Privacy policy of the Lab

1. Who the controller is

The controller within the meaning of Article 4(7) GDPR is:
SIMO GmbH
Würzburger Straße 152
63743 Aschaffenburg, Germany
Commercial register: HRB 15769, Local Court (Amtsgericht) of Aschaffenburg
Phone: +49 6021 625 63 40
Email: info@simo-online.com

For anything concerning your data, write to datenschutz@simo-online.com or use the postal address above, marked “Data protection.”

2. When you open this site

Every request leaves an entry in the server log. We record the truncated IP address, the date and time, the address requested, the referrer, the browser, and the operating system.

Purpose

Delivering the site, keeping it available, and detecting and investigating attacks.

Legal basis

Article 6(1)(f) GDPR. Our legitimate interest is a site that stays up and is not abused.

Storage period

7 days, then deleted automatically.

Recipients

Our hosting provider as a processor under Article 28 GDPR. Servers are located in Germany.

Cloudflare’s content delivery network sits in front of our servers (Cloudflare Germany GmbH, Rosental 7, 80331 Munich, Germany). It serves images and fonts from a data center near you and absorbs denial-of-service attacks. Your IP address is processed briefly in the process. The legal basis is Article 6(1)(f) GDPR.

The typefaces used are stored on our own server. No connection to Google Fonts is made.

3. Cookies and storage on your device

On a plain visit to this website there is nothing that would require consent: no audience measurement, no advertising tools, and no cross-site recognition. We therefore use no consent banner (Section 25(1) TDDDG, the German implementation of the ePrivacy Directive). This website is entirely cookie-free: it stores nothing on your device and reads nothing from it. Your chosen language is carried in the address (German without a prefix, English under /en) and is not stored.

Strictly necessary, therefore no consent required

• cf_clearance (Cloudflare). Our site is delivered through Cloudflare. To fend off automated attacks Cloudflare may set the cf_clearance cookie. It serves the security of the service and is exempt from consent under Section 25(2) no. 2 TDDDG; it is set at the edge, not by this application. You can delete it in your browser at any time.

Should we use a tool for analytics, recognition, or advertising in the future, we will amend this policy beforehand and, where required, obtain your consent. Without your consent no tool requiring consent will load.

4. When you write to us

When you email us, we process what you tell us: usually your name, email address, company, and the content of your message.

Purpose

Answering your inquiry and keeping a record of how it was handled.

Legal basis

Article 6(1)(f) GDPR, our interest in answering the people who write to us. Where your inquiry aims at a consulting engagement with SIMO GmbH, the legal basis is Article 6(1)(b) GDPR (steps taken at your request prior to entering into a contract).

Storage period

Until the matter is settled. We then delete unless commercial or tax law requires us to keep the record.

Recipients

None. Your message stays with us.

5. No audience measurement

We do not measure the audience of this website. Nobody counts which pages are opened, neither on someone else’s servers nor on our own. No entry sits on your device for it, and there is no analysis.

We run no advertising networks on this site. There is no Google Tag Manager, no Google Analytics, and no cross-site recognition.

What a page view leaves in the server log is described in section 2. That is not audience measurement but operational security, and it is deleted after seven days.

6. The AI chat on this site

Where this site offers an AI chat, the following applies: your input and a pseudonymous session identifier are logged briefly so that we can detect abuse and check answer quality. Your IP address is turned into a SHA-256 value before it is stored. Requests run through our own gateway on a server in Germany, using language models operated inside the European Union.

Legal basis

Article 6(1)(f) GDPR, our interest in a service that works and cannot be abused.

Storage period

24 hours.

Note

You are talking to a system, not to a person. We say so because Article 50 of Regulation (EU) 2024/1689 requires it.

Please do not enter special categories of personal data under Article 9 GDPR into the chat, health data for instance. For advice on such matters, use postal mail or the telephone.

7. Who receives your data

We share data only where one of the sections above says so. We do not sell data and we do not pass it on for advertising.

• Processors under Article 28 GDPR: our hosting provider and Cloudflare. A data processing agreement is in place with each of them.
• Public authorities and courts, where the law obliges us to disclose (Article 6(1)(c) GDPR).

8. Transfers to third countries

This website is operated in Germany. No data is transferred to a third country.

9. How long we keep things

Server logs

7 days

Chat logs

24 hours, IP address stored as a hash

Inquiries

until the matter is settled

When a period runs out, we delete. Where a retention obligation stands in the way, we apply restriction of processing instead of deletion. The data is then held for the purpose of retention and nothing else.

10. Your rights

You have the following rights against us. Exercising them costs you nothing, and we answer within one month.

Right of access (Article 15 GDPR)

You can find out whether and what data we process about you, and ask for a copy.

Right to rectification (Article 16 GDPR)

If something is wrong or incomplete, we correct or complete it.

Right to erasure (Article 17 GDPR)

We erase as soon as the purpose has fallen away and no retention obligation stands in the way.

Right to restriction of processing (Article 18 GDPR)

Instead of erasing, we can limit processing to mere storage, while the accuracy of the data is in dispute, for example.

Right to data portability (Article 20 GDPR)

What you gave us on the basis of consent or a contract, we hand back in a structured, machine-readable format.

Right to object (Article 21 GDPR)

You can object to processing based on our legitimate interests on grounds relating to your particular situation.

Right to withdraw consent (Article 7(3) GDPR)

At any time, as easily as you gave it, with effect for the future.

You also have the right to lodge a complaint with a supervisory authority (Article 77 GDPR). The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 27, 91522 Ansbach, Germany. You may equally approach the authority where you live.

11. Whether you have to provide data

You do not have to provide any data to read this site. If you write to us, we need an address to reply to. Everything else is voluntary.

12. No automated decision-making, no profiling

We take no decisions about you that are based solely on automated processing and produce legal effects concerning you (Article 22 GDPR). We do not profile you for advertising.

13. Security

Traffic is encrypted end to end with TLS; your browser shows the padlock. Access to personal data is limited to the people who need it for their work. Please report security issues to security@simo-online.com.

14. Changes to this policy

If what we process changes, this policy changes with it. The version in force is always the one on this page; the date at the bottom tells you which that is. Where a change concerns processing you consented to, we ask you again.