Privacy Policy
Protecting your personal data is of great importance to us. We process your personal information in accordance with the applicable data protection regulations, in particular the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG).
This privacy policy serves to provide information about the type, scope and purpose of the collection and use of your personal data. It also informs you of your rights regarding the data we process.
Information About the Controller
Spira Labs GmbHLeopoldstraße 20
80802 Munich
Germany
Email: contact@spira-labs.ai
Contact details of the data protection officer
Data Protection OfficerSpira Labs GmbH
Leopoldstraße 20
80802 Munich
Germany
Email: dataprivacy@spira-labs.ai
A. Data Processing Information
When visiting our website, we temporarily process HTTP data on our web server to deliver the content you access. This processing is based on our legitimate interest (Article 6(1)(f) GDPR). Data is shared with the web host that acts as a processor (within the meaning of Art. 28 GDPR). Please see Section C for storage periods.
IT Infrastructure Security
We temporarily store and analyze server log files to detect, address, and document any IT disruptions, such as DDoS attacks. This processing is also based on our legitimate interest (Article 6(1)(f) GDPR). Please refer to Section C for storage details.
Cookies
Our website uses cookies. Cookies are small text files that may contain personal data and are stored by a website on the user’s device. There are both cookies that are necessary to operate the website or essential and cookies that are optional. You can also prevent cookie tracking in your browser settings. We might also provide a cookie dashboard that will allow you to manage your cookie preferences and we may process data related to your cookie choices and device. This is done based on our legitimate interest (Article 6(1)(f) GDPR). See Section C for storage periods.
Contact
When you contact us, we process your personal data to handle your enquiry. This may include requests for information about our products and services or questions relating to existing contractual relationships. The legal basis for this processing is our legitimate interest in responding to your request (Article 6(1)(f) GDPR). Where your enquiry relates to an existing or prospective contract, the legal basis is the performance of a contract (Article 6(1)(b) GDPR). Data may be shared with email service providers. See Section C for storage periods.
Appointment booking (Google Calendar)
On our “Demo vereinbaren” page we offer an appointment calendar provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The calendar is not loaded automatically. It is embedded only after you actively click “Kalender laden”, so no connection to Google is established if you simply read the page. Once you load it, your IP address, browser information and the fact that you visited this page are transmitted to Google, and Google may set cookies or use comparable storage on your device.
The legal basis for loading the calendar is your consent, given by clicking the button (Article 6(1)(a) GDPR); you can withhold it simply by not loading the calendar and using our contact form instead. If you go on to book an appointment, the data you enter there (in particular your name, email address and any information you add) is processed by Google on our behalf in order to arrange the appointment, on the basis of pre-contractual measures at your request (Article 6(1)(b) GDPR).
Google may process this data on servers outside the European Union. Please see Section C. Further information is available in Google’s privacy policy.
C. Transfer of data to third countries
We will only transfer personal data to recipients who process personal data outside the European Union (referred to as third countries) without your consent in accordance with Article 49(1)(a) GDPR if the recipient has an adequacy decision from the European Commission or appropriate safeguards for this third country. If you consent to the transfer of your personal data to third countries, we will transfer your data to the relevant third country without appropriate data protection safeguards. The transfer of personal data to third countries that do not offer an adequate level of data protection (in particular the USA) involves the risk that the data may be processed for the purposes of third parties without your knowledge and that the data may not be protected against access by third parties.
D. Periods for which your personal data are stored
We store your data only as long as necessary for the respective purpose (technical or legal). HTTP data and log files: retained for up to 3 months and longer in case of security incidents until the security-related event has been eliminated and clarified in full.
E. Collection of applicant data
You have the possibility to inform yourself about open positions at Spira Labs on our website. Your application is made via an application management tool. As part of the application process, the personal data you provide (including your name, contact details, qualifications and other application documents) will be processed for the purpose of reviewing and deciding whether to hire an applicant. Without providing personal data, an application cannot be considered. Your application documents and the personal data contained therein will be forwarded internally to the responsible and decision-making employees. The legal basis for this is Section 26 (1) of the German Federal DPA (Bundesdatenschutzgesetz).
We process voluntary information as part of your application on the basis of Section 26 Federal DPA in conjunction with Art. 6 (1) p. 1 lit. a GDPR. If you start an employment relationship with us, we will further process the data for the execution of this contract (Section 26 (1) Federal DPA). If you do not start employment with us, your personal data will be deleted within six months after the end of the application process. Provided you give your consent, we will store your data beyond this in order to inform you about new vacancies. The legal basis is Section 26 (1) Federal DPA processed in conjunction with Art. 6 (1) p. 1 lit. a GDPR.
F. No Obligation to provide data
You are not legally or contractually obliged to provide your personal data. However, without such data, certain website functionalities may not be available.
G. Your Rights as a Data Subject
Under the GDPR, you have the following rights:
- Right to information (Article 15 GDPR)
- Right to rectification (Article 16 GDPR)
- Right to cancellation (Right to be forgotten) (Article 17 GDPR)
- Restriction of Processing (Article 18 GDPR)
- Data Portability (Article 20 GDPR)
- Right to objection (Article 21 GDPR)
- Withdrawal of Consent (Article 7(3) GDPR)
- Lodging a complaint with a supervisory authority (Article 77 GDPR)
You may exercise these rights by contacting us using the details provided in this privacy policy.
H. Terminology used in this privacy policy
Key terms used in this Privacy Policy are defined as per the GDPR, including but not limited to:
Personal data or data: means any information relating to an identified or identifiable natural person. Someone who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Processing: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Controller: means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
Processor: Entity processing data on behalf of the controller.
Recipient: means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing.