Privacy Policy

The controller responsible for data processing on this website is AMBOSS Labs GmbH, Zum Burghof 15, 41366 Schwalmtal, Germany, represented by its Managing Director Axel Stappen.

For any questions about data protection, contact us at info@ambosslabs.com.

We are not legally required to appoint a data protection officer and have not appointed one.

We process personal data only as far as necessary to run this website and to handle your sign-up or enquiry.

This website sets no cookies, uses no analytics or tracking tools and shows no advertising. Fonts, images and video are delivered from our own server; no third-party content is loaded when you visit the site.

This website is operated by Railway Corporation (USA). Our servers and database are located in a data centre in the European Union. When you visit the website, the host automatically processes the following data in server log files:

• IP address of the requesting device
• Date and time of access
• Requested page or file
• Referrer URL (the previously visited page), if transmitted
• Browser type and operating system (user agent)
• HTTP status code and amount of data transferred

This processing is required to deliver the website, keep it stable and secure, and fend off attacks. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR. Log files are kept only as long as needed for these purposes and are then deleted automatically.

Railway processes this data on our behalf under a data processing agreement pursuant to Art. 28 GDPR. Because Railway is a US company, access from the USA cannot be ruled out. Appropriate safeguards under Art. 44 et seq. GDPR are in place for this case, in particular the EU Standard Contractual Clauses.

The connection to this website is encrypted with TLS (HTTPS).

When you change the language or colour theme, we save your choice in your browser's local storage under the entries "amboss-labs-locale" and "amboss-labs-theme". This information stays on your device and is not sent to us.

This storage is strictly necessary to provide the setting you explicitly requested (Section 25(2) no. 2 TDDDG). You can delete these entries at any time in your browser settings.

You can join our early access waiting list using the sign-up form. We process the following details:

• First and last name
• Position
• Company
• Work email address
• Language you use on the website (for our emails)

We use these details only to contact you about early access to our products and to let you know when they launch. The legal basis is Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract) and our legitimate interest in contacting interested companies under Art. 6(1)(f) GDPR.

Your sign-up only takes effect once you click the link in our confirmation email (double opt-in). We store the time of your confirmation as proof of your sign-up. Your details are stored in an access-protected database with our host Railway in the EU and are available only to our authorised team. To prevent misuse, a keyed hash of your email address is held in server memory for no more than ten minutes.

After you sign up, we send you an email with a confirmation link, and after you confirm, a short welcome email. We use Google Workspace (Gmail) from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as a processor for sending it. A transfer to Google LLC in the USA cannot be ruled out; Google LLC is certified under the EU-US Data Privacy Framework.

The confirmation link is valid for 7 days. Unconfirmed entries are automatically cleaned up after expiry. We keep confirmed details until you object to the processing or request deletion, but no longer than 24 months after our last contact with you. Statutory retention obligations remain unaffected.

Providing your details is voluntary. Without them, however, we cannot add you to the waiting list.

If you email or call us, we process your contact details (email address or phone number), your name and the content of your message in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract, and otherwise our legitimate interest in answering it under Art. 6(1)(f) GDPR.

Our mailboxes run on Google Workspace (see section 5). We delete your enquiry once it has been dealt with, unless statutory retention obligations apply.

The contact button also offers WhatsApp. The link only opens WhatsApp; no data is transferred when you visit our website. If you write to us via WhatsApp, WhatsApp Ireland Limited (Meta) also processes your data, including your phone number and metadata, under its own privacy policy, and a transfer to the USA is possible. Please use email for confidential content.

Our website links to LinkedIn profiles. These are plain links, not embedded plugins: no data is sent to LinkedIn when you visit our website. Only when you click a link does LinkedIn (LinkedIn Ireland Unlimited Company) process your data under its own privacy policy.

Your data is accessible only to our authorised team and to the service providers named above, Railway and Google, who act on our behalf and on our instructions. We do not sell your data or pass it on for advertising purposes.

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

You have the following rights regarding your personal data:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

To exercise your rights, simply email info@ambosslabs.com.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

We update this privacy policy when our website or the legal situation changes. The version published here applies.