Legal

Data Protection

We, rencolab GmbH, take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory provisions of the relevant data protection laws, in particular the European General Data Protection Regulation (GDPR) as well as this privacy policy.

This privacy policy applies to the use of rencolab's services, including our social media profiles, across all internet-capable devices. Our digital offerings may contain links to other websites and/or services of third-party providers to which this privacy policy does not apply.

1. Controller

The controller responsible for the processing of your personal data is

rencolab GmbH

Uhlandstraße 1a 28211 Bremen

rencolab@rencolab.de +49 421 37845007

If you have any questions about data protection, please write to us at the above postal address marked "Data Protection" or by e-mail to rencolab@rencolab.de.

2. Purpose of the processing of personal data

2.1 Data processing for the provision of the contractual services

We process personal data in order to perform the contractual relationships and to be able to submit needs-based contract offers. The data is collected in particular for the conclusion of a contract.

For all forms, we only collect as mandatory those personal data that are strictly necessary for performing the contractual relationships or for your information request. Such fields are marked with an asterisk. The collection of data that is not strictly necessary, but in which we have an interest in order to optimise the fulfilment of the purpose, takes place only optionally. In this case, you decide on a voluntary basis whether and which data you wish to provide to us.

For your order or a related enquiry, we may require your correct name, address and, where applicable, payment details. We request your e-mail address and telephone number so that we can communicate with you in the event of questions or problems regarding the service you have ordered.

The legal basis for the data processing is Art. 6(1)(1)(b) GDPR, which permits the processing of data for the performance of a contract or pre-contractual measures.

2.2 User area

On some of our websites we offer the option to register for a user area by providing personal data. For this we require the following information: first and last name, e-mail address, where applicable a password, and beyond that possibly further data for contact purposes. The data in the user area can, where applicable, be viewed, edited and deleted using the e-mail address and the associated password. In the event that you have forgotten your password for the customer area, you will find the link "Forgot password" on the log-in page. You can set a new password by providing your e-mail address. Alternatively, you may be able to request a new password through us. The personal data you enter is processed within the scope of the use of the respective user area only in order to be able to provide you with the associated services.

The legal basis for the data processing is Art. 6(1)(b) GDPR, which permits the processing of data for the performance of a contract or pre-contractual measures.

2.3 Data processing for communication with you

In addition to the contract data, we process your communication data (name, address, telephone number, e-mail address) in order to process your enquiry and/or to be able to contact you. Personal data that you provide to us by e-mail, via a contact form or via another communication channel opened by us is processed only for correspondence with you or only for the purpose for which you provided the data to us.

The processing of this data takes place on the basis of Art. 6(1)(1)(b) GDPR insofar as your enquiry is connected with the performance of a contract or is necessary for carrying out pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective handling of the enquiries addressed to us (Art. 6(1)(1)(f) GDPR) or on your consent (Art. 6(1)(1)(a) GDPR) insofar as this has been obtained in this respect.

2.4 Cookies

We may use so-called cookies in order to be able to offer website-specific services. Cookies are small text files that are stored on a visitor's computer and contain data on the respective user in order to give them access to various functions.

Both session cookies and permanent cookies may be used on websites. A session cookie is temporarily stored on the computer used while navigating through the website. A session cookie is deleted as soon as the internet browser is closed or as soon as the session has expired after a certain period of time. A permanent cookie remains on the computer until it is deleted.

In some cases we cooperate with third parties for some of our offerings, and therefore, when you visit such a website, cookies from partner companies may also be stored (third-party cookies). Where applicable, we will inform you in advance about the use of such cookies and the extent of the data stored or retrieved in each case. Supplementary information on the cookies used in each case is provided to data subjects, where applicable, via the cookie tool used by us and the explanations there.

We use necessary cookies that are required to enable the provision of the services we owe or to ensure the functionality of our services. The legal basis for setting these cookies is Section 25(2) No. 2 TDDDG (German Telecommunications and Telemedia Data Protection Act). Any processing of personal data carried out in this context then takes place on the basis of Art. 6(1)(1)(b) GDPR, which permits the processing of data for the performance of a contract or pre-contractual measures, or pursuant to Art. 6(1)(1)(f) GDPR, which permits the processing of data to safeguard the legitimate interests of the controller, unless the interests or the fundamental rights and freedoms of the data subject override the interest of the controller in the data processing. Our interest then lies in ensuring the provision of the functions of our services.

For the use of other, non-essential cookies, we obtain your consent where applicable. The setting of the cookies then takes place on the basis of a consent pursuant to Section 25(1) TDDDG, and any processing of personal data carried out in this context pursuant to Art. 6(1)(1)(a) GDPR. Data subjects can withdraw their consent at any time – among other things via the cookie tool that we may have integrated. The lawfulness of the data processing already carried out on the basis of consent remains unaffected by the withdrawal.

2.5 Data processing in the context of our LinkedIn presences

We operate a company page on LinkedIn. The provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. When you visit our company page, LinkedIn processes personal data and provides us with aggregated statistics ("Page Insights") derived from it. In this respect, we are joint controllers with LinkedIn (Art. 26 GDPR); the basis is the joint controller agreement ("Page Insights Joint Controller Addendum", available at https://legal.linkedin.com/pages-joint-controller-addendum). The processing takes place on the basis of our legitimate interest in an effective public presentation and communication (Art. 6(1)(1)(f) GDPR). A transfer of personal data to the USA cannot be ruled out in this context; LinkedIn is certified under the EU-US Data Privacy Framework.

In addition, the managing directors and co-founders of rencolab GmbH actively use their personal LinkedIn profiles to communicate on behalf of rencolab GmbH with customers, prospects and partners and to share content about our business activities. Insofar as personal data of visitors or of those interacting is processed in this context (e.g. real names, comments, messages), this likewise takes place on the basis of our legitimate interest in an effective public presentation and communication (Art. 6(1)(1)(f) GDPR). With regard to the processing by LinkedIn itself, we refer to LinkedIn's privacy notices at https://www.linkedin.com/legal/privacy-policy.

2.6 Data processing to safeguard legitimate interests

We also process your data where this is necessary in order to safeguard legitimate interests of ours or of third parties. This may be the case in particular in order to ensure IT security and IT operations, in particular also for support enquiries, and in order to be able to trace and prove facts in the event of legal disputes.

The legal basis for the data processing is Art. 6(1)(1)(f) GDPR. We have a legitimate interest in the data processing operations listed above.

2.7 Data processing for analysis, advertising or market research purposes

In the event of the use of your data for advertising purposes for our products, we obtain your consent where applicable. The data processing then takes place on the basis of your consent (Art. 6(1)(1)(a) GDPR). You can withdraw your consent at any time. The lawfulness of the data processing operations already carried out remains unaffected by the withdrawal.

In addition, we use your e-mail address for recommendations or enquiries if we already maintain a contractual relationship. You receive these recommendations from us regardless of whether you have subscribed to a newsletter. In this way, we wish to provide you with information about our offerings that could be of interest to you on the basis of your enquiry or contractual relationship with us. In doing so, we adhere strictly to the statutory requirements. If you no longer wish to receive any recommendations or any promotional messages from us at all, you can object to this at any time. A notification in text form to the contact details specified under section 1 (e.g. e-mail, fax, letter) is sufficient for this purpose.

The legal basis for the aforementioned data processing is Art. 6(1)(1)(f) GDPR, which permits the processing of data to safeguard the legitimate interests of the controller, provided that the interests or fundamental rights and freedoms of the data subject do not override them.

2.8 Other data processing on the basis of your consent

It may also happen that we ask for your consent for a processing of your personal data. Every granting of consent and the respective relevant data processing takes place on a voluntary basis, and no disadvantages arise for you in the event of non-consent.

The data processing then takes place on the basis of your consent pursuant to Art. 6(1)(1)(a) GDPR. You can withdraw any consent you have granted at any time with effect for the future. An informal notification to us is sufficient for this. The lawfulness of the data processing operations already carried out remains unaffected by the withdrawal.

2.9 Log files

Each time our websites are accessed, usage data is transmitted by the respective internet browser and stored in log files, the so-called server log files. The data records stored in this process contain the following data: browser type and browser version, operating system used, referrer URL, host name of the accessing computer, system configurations, time of the server request, and anonymised IP address.

This data cannot be attributed to specific persons. This data is not merged with other data sources. We reserve the right to check this data subsequently if we become aware of specific indications of unlawful use.

The legal basis for the data processing is Art. 6(1)(1)(f) GDPR, which permits the processing of data to safeguard the legitimate interests of the controller, provided that the interests or fundamental rights and freedoms of the data subject do not override them.

2.10 Data processing to fulfil legal obligations

In addition, we process your data to fulfil legal obligations (e.g. regulatory requirements, retention and documentation obligations under commercial and tax law).

The legal basis for the data processing is Art. 6(1)(1)(c) GDPR, which permits processing for the fulfilment of a legal obligation.

3. Recipients of the personal data

Your personal data is only passed on or otherwise transferred to third parties if this is necessary for the purpose of contract performance or billing, or if you have previously consented, or if there is a legal basis for the disclosure.

Your data is forwarded to the respective responsible department and the responsible employees within our company in order to answer your enquiries, for communication, for carrying out the order or for the fulfilment of contractual obligations.

To provide our services, we use carefully selected service providers who process personal data on our behalf and in accordance with our instructions (processing on behalf pursuant to Art. 28 GDPR). These include in particular:

• nexea GmbH, Uhlandstraße 1a, 28211 Bremen, Germany – IT, infrastructure and administrative services (including development and GitLab infrastructure)
• IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany – server, hosting and e-mail services
• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany – server and hosting services
• Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland – Microsoft 365 (Office, e-mail, cloud storage)
• Fireflies.ai, Inc., USA – automatic transcription of meetings
• Mistral AI SAS, 15 rue des Halles, 75001 Paris, France – AI-based language processing
• Slack Technologies Limited (Salesforce), Dublin, Ireland – internal communication
• Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia – privacy-friendly, cookieless web analytics

Insofar as service providers process personal data outside the EU or the EEA – in particular in the USA (Microsoft, Fireflies, Slack) – this is safeguarded by the EU standard contractual clauses (Art. 46 GDPR) agreed with the respective provider or – where applicable – by an adequacy decision of the EU Commission (EU-US Data Privacy Framework).

Insofar as it is necessary for the purpose of contract performance, data is passed on to partner companies that have been commissioned to support the contract performance. The basis for this is then Art. 6(1)(1)(b) GDPR, which permits the processing of data for the performance of a contract or pre-contractual measures.

In addition, data may be passed on to third parties commissioned with advice, such as consulting firms or law firms, tax advisors, auditors or comparable advisory service providers. These are regularly not acting as processors; however, they are subject to statutory or contractually agreed confidentiality obligations.

4. Duration of data storage

As a matter of principle, we delete your data as soon as it is no longer required for the purposes mentioned above, unless the temporary retention continues to be necessary. Thus, we store your data on the basis of statutory documentation and retention obligations arising, among other things, from the German Commercial Code (HGB) and the German Fiscal Code (AO). The retention periods under these can be up to ten years. In addition, we retain your data for the period during which claims can be asserted against our company (statutory limitation period of three or up to thirty years).

5. Data security

Your personal data is transmitted securely by us using encryption. We use the SSL/TLS (Transport Layer Security) coding system for this purpose. You can recognise an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line. Furthermore, we secure our websites and other systems by technical and organisational measures against loss, destruction, access, alteration or dissemination of your data by unauthorised persons.

6. Rights of data subjects

Within the framework of the applicable statutory provisions, data subjects have the right at any time to free information about their personal data stored by us, its origin and recipients and the purpose of the data processing, and, where applicable, a right to rectification or erasure of this data.

For this purpose and for further questions on the subject of personal data, they can contact us at any time using the contact details specified under section 1.

Data subjects may further be entitled to a right to restriction of the processing of their data as well as a right to the release of the data they have provided in a structured, commonly used and machine-readable format.

If you have granted us consent to process personal data for specific purposes, you can withdraw your consent at any time with effect for the future. If we process your data to safeguard legitimate interests, you can object to this processing on grounds relating to your particular situation. If we cannot demonstrate compelling legitimate grounds for the further processing that override your interests, rights and freedoms, or if we process the data in question for the purpose of direct marketing, we will then no longer process your data.

In addition, you have the option of contacting a data protection supervisory authority (right of complaint).

rencolab GmbH

Uhlandstraße 1a 28211 Bremen

rencolab@rencolab.de +49 421 37845007

Last updated: July 2026