This Privacy Policy applies to the processing of personal data when you visit the DragLab website, submit a form, use our live chat, subscribe to company updates, respond to our communications or otherwise contact us through the website. Personal data means any information relating to an identified or identifiable natural person.

The website is hosted by a service provider whose servers used for this website are located in Germany. When you access the website, technical information is processed automatically in server log files. This may include:

• IP address of the requesting device
• date and time of access
• requested page or file and amount of data transferred
• referrer URL
• browser type and version
• operating system and device information
• access status and error information

Purpose and legal basis: This processing is necessary to deliver the website, maintain technical stability, detect misuse and protect the security of our systems. The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the secure, reliable and efficient operation of the website.

Retention: Server log data is generally deleted after no more than 14 days. It may be retained longer where this is necessary to investigate a security incident, establish or defend legal claims, or comply with a legal obligation.

We use cookies and similar technologies. Some are technically necessary for the website to function. Others are used for analytics, advertising or optional functions and are activated only after you provide the relevant consent through the cookie banner.

4.1 Technically necessary technologies

Technically necessary cookies and storage technologies may be used without consent where they are strictly necessary to provide a service expressly requested by the user. Their use is based on Section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG). Where personal data is processed, the legal basis is Article 6(1)(f) GDPR unless another legal basis applies.

4.2 Optional technologies

Analytics, advertising and optional communication technologies are activated only with your consent. Access to or storage of information on your device is based on Section 25(1) TDDDG, and the subsequent processing of personal data is based on Article 6(1)(a) GDPR.

4.3 Managing or withdrawing consent

You may grant, refuse or withdraw consent by category through the cookie banner and the Cookie Settings link available in the website footer. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. You may also delete cookies through your browser settings, although this may affect website functions.

The website provides forms for contacting us, requesting a quotation, requesting technical support, registering a warranty and applying to become a distributor. Depending on the form, we may process:

• name, salutation, job title, department and company name
• postal address, country, telephone number, fax number and email address
• subject, message and details of the enquiry or requested quotation
• product category, model, serial number, purchase date and failure date
• technical issue, requested service and files or information you choose to provide
• distribution interests, territory and other business information submitted by an applicant

Purposes and legal bases: We process form data to answer enquiries, prepare quotations, take pre-contractual steps, perform contracts, provide support, administer warranty requests and assess potential distribution relationships. The legal basis is Article 6(1)(b) GDPR where the request relates to a contract or pre-contractual measures. For general business communications and the administration of customer and partner relationships, the legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the effective handling of enquiries and business relationships. Where we specifically request consent, Article 6(1)(a) GDPR applies.

Please do not submit confidential personal data or special categories of personal data, such as medical or health information, unless we specifically request it and an appropriate legal basis and secure transmission method are available.

When you contact us, request a quotation or support, register a warranty, apply to become a distributor or otherwise begin a business relationship with us, we may use the contact details you provide to respond, clarify and follow up on your request, prepare and administer quotations, take pre-contractual steps, perform and manage contracts, and provide relevant service, technical support, warranty, product-safety and administrative communications. Depending on the context, the legal basis is Article 6(1)(b) GDPR or Article 6(1)(f) GDPR. Our legitimate interests are the effective handling of enquiries and the proper management of customer and partner relationships.

Marketing based on consent: Where a website form or another communication channel presents a marketing consent option and you actively select the corresponding checkbox or otherwise give express consent, we may use your email address to send product information, offers, newsletters and other promotional communications by email. The consent wording currently used below relevant website forms is: "I have read the Privacy Policy and agree to receive product information, offers, newsletters and other promotional communications by email." The marketing checkbox must be optional and not pre-selected. Refusing marketing consent does not prevent you from submitting a request or receiving contractual, support, warranty or other non-marketing services. The legal basis is Article 6(1)(a) GDPR. We may record information necessary to demonstrate when and how consent was given.

Once valid marketing consent has been given and recorded, we may add the email address to our regular marketing and newsletter list and use it to send communications about our products, services, offers, company news and other relevant commercial information. We may use an additional confirmation procedure where appropriate. Consent may be withdrawn at any time with effect for the future.

Marketing to existing customers: Where the requirements of Section 7(3) of the German Act Against Unfair Competition (UWG) are met, we may use an email address obtained from a customer in connection with the sale of goods or services, without requesting separate marketing consent, to send direct advertising for our own similar goods or services. This applies only if the customer has not objected and was clearly informed, when the address was collected and in every message sent on this basis, that its use for such advertising may be objected to at any time without costs other than the basic transmission costs. Such communications may include, where sufficiently similar to the previous purchase, information about comparable products, accessories, spare parts, replacement products, upgrades and related services. For messages sent on this basis, the recipient notice may state: "You are receiving this email because we obtained your email address in connection with a previous purchase from Nanodrag Technology GmbH (DragLab). We may use it to inform you about our own similar products and services. You may object to receiving such communications at any time by using the unsubscribe option in this email or by contacting us. No costs will arise other than the transmission costs according to the basic rates."

You may withdraw marketing consent or object to direct marketing at any time by using an unsubscribe option provided in the email, emailing info@drag-lab.de or replying to the message. If you object to direct marketing, we will no longer process your personal data for that purpose. Withdrawal or objection takes effect for the future and does not affect service, contractual, warranty, product-safety or other non-marketing communications that remain necessary or legally permitted. We may use authorised email delivery and business communication service providers acting under appropriate contractual and confidentiality obligations.

We use the Tawk.to live chat service to allow visitors to communicate with us directly. The chat is activated only after you consent to the relevant optional technology through the cookie banner. If you use the chat, the service may process the information you enter, such as your name, email address and message, together with technical and usage information such as IP address, device, browser, time of access and pages visited during the chat session.

The purpose is to answer enquiries and provide timely support. The legal basis for activating the service and its optional technologies is your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. Where a chat relates to a contract or requested pre-contractual measures, subsequent processing of the conversation may also be based on Article 6(1)(b) GDPR.

Provider information: Tawk.to Privacy Policy

With your consent, we use Microsoft Clarity to understand how visitors use the website and to improve navigation, content and usability. Clarity may process information about page views, clicks, scrolling, mouse movements, device and browser characteristics, approximate location derived from the IP address, referring pages and session interactions. We configure the service to avoid intentionally collecting information entered into sensitive form fields.

The legal basis is your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw consent through Cookie Settings at any time.

Further information: Microsoft Privacy Statement

With your consent, we use Google Analytics, a web analytics service provided by Google Ireland Limited. Google Analytics helps us measure website use and improve our content and services. It may process online identifiers, cookie identifiers, device and browser information, approximate location, referrer information, pages viewed, interactions and information about the effectiveness of campaigns.

IP address information is handled using the IP anonymisation and data minimisation features applicable to Google Analytics. We receive reports and statistics rather than information intended to identify individual visitors. Google processes analytics data on our behalf under a data processing agreement.

The legal basis is your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. User-level and event-level data associated with cookies and user identifiers is retained for up to 14 months in our Google Analytics settings, after which it is deleted automatically, subject to any shorter retention applied by Google.

Further information: Google Privacy Policy

With your consent, we use Google Ads conversion tracking to measure whether an advertisement leads to an action on our website, such as a page visit, enquiry or submitted form. Google may process cookie and advertising identifiers, device and browser information, ad interaction data, pages viewed and conversion events. We receive aggregated campaign and conversion information and do not receive information intended to identify individual visitors.

If you are signed in to a Google account, Google may associate information with that account in accordance with its own settings and privacy information. The legal basis for our use is your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw consent through Cookie Settings.

Further information: Google Privacy Policy

Personal data is accessible only to employees and authorised persons who require it for their duties. We may also use service providers for website hosting, website operation, email delivery, business communication, analytics, advertising, live chat, IT support and data storage. These providers receive only the information necessary for their services and, where they act as processors, are bound by data processing and confidentiality obligations.

We may disclose information to advisers, public authorities, courts or other recipients where this is required by law, necessary to establish or defend legal claims, or necessary to protect our rights or the rights of others.

Some service providers or their group companies may process personal data outside the European Economic Area, including in the United States. Where such transfers occur, we use an applicable transfer mechanism, such as an adequacy decision of the European Commission, participation in the EU-U.S. Data Privacy Framework where applicable, or European Commission Standard Contractual Clauses together with supplementary safeguards where required. Information about provider-specific processing is available through the privacy links in this Policy.

Unless a specific retention period is stated in this Policy, we retain personal data only for as long as necessary for the relevant purpose. We then delete or anonymise it unless continued storage is required by commercial, tax, product safety, warranty or other legal obligations, or is necessary to establish, exercise or defend legal claims. Contract and business records may therefore be retained for the periods required by applicable German law.

Subject to the conditions of the GDPR, you may have the following rights:

• access to your personal data (Article 15 GDPR)
• rectification of inaccurate or incomplete data (Article 16 GDPR)
• erasure of personal data (Article 17 GDPR)
• restriction of processing (Article 18 GDPR)
• data portability where applicable (Article 20 GDPR)
• objection to processing based on legitimate interests (Article 21 GDPR)
• withdrawal of consent at any time with effect for the future (Article 7(3) GDPR)
• the right not to be subject to a decision based solely on automated processing where Article 22 GDPR applies

To exercise your rights, contact info@drag-lab.de. We may request information reasonably necessary to verify your identity. Restrictions and statutory exceptions may apply to individual rights.

If we process your personal data on the basis of legitimate interests under Article 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation. We will stop the processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for legal claims.

You may object to the processing of personal data for direct marketing at any time. If you object, we will no longer process your personal data for that purpose.

You have the right to lodge a complaint with a data protection supervisory authority. The supervisory authority responsible for our registered office is:

The Hessian Commissioner for Data Protection and Freedom of Information (HBDI)
Postfach 3163
65021 Wiesbaden, Germany

https://datenschutz.hessen.de

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure and unauthorised access. These measures are reviewed and adjusted where appropriate, taking account of the nature of the processing, available technology and relevant risks.

We may update this Privacy Policy when our website, services, providers or legal requirements change. The current version and its update date will be published on this page. We recommend reviewing the Policy periodically.