Privacy Policy

I. Controller

II. External Data Protection Officer

III. General use of the website

This site is hosted by Netlify, Inc. (101 2nd Street, San Francisco, CA 94105, USA). We do not collect personal data ourselves for purely informational visits to this site. For technical reasons, your browser may automatically transmit certain information to Netlify as our hosting provider (including date and time of access, browser type, operating system, and IP address). This data is used solely to technically deliver the site. Netlify processes this under a data processing agreement pursuant to Art. 28 GDPR and is certified under the EU-U.S. Data Privacy Framework (including its UK and Swiss-U.S. extensions); EU Standard Contractual Clauses (European Commission Decision 2021/914) apply as an additional safeguard.

Booking an appointment via this site's booking link takes you to Google Calendar (Google Ireland Limited), a separate Google service. That link is only called up when you actively click it; no connection to Google is made before that. Google's own privacy notices apply to the booking itself.

IV. Getting in touch

The contact form and the optional email field in the AI Pulse Score result on this site are processed via Netlify Forms, a feature of our hosting provider Netlify, Inc. (see section III). On submission, the information you enter (for the contact form: name, email address and message, among others; for the Pulse Score field: your email address and your test result) is sent directly to Netlify and stored there until we delete it from the Netlify dashboard; no data is transmitted to our own servers. The legal basis is the performance of pre-contractual measures taken at your request (Art. 6(1)(b) GDPR) or, for the Pulse Score field, your explicit consent (Art. 6(1)(a) GDPR), given on submission.

V. Cookies

This site does not set its own analytics or marketing cookies.

Traffic statistics are collected with Plausible Analytics, a cookie-free, EU-hosted web analytics service that stores no personal data and builds no cross-device profiles (Art. 6(1)(f) GDPR).

VI. Fonts

The typeface used on this site (Figtree) is self-hosted and served directly from our own server or from Netlify (see section III). No connection is made to an external font service; loading the typeface transmits no data to a third party.

VII. Disclosure to third parties

We only disclose your data to third parties where necessary to provide the service you requested — in particular to Netlify, Inc. as our hosting provider and for processing both forms via Netlify Forms (see sections III and IV) — or where we are legally required to do so. The embedded typeface (see section VI) is self-hosted and involves no disclosure to third parties. Your data is processed in the USA through this connection; Netlify is certified under the EU-U.S. Data Privacy Framework and/or applies EU Standard Contractual Clauses. Clicking the booking link (see section III) also establishes a connection to Google Calendar. If you write to us on WhatsApp, Meta and our relay service at Google Cloud are involved (see section X).

VIII. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability, and objection regarding your personal data. Contact contact@venturelabs.team or our data protection officer (above). You also have the right to lodge a complaint with a supervisory authority, e.g. the North Rhine-Westphalia data protection authority.

IX. Data security

Your data is transmitted in encrypted form via SSL/TLS (https).

X. Contacting us via WhatsApp

If you write to us on WhatsApp (the WhatsApp Business number of Venture Labs GmbH), we process your data as described here. We only write back if you wrote to us first.

Provider and platform. WhatsApp is operated by Meta; for the Business Platform the contracting entity is Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland), and its parent is Meta Platforms, Inc. (USA). Through the WhatsApp Business Platform your message, your phone number, your WhatsApp profile name and connection and delivery data are passed to us. Meta also processes data for its own purposes; WhatsApp's and Meta's privacy notices apply to that. Where data is transferred to the USA, Meta relies on the EU-U.S. Data Privacy Framework and/or EU Standard Contractual Clauses.

Purpose and data. We use WhatsApp to receive and answer enquiries, replies and project feedback. We process your phone number, where applicable your first or profile name, the content of your message (text, voice message, image, document) and timestamps. Voice messages are converted to text locally on our own systems; no cloud service is used for this.

Legal basis. Your consent, which you give by writing to us after reading this notice (Art. 6(1)(a) GDPR), and answering your request and performing pre-contractual measures or the collaboration (Art. 6(1)(b) GDPR). You can withdraw consent at any time with effect for the future.

Processing in our infrastructure. Incoming WhatsApp events are received by a small relay service at Google Cloud in Frankfurt am Main, Germany (Google Cloud EMEA Limited, under a data processing agreement pursuant to Art. 28 GDPR). It stores nothing permanently: events wait in a queue for at most 7 days and are deleted as soon as our own system has collected them. The messages are then stored and evaluated on our own machines in Germany. There is no use for advertising, no profiling and no automated decision with legal effect; the content of one project is not used for another project.

Retention. We delete voice recordings after conversion to text, at the latest after 14 days. We keep texts and transcripts for the duration of the respective project and delete them afterwards. On request we delete everything immediately: send us "LÖSCHEN" on WhatsApp or an email to contact@venturelabs.team. Your rights are listed in section VIII.

XI. Customer portal (hub.venturelabs.team): sign-in with Google or Apple

The customer portal at hub.venturelabs.team is only open to customers we have invited. There is no public registration; without an invitation you get no access.

Data. If you sign in with Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) or Apple (Apple Distribution International Limited, Hollyhill Industrial Estate, Cork, Ireland), the provider passes us your name, your email address (with Apple possibly a relay address) and an identifier of your account (Google or Apple ID). We receive no passwords and no access to other content of your account. During sign-in the respective provider also processes data under its own privacy notice.

Purpose and legal basis. We use the data to recognise you as an invited person, to secure access and to provide the content of your project. The legal basis is performance of the contract or pre-contractual measures (Art. 6(1)(b) GDPR) and our legitimate interest in secure access (Art. 6(1)(f) GDPR).

Retention. We keep your access data as long as your access exists, i.e. for the duration of the collaboration. After that we block and delete it, unless a statutory retention duty applies. On request we delete your access earlier: write to contact@venturelabs.team. Your rights are listed in section VIII.