications Digital Services Data Protection Act, TDDDG). There are no analytics or marketing services, no user tracking and no profiling.

The website embeds no external fonts, videos, map services, social media elements or other content that would connect to a third-party provider when it loads.

Map on the contact page

The contact page shows a map of the area around Riverlabs with the walking routes from the underground stations Kochstraße and Stadtmitte. The map section, the routes, the typeface and the program that draws the map (MapLibre GL JS) are stored on this website and served by it like any other file (section 3). Displaying the map does not connect to a map service or any other third party. The map and the routes are based on OpenStreetMap data; they were created once in advance, and neither OpenStreetMap nor the services used to create them learn of your visit.

Your browser draws the map itself. The map does not determine your location, does not query your device’s location services and stores nothing in your browser. If you move or zoom the map, your browser may load further map files from this website; these requests appear in the server logs like any other request (section 3.2). The legal basis is Art. 6(1)(f) GDPR (section 3.3).

The links for directions in Apple Maps or Google Maps lead to services of Apple and Google. Only when you click such a link does your browser or device open that service; like any page request, it then receives your IP address and Riverlabs' address as the destination. Apple’s and Google’s privacy notices apply. Without a click, nothing is transmitted to Apple or Google.

Language version

Riverlabs offers this website in English and German, each version at its own address. If you open the home page, the contact page, the imprint or the privacy policy at its English address (/, /contact, /imprint, /privacy) and your browser names German as its preferred language, the server forwards you to the German version (/de, /de/kontakt, /de/impressum, /de/datenschutz). This does not happen if you come from a page of this website, which the server recognises from the referrer your browser sends, or if the address contains the addition ?lang. This keeps the version you have chosen yourself within reach.

This happens afresh on every request. Nothing is stored on your device, neither as a cookie nor in any other way, and it is not combined with other data into a profile. To the extent your browser’s language setting and referrer are evaluated for this purpose, this is necessary to provide the website in your language (Section 25(2) no. 2 TDDDG); further processing is based on Art. 6(1)(f) GDPR. Every page links to its version in the other language, which you can open yourself at any time.

Time and animation

Times, dates and animations are calculated entirely in your browser. For the local time, the page uses your device’s time zone setting.

Your browser calculates the Berlin time shown next to the phone number from your device’s clock.

Your browser calculates how long ago a page was last updated from its date and your device’s clock.

When you print a page, your browser adds your device’s current date as a print note.

Your browser calculates from your device’s clock whether Riverlabs can be reached by phone right now (Monday to Friday, 9 am to 6 pm Berlin time, except on public holidays in Berlin). If your device is set to another time zone, it also converts the phone hours into your local time.

Your device’s time, time zone and date are not transmitted to Riverlabs or to third parties, and they are not stored. Riverlabs does not determine your location to adapt content, whether from your IP address or through your device’s location services.

Copying to the clipboard

If you click a copy button (for example next to the address, the register number or the VAT identification number) or “Copy link to this section”, your browser writes the text shown or the address of the section to your device’s clipboard. This happens only when you click and is necessary for the function you have requested (Section 25(2) no. 2 TDDDG). The page never reads the clipboard, and nothing is transmitted to Riverlabs or third parties.

6“Privacy at a glance” window

The “Privacy at a glance” window is purely informational. It has no controls, stores no choice and sets neither cookies nor entries in local storage or session storage. Since nothing that requires your consent is currently in use on riverlabs.de, there is nothing to confirm. Should Riverlabs use services that require consent in the future, the website will ask beforehand, and you can change or withdraw your choice at any time with effect for the future.

7Recipients

Access data may be processed by Vercel and the sub-processors Vercel uses to provide its service. When you get in touch, Google (section 4.3) and the IT and telecommunications providers used by Riverlabs receive the data required for the respective service. When you book a meeting, these are Cloudflare, Google, Mistral AI, Mapbox and, only with your consent in the video room, ElevenLabs (section 4.8); the further participants you add also receive your name and the meeting, and all participants see the meeting page. Otherwise Riverlabs discloses data only where there is a legal obligation, for example to authorities or tax advisers. No data is disclosed for advertising, profiling or marketing purposes.

8Obligation to provide data

You are not required by law or by contract to provide personal data. Without the connection data, however, the website cannot be delivered; without your contact details, Riverlabs cannot answer an enquiry. A booking requires your name and email address, a visit also your address; without them no meeting can be arranged.

9Your rights

Where the legal requirements are met, you have the right to:

• Access to your personal data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

A message to hello@riverlabs.de is enough to exercise your rights. Clicking one of the rights opens an email with a matching subject; the subject is only a suggestion, and an informal email, a letter or a call works just as well. Riverlabs may ask for appropriate proof of your identity where this is necessary to protect your data.

10Right to object

11Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for Riverlabs is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information) Alt-Moabit 59–61 10555 Berlin Germany Email: mailbox@datenschutz-berlin.de Website: datenschutz-berlin.de

12No automated decision-making

Riverlabs does not use automated decision-making, including profiling within the meaning of Art. 22 GDPR, in connection with this website.

13Updates

This privacy policy is updated when the website, the service providers used or the legal requirements change. The date of the current version is shown at the top of this page.